Linux under WSL2 can be leaking • Hacker News Board

Re: Linux under WSL2 can be leaking

#31

Post by smarx007 » Wed, Sep 30, 2020, 6:45 PM UTC

The title is wrong. The VPN traffic does NOT leak. What leaks is the traffic that the VPN software tries to block when the VPN connection is not active. Mullvad uses Windows Firewall to block all internet access if VPN is not active (if the user configured so) and WSL2 bypasses this by not going through Windows Firewall. When the VPN is active, WSL2 traffic IS tunneled through the VPN.

UPD: The solution may be to have Windows Firewall rules apply to WSL2 or have Mullvad control Linux internet access through on-the-fly UFW settings update or completely disconnect internet (but that likely does not work nicely and is why Mullvad went for the Windows Firewall based solution in the first place).

Re: Linux under WSL2 can be leaking

#32

Post by wutwutwutwut » Wed, Sep 30, 2020, 6:46 PM UTC

mikece wrote: post #3

Voline wrote: post #2

We have tested a few other VPN clients from competitors and found that all of them leak in the same way. The way Microsoft has implemented virtual networking for Linux guests makes it very difficult to properly secure them.

I would think that anyone who relies on a VPN for safety or is really particularly security conscious (1) isn't using Windows 10, (2) has networking disabled if they are using it, for example, in a VM, and (3) is probably using a dedicated device like a Slate router or pfSense box as their VPN point.

Are you saying that you don't think there is anyone on Windows who is using a VPN to hide their pirating activities? If so, you can borrow a needle from me and pop that bubble.

Re: Linux under WSL2 can be leaking

#33

Post by ajross » Wed, Sep 30, 2020, 6:46 PM UTC

AndrewDucker wrote: post #26

So, if I'm understanding correctly the Linux system gets access to the raw Ethernet system, and so bypasses the Windows firewall. Seems not entirely unreasonable - if you want Linux to use a firewall then install one into it. But it should definitely be well publicised/documented, because otherwise people won't realise they have a gaping hole in their greens m defences.

Right, this is as much a feature as it is a bug. But it's absolutely something that should be documented and under control of the host-side security layer.

Re: Linux under WSL2 can be leaking

#34

Post by muststopmyths » Wed, Sep 30, 2020, 6:50 PM UTC

GekkePrutser wrote: post #20

qz2 wrote: post #7

Earlier quoted context omitted.

It’s a shit show. Can’t trace packets either via wireshark on the host and tcpdump doesn’t work on the guest. I’ve gone back to virtualbox and eviscerated WSL. Another total waste of my life.

Conceptually this makes sense. It doesn't really run Under windows, it runs beside windows. Unlike WSL1 which was basically part of Windows. It's strange tcpdump doesn't run though as WSL2 is running a real kernel. Personally I really liked the resource efficient WSL1 approach and I lament that they dropped it. But I know for some usecases (e.g. docker) a real Linux kernel was needed.

>It's strange tcpdump doesn't run though as WSL2 is running a real kernel.

It works just fine. Just tested it

Re: Linux under WSL2 can be leaking

#35

Post by Enginerrrd » Wed, Sep 30, 2020, 6:52 PM UTC

shmerl wrote: post #11

Using WSL should be a very last resort anyway. Just use Linux straight on your hardware if you have a choice and ditch Windows.

Yeah I've never understood the use case there exactly....

Re: Linux under WSL2 can be leaking

#36

Post by qz2 » Wed, Sep 30, 2020, 6:53 PM UTC

muststopmyths wrote: post #34

GekkePrutser wrote: post #20

Earlier quoted context omitted.

Conceptually this makes sense. It doesn't really run Under windows, it runs beside windows. Unlike WSL1 which was basically part of Windows. It's strange tcpdump doesn't run though as WSL2 is running a real kernel. Personally I really liked the resource efficient WSL1 approach and I lament that they dropped it. But I know for some usecases (e.g. docker) a real Linux kernel was needed.

>It's strange tcpdump doesn't run though as WSL2 is running a real kernel. It works just fine. Just tested it

Try dumping UDP packets from the host to the WSL machine...

Re: Linux under WSL2 can be leaking

#37

Post by jdc » Wed, Sep 30, 2020, 6:53 PM UTC

speedgoose wrote: post #29

Aaronstotle wrote: post #24

Earlier quoted context omitted.

Also a huge fan of paying with BTC and their use of account ids instead of emails, wish they would accept XMR also.

Did you consider the average pollution of bitcoin transactions?

Do you have a number for us?

Re: Linux under WSL2 can be leaking

#38

Post by Animats » Wed, Sep 30, 2020, 6:55 PM UTC

Why would someone run a VPN client on Linux under Windows, anyway, as opposed to just running it on Windows?

Re: Linux under WSL2 can be leaking

#39

Post by Jonnax » Wed, Sep 30, 2020, 6:58 PM UTC

shmerl wrote: post #11

Using WSL should be a very last resort anyway. Just use Linux straight on your hardware if you have a choice and ditch Windows.

Why? In my opinion Linux desktop environments are terrible compared to Windows.

How's the display scaling these days? Is it still a better experience to run a 4k monitor at a lower resolution? What's the Nvidia driver situation? Still janky because their drivers are doing their own thing?

Re: Linux under WSL2 can be leaking

#40

Post by smartbit » Wed, Sep 30, 2020, 7:02 PM UTC

speedgoose wrote: post #29

Aaronstotle wrote: post #24

Earlier quoted context omitted.

Also a huge fan of paying with BTC and their use of account ids instead of emails, wish they would accept XMR also.

Did you consider the average pollution of bitcoin transactions?

Good question.

OTOH, did anyone ever consider the average pollution of the banking system? 10.000th of banks, 200+ central banks, BIS, IMF, ECB, etc, etc. Millions of employees, millions of desktops & servers, day-in-day out. Anyone with a link to a guestimate?