Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux under WSL2 can be leaking

mullvad.net

Post reply on HN
Print view View original

21–30 of 194 posts

Re: Linux under WSL2 can be leaking

#21

Post by jeroenhd »

jetpackjoe wrote: post #6
mikece wrote: post #3

Earlier quoted context omitted.

I would think that anyone who relies on a VPN for safety or is really particularly security conscious (1) isn't using Windows 10, (2) has networking disabled if they are using it, for example, in a VM, and (3) is probably using a dedicated device like a Slate router or pfSense box as their VPN point.

With the way these companies advertise, they make it seem like a silver bullet for internet anonymity. Almost every YouTube video I've seen recently seems to have one as a sponsor, and I am sure they are picking up many non-technical customers. I don't think users of NordVPN, ExpressVPN, MullvadVPN et al. are as sophisticated as you think.

The non-technical customers probably aren't running WSL2 either. In fact I think very few of them actually need a VPN. Those who torrent in litigious countries have a benefit from their VPN provider but I doubt most others don't know about the behaviour changes that need to take place to make a VPN effective.

I think VPNs can be a powerful tool for many people who would normally not be able to find out about their existence, but the predatory nature modern VPN ads have taken is quite sad.

This leads to some cases of Youtube fan bases angrily calling out shitty VPN ads while the video creators just want to pay their bills, a situation nobody wants.

Re: Linux under WSL2 can be leaking

#22

Post by GekkePrutser »

jetpackjoe wrote: post #6
mikece wrote: post #3

Earlier quoted context omitted.

I would think that anyone who relies on a VPN for safety or is really particularly security conscious (1) isn't using Windows 10, (2) has networking disabled if they are using it, for example, in a VM, and (3) is probably using a dedicated device like a Slate router or pfSense box as their VPN point.

With the way these companies advertise, they make it seem like a silver bullet for internet anonymity. Almost every YouTube video I've seen recently seems to have one as a sponsor, and I am sure they are picking up many non-technical customers. I don't think users of NordVPN, ExpressVPN, MullvadVPN et al. are as sophisticated as you think.

If they're not that sophisticated they probably won't use WSL anyway though, so it's not a huge issue in that sense (unless some malware specifically installs WSL2 to get around it).

Re: Linux under WSL2 can be leaking

#23

Post by adriancr »

sally1620 wrote: post #19

This is the exact reason I didn't try running weird VPN configs like this. The reliable way is to run Linux inside a VirtualBox and have it connected to VPN on its own. Currently, I run Linux on a Xen domU and configure VPN client inside the guest. PS: I don't want all my traffic to go through VPN. Especially things like Netflix or Youtube where VPNs are blocked (and VPN BW is lower anyway).

You can set up a docker vpn client as well

Re: Linux under WSL2 can be leaking

#24

Post by Aaronstotle »

wing-_-nuts wrote: post #16

A bit off topic, but this sort of transparency is why I don't mind paying $6 / mo for a vpn when mullvad's competitors are much cheaper. Their wireguard support is great, and their speeds are much faster than what I got through openVpn on pia.

Also a huge fan of paying with BTC and their use of account ids instead of emails, wish they would accept XMR also.

Re: Linux under WSL2 can be leaking

#26

Post by AndrewDucker »

So, if I'm understanding correctly the Linux system gets access to the raw Ethernet system, and so bypasses the Windows firewall. Seems not entirely unreasonable - if you want Linux to use a firewall then install one into it.

But it should definitely be well publicised/documented, because otherwise people won't realise they have a gaping hole in their greens m defences.

Re: Linux under WSL2 can be leaking

#27

Post by kodablah »

I have noticed similar simply because the Cisco AnyConnect client doesn't work with WSL2 and is a known issue [0]. But that seemed to be blocking traffic instead of just allowing all traffic over non-VPN. However, openconnect does work fine as does the UWP-based AnyConnect client. I wonder how those latter two are successful tunneling traffic (or if it's only if they are started before the wsl2 vm is).

0 - https://github.com/microsoft/WSL/issues/4277

Re: Linux under WSL2 can be leaking

#28

Post by gambiting »

mikece wrote: post #3
Voline wrote: post #2

We have tested a few other VPN clients from competitors and found that all of them leak in the same way. The way Microsoft has implemented virtual networking for Linux guests makes it very difficult to properly secure them.

I would think that anyone who relies on a VPN for safety or is really particularly security conscious (1) isn't using Windows 10, (2) has networking disabled if they are using it, for example, in a VM, and (3) is probably using a dedicated device like a Slate router or pfSense box as their VPN point.

The reason why I route all of my traffic through a VPN is simple - in the UK all ISPs have to keep the history of all your browsing for a year. I want to avoid that. That's it. I just don't like this requirement, especially since lots of agencies can access this data without any kind of warrant - so this is like my own little personal protest against this stupid law. Nothing more complex than that.

Re: Linux under WSL2 can be leaking

#29

Post by speedgoose »

Aaronstotle wrote: post #24
wing-_-nuts wrote: post #16

A bit off topic, but this sort of transparency is why I don't mind paying $6 / mo for a vpn when mullvad's competitors are much cheaper. Their wireguard support is great, and their speeds are much faster than what I got through openVpn on pia.

Also a huge fan of paying with BTC and their use of account ids instead of emails, wish they would accept XMR also.

Did you consider the average pollution of bitcoin transactions?
Post reply on HN