(I see posts elsewhere in the thread now describing how to do this with iptables.)
the firewall on the gateway vpc has to be on drop by default and only forward traffic from the 2nd vpc to the vpn interface.
the gateway vpc should NEVER provide DHCP or DNS to the second vpc since this is the easiest way to shoot your foot off since a single dns request may give your identity away.
that or use qubes os.
Road & Rail networks have a lot in common with digital networks, when you think about it.
Personally I'd have a machine in a foreign country and used that either via an app or friend in front of the machine to do the download(s) with a time delay to avoid obvious links and then sneak it back across the border in bits.
Insecure home networks can be useful, and there is no limit to the number of times and algo's that can be used to encrypt files Russian Doll style.
Foreign country's which do not data share or extradite have their uses, but media like news orgs, Youtube and others can be helpful for establishing what hackers have been extradited. Assume all country's have hackers attacking the US or some other country and then look for missing news stories, YT videos and that sort of thing.
Then look into what relations are like between the two country's and go from there.
If you do your research or homework there shouldnt be any risks.
I dont think the hackers behind this have ever been caught. https://www.bbc.co.uk/iplayer/episode/m0010s10/the-trick
https://web.archive.org/web/20120719071718/http://www.norfol...