Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux under WSL2 can be leaking

mullvad.net

Post reply on HN
Print view View original

101–110 of 194 posts

Re: Linux under WSL2 can be leaking

#101

Post by TwoNineFive »

smarx007 wrote: post #31

The title is wrong. The VPN traffic does NOT leak. What leaks is the traffic that the VPN software tries to block when the VPN connection is not active. Mullvad uses Windows Firewall to block all internet access if VPN is not active (if the user configured so) and WSL2 bypasses this by not going through Windows Firewall. When the VPN is active, WSL2 traffic IS tunneled through the VPN. UPD: The solution may be to hav…

The title is correct. For example, a remote attacker could induce the transmission of unencrypted packets by taking the tunnel down by means of DoS attack.

Basically, the tunnel doesn't leak under ideal conditions, with non-ideal conditions being trivial to induce.

For example, StrongSwan (IPSec) talks about this in their best practices page here: https://wiki.strongswan.org/projects/strongswan/wiki/Securit...

The StrongSwan process can do some tricks to tell linux to not allow this outbound traffic by creating a kind of dummy/shunt tunnel. Also, iptables should be used to prevent the outbound transmission of non-ipsec traffic to that destination.

It's notable that I had a run-in with this issue a year or so ago with Ubiquiti Edgerouters, which run a fork of Vyatta. They don't allow the "-m policy --pol none --dir out" iptables module to be used in configuration, even though the underlaying linux kernel supports it. They even support it's use in-bound. Pure stupidity, if not malice.

Yes I am a network engineer.

Re: Linux under WSL2 can be leaking

#102

Post by donor20 »

sneak wrote: post #94
smarx007 wrote: post #31

The title is wrong. The VPN traffic does NOT leak. What leaks is the traffic that the VPN software tries to block when the VPN connection is not active. Mullvad uses Windows Firewall to block all internet access if VPN is not active (if the user configured so) and WSL2 bypasses this by not going through Windows Firewall. When the VPN is active, WSL2 traffic IS tunneled through the VPN. UPD: The solution may be to hav…

That’s exactly what leaking means. Traffic that is supposed to be vpn-or-nothing is going out in the clear.

Is Windows firewall supposed to apply to WSL? I never expected that! I'm serious - I run a different firewall on my onlinux.

Can you confirm that WSL is supposed to be dealing with (the nightmare) of the windows firewall for internet access? How does fedora / ubuntu etc coordinate / know to do this?

Re: Linux under WSL2 can be leaking

#103

Post by donor20 »

The idea of the a linux distribution is going to be using the WINDOWS firewall?? seems a bit crazy to me.

I expect the distributions on WSL to use their own firewall - that's half of the fun of using WSL.

PLEASE don't push fake news like this that results in distribution on WSL having to deal with / modify the window firewall - that would be a total nightmare!

Re: Linux under WSL2 can be leaking

#104

Post by unixhero »

ss3000 wrote: post #53
wing-_-nuts wrote: post #16

A bit off topic, but this sort of transparency is why I don't mind paying $6 / mo for a vpn when mullvad's competitors are much cheaper. Their wireguard support is great, and their speeds are much faster than what I got through openVpn on pia.

I love everything about Mullvad except their device limit, which is unfortunately a deal breaker for me. 5 is completely inadequate for my use cases.

Is it not fair that you pay for another subscription if you go beyond 5 devices? They do provide a service with their finite resources. It is not a mega corporation.

Re: Linux under WSL2 can be leaking

#105

Post by dymax78 »

sneak wrote: post #94
smarx007 wrote: post #31

The title is wrong. The VPN traffic does NOT leak. What leaks is the traffic that the VPN software tries to block when the VPN connection is not active. Mullvad uses Windows Firewall to block all internet access if VPN is not active (if the user configured so) and WSL2 bypasses this by not going through Windows Firewall. When the VPN is active, WSL2 traffic IS tunneled through the VPN. UPD: The solution may be to hav…

That’s exactly what leaking means. Traffic that is supposed to be vpn-or-nothing is going out in the clear.

No one is disputing the definition of "leak(ing)" rather what traffic is being leaked, which is not VPN traffic as the title suggests and the Mullvad link clearly explains. edit: the title has since been modified.

Re: Linux under WSL2 can be leaking

#106

Post by donor20 »

AndrewDucker wrote: post #26

So, if I'm understanding correctly the Linux system gets access to the raw Ethernet system, and so bypasses the Windows firewall. Seems not entirely unreasonable - if you want Linux to use a firewall then install one into it. But it should definitely be well publicised/documented, because otherwise people won't realise they have a gaping hole in their greens m defences.

Huh - you want linux distributions to have to play with the windows firewall rules? You want windows firewall getting messed up by linux containers?

These VPN authors are just idiots - let's stop over complicating things. Half the time people LIKE that they can use linux firewall features on their linux hosts for stuff.

Re: Linux under WSL2 can be leaking

#107

Post by dang »

smarx007 wrote: post #31

The title is wrong. The VPN traffic does NOT leak. What leaks is the traffic that the VPN software tries to block when the VPN connection is not active. Mullvad uses Windows Firewall to block all internet access if VPN is not active (if the user configured so) and WSL2 bypasses this by not going through Windows Firewall. When the VPN is active, WSL2 traffic IS tunneled through the VPN. UPD: The solution may be to hav…

We changed the title from "Linux Under Windows Subsystem for Linux 2 Leaks VPN Traffic" to the article's own title. That's in the site guidelines: "Please use the original title, unless it is misleading or linkbait; don't editorialize."

https://news.ycombinator.com/newsguidelines.html

Re: Linux under WSL2 can be leaking

#108

Post by wasmitnetzen »

donor20 wrote: post #102
sneak wrote: post #94

Earlier quoted context omitted.

That’s exactly what leaking means. Traffic that is supposed to be vpn-or-nothing is going out in the clear.

Is Windows firewall supposed to apply to WSL? I never expected that! I'm serious - I run a different firewall on my onlinux. Can you confirm that WSL is supposed to be dealing with (the nightmare) of the windows firewall for internet access? How does fedora / ubuntu etc coordinate / know to do this?

The firewall probably applied in the non-virtualized WLS1, but doesn't anymore in the new Hyper-V-based WSL2.

Re: Linux under WSL2 can be leaking

#109

Post by eptcyka »

TwoNineFive wrote: post #101
smarx007 wrote: post #31

The title is wrong. The VPN traffic does NOT leak. What leaks is the traffic that the VPN software tries to block when the VPN connection is not active. Mullvad uses Windows Firewall to block all internet access if VPN is not active (if the user configured so) and WSL2 bypasses this by not going through Windows Firewall. When the VPN is active, WSL2 traffic IS tunneled through the VPN. UPD: The solution may be to hav…

The title is correct. For example, a remote attacker could induce the transmission of unencrypted packets by taking the tunnel down by means of DoS attack. Basically, the tunnel doesn't leak under ideal conditions, with non-ideal conditions being trivial to induce. For example, StrongSwan (IPSec) talks about this in their best practices page here: https://wiki.strongswan.org/projects/strongswan/wiki/Securit... The St…

If you were to inspect the Mullvad client and how it works on Linux, you'd find that it uses nftables to ensure that traffic only flows through the tunnel. The issue here is that a similar OS provided construct doesn't do that on Windows.

Re: Linux under WSL2 can be leaking

#110

Post by eptcyka »

donor20 wrote: post #102
sneak wrote: post #94

Earlier quoted context omitted.

That’s exactly what leaking means. Traffic that is supposed to be vpn-or-nothing is going out in the clear.

Is Windows firewall supposed to apply to WSL? I never expected that! I'm serious - I run a different firewall on my onlinux. Can you confirm that WSL is supposed to be dealing with (the nightmare) of the windows firewall for internet access? How does fedora / ubuntu etc coordinate / know to do this?

It's somewhat unintuitive that a virtualized guest can circumvent the host's firewall/network stack when the guest doesn't have an explicitly bridged or passthrough'd physical adapter.
Post reply on HN