Hacker News Reader

Comment by vmoore | Hacker News Reader

I've toyed with some VPN browser extensions. Not naming names. I became a customer of a few VPNs over the years, to try some of these extensions out, and the extensions leak your real IP inadvertently. One such extension said it was 'connected' when I DuckDuckGo'd 'what is my ip' and it reported my real / naked IP.

So my solution was to use a (hardware) VPN router which ensures all your traffic is tunneled through the VPN and you don't have to worry about edge cases like this leaking your real IP. Also: many users don't even turn off WebRTC which can expose you too. Many people it seems, don't know about the WebRTC VPN vuln that was disclosed many years ago.

Edit: I reported these extension vulns and they got fixed, but I still don't trust them.

View on HN

Regarding WebRTC-type leaks probably the best answer on Linux is to have a separate network namespace with only wg0 inside of it and then run your browser in the network namespace. Then the browser does not get to "see" the real egress interface/its IP and thus can't leak it even if it wanted to. Or, if you want this to apply for everything, move physical interface in its own namespace so all apps from the default namespace only see the WireGuard interface. See https://www.wireguard.com/netns/

I actually did something similar to this for slightly different use case. I needed to connect to two different VPNs simultaneously that had overlapping cidr ranges. So I created a network namespace for one of them, and used that for any connections that needed that VPN, and used the root network namespace for the other VPN. I did have to create two separate browser profiles though, since both firefox and chrome won't let you run multiple instances of the same profile simultaneously.

VPN browser extensions are merely proxies and most likely will leak you IP/privacy. I've written a blog post on this topic: https://blog.innerht.ml/vpn-extensions-are-not-for-privacy/

you can still get dns leaks with hardware vpn i think.

If your route to the DNS server is through your VPN router, you are protected.

DNS leaks are a subset of the problem where not all of your traffic goes through the VPN routes. If your only connection to the internet is through the VPN, the odds of that happening approaches 0%. If you're using some browser extension, the odds of that happening approaches 100%

Reply on news.ycombinator.com