<story><title>Unpatched iOS bug blocks VPNs from encrypting all traffic</title><url>https://www.bleepingcomputer.com/news/security/unpatched-ios-bug-blocks-vpns-from-encrypting-all-traffic/</url></story><parent_chain><item><author>rsync</author><text>This is why I use a &amp;quot;slug&amp;quot; when I use a VPN.&lt;p&gt;A &amp;quot;slug&amp;quot; is a layer-2 bridge, with no IP address configured, that still enforces a TCP&amp;#x2F;IP whitelist.  So it does not &amp;quot;use&amp;quot; a hop on the network route, and you can&amp;#x27;t see the device, but as it bridges traffic it enforces a (very simple) ruleset.&lt;p&gt;In my case, I use my own VPN hosts that transact over TCP22 ... and so my network &amp;quot;slug&amp;quot; allows &lt;i&gt;only tcp port 22 traffic&lt;/i&gt;.  Everything else is blocked.&lt;p&gt;This means that no matter how badly behaved (or buggy) my VPN software is (I use sshuttle[1]) the bad behavior is blocked by the slug.&lt;p&gt;The slug itself has almost zero attack surface as it is a BSD based system that &lt;i&gt;has no IP address configured&lt;/i&gt; and runs no network services.&lt;p&gt;I keep meaning to write up a blog entry about this ...&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;sshuttle.readthedocs.io&amp;#x2F;en&amp;#x2F;stable&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;sshuttle.readthedocs.io&amp;#x2F;en&amp;#x2F;stable&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>zamadatix</author><text>I haven&amp;#x27;t heard &amp;quot;slug&amp;quot; before, is that your own phrase? It sounds like you&amp;#x27;ve implemented what&amp;#x27;s known as a stateless transparent firewall if I&amp;#x27;m understanding what you&amp;#x27;ve said correctly. Stateless because it&amp;#x27;s just plain ACLs, transparent because it&amp;#x27;s not a routed hop&amp;#x2F;isn&amp;#x27;t detectable by the client (outside traffic being dropped), and firewall because it&amp;#x27;s filtering unauthorized traffic. Most people just call it &amp;quot;ACLs&amp;quot; for short though since &amp;quot;stateless transparent firewall&amp;quot; is a bit of a mouthful and &amp;quot;firewall&amp;quot; by itself often implies a routed mode stateful firewall.</text></comment>
<story><title>Unpatched iOS bug blocks VPNs from encrypting all traffic</title><url>https://www.bleepingcomputer.com/news/security/unpatched-ios-bug-blocks-vpns-from-encrypting-all-traffic/</url></story><parent_chain><item><author>rsync</author><text>This is why I use a &amp;quot;slug&amp;quot; when I use a VPN.&lt;p&gt;A &amp;quot;slug&amp;quot; is a layer-2 bridge, with no IP address configured, that still enforces a TCP&amp;#x2F;IP whitelist.  So it does not &amp;quot;use&amp;quot; a hop on the network route, and you can&amp;#x27;t see the device, but as it bridges traffic it enforces a (very simple) ruleset.&lt;p&gt;In my case, I use my own VPN hosts that transact over TCP22 ... and so my network &amp;quot;slug&amp;quot; allows &lt;i&gt;only tcp port 22 traffic&lt;/i&gt;.  Everything else is blocked.&lt;p&gt;This means that no matter how badly behaved (or buggy) my VPN software is (I use sshuttle[1]) the bad behavior is blocked by the slug.&lt;p&gt;The slug itself has almost zero attack surface as it is a BSD based system that &lt;i&gt;has no IP address configured&lt;/i&gt; and runs no network services.&lt;p&gt;I keep meaning to write up a blog entry about this ...&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;sshuttle.readthedocs.io&amp;#x2F;en&amp;#x2F;stable&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;sshuttle.readthedocs.io&amp;#x2F;en&amp;#x2F;stable&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>BeefySwain</author><text>This concept is often referred to as a &amp;quot;VPN killswitch&amp;quot; as well (though that is really a misnomer, IMO).&lt;p&gt;Popular with pirates because having torrent activity leaked to your ISP is not great.</text></comment>