Open ports expose VPN users’ real IP

[hugomueller 13]

https://www.perfect-privacy.com/blog/2015/12/21/wrong-way-security-problem-exposes-real-ip/

 

 

Another VPN security problem was found: “Wrong Way” may reveal the user’s real IP address like “Port Fail“. This time are not only providers with port forwarding affected but rather all providers, they havn’t fixed the problem. The underlying problem is that packets received over the real IP will be answered via the VPN interface under certain conditions.

 

 

@AirVPN

Does your client handle this problem with the Network Lock?

[zhang888 1066]

The Network Lock will prevent this among many other things.

 

However, this vulnerability will only occur when you have:

 

1) A router with UPNP enabled

2) An application that listens on UDP ports

[produs 1]

Does't  Eddie listens on UDP ports?

[Ammonia 2]

This is mitigated with Network Lock, no problem here.

[produs 1]

Okay. Thank you!!

[airvpnmember 0]

Hi Guys,

 

how does this affect those who have OpenVPN client running on a router?

 

Thank you.

[Staff 9972]

Hello!
 
1) It's not that Network Lock "mitigates" the issue, it does solve it entirely at its root.
 
2) Again, this is much ado about nothing. According to our instructions, it's since 2010 that we instruct how to avoid correlations of these kinds (disable UPnP for example: 5 years ago it was already written in our proto web site). Those VPNs teams that show much concern and exploit sensationalism are just sending a message to gullible and inexperienced people. All the other persons can clearly see that this sensationalism hints to a lack of competence about the most basic and trivial routing concepts.
 
See also this nice article, which treats so called "Port Fail" in addition to other issues (including the one treated in this thread).

Another “critical” “VPN” “vulnerability” and why Port Fail is bullshit
https://medium.com/@ValdikSS/another-critical-vpn-vulnerability-and-why-port-fail-is-bullshit-352b2ebd22e2#.vgjazzmz8

and how the Great ValdikSS (author of the article and probably reading us) could get (according to his own words which we feel to share) a total of 7300 USD for "such a bullshit issue" (from les incompétents, we would be tempted to add).

Kind regards

[trekkie.forever 6]

Hi Guys,

 

how does this affect those who have OpenVPN client running on a router?

 

Thank you.

 

Good question, I connect to Air servers using the included OpenVPN client on Asuswrt Merlin with UPnP off. Are there any further precautions needed and what about those on dd-wrt, tomato or even pfsense?

[Staff 9972]

 

Hi Guys,

 

how does this affect those who have OpenVPN client running on a router?

 

Thank you.

 

Good question, I connect to Air servers using the included OpenVPN client on Asuswrt Merlin with UPnP off. Are there any further precautions needed and what about those on dd-wrt, tomato or even pfsense?

 

Note these rules (on the guide about how to forward ports in DD-WRT etc.):

 

https://airvpn.org/topic/9270-how-to-forward-ports-in-dd-wrt-tomato-with-iptables

 

iptables -I FORWARD -i tun1 -p udp -d destIP --dport port -j ACCEPT

iptables -I FORWARD -i tun1 -p tcp -d destIP --dport port -j ACCEPT

iptables -t nat -I PREROUTING -i tun1 -p tcp --dport port -j DNAT --to-destination destIP

iptables -t nat -I PREROUTING -i tun1 -p udp --dport port -j DNAT --to-destination destIP

 

Bold is ours to make the answer to your question clearer.

 

Kind regards

[Kepler_438b2 4]

I had not turned off UPNP until now (but always used Network Block). Would leaving UPNP on have left me vulnerable? Thanks. BTW, you guys do a great job!

[Staff 9972]

I had not turned off UPNP until now (but always used Network Block). Would leaving UPNP on have left me vulnerable? Thanks. BTW, you guys do a great job!

 

Hello!

 

Don't worry, since you had Network Lock on UPnP did not expose your system to correlations.

 

Kind regards

[User of AirVPN 46]

Hello!

 

1) It's not that Network Lock "mitigates" the issue, it does solve it entirely at its root.

 

2) Again, this is much ado about nothing. According to our instructions, it's since 2010 that we instruct how to avoid correlations of these kinds (disable UPnP for example: 5 years ago it was already written in our proto web site). Those VPNs teams that show much concern and exploit sensationalism are just sending a message to gullible and inexperienced people. All the other persons can clearly see that this sensationalism hints to a lack of competence about the most basic and trivial routing concepts.

 

See also this nice article, which treats so called "Port Fail" in addition to other issues (including the one treated in this thread).

 

Another “critical” “VPN” “vulnerability” and why Port Fail is bullshit

https://medium.com/@ValdikSS/another-critical-vpn-vulnerability-and-why-port-fail-is-bullshit-352b2ebd22e2#.vgjazzmz8

 

and how the Great ValdikSS (author of the article and probably reading us) could get (according to his own words which we feel to share) a total of 7300 USD for "such a bullshit issue" (from les incompétents, we would be tempted to add).

 

Kind regards

I use ESET Smart Security's Firewall, so Network Lock doesn't work for me because it uses Windows Firewall. I was wondering if maybe you know what rules to set in ESET's firewall and what IPs to allow/deny so that only AirVPN traffic is allowed?