VPN leak

[AdamLMark]

I received an alert from Untangle firewall that it detected BitTorrent traffic. Untangle should never be able to see this as long as the VPN is working properly.

Untangle alert 1:

Event: ApplicationControlLogEvent
remote addr = 192.168.11.1

Untangle alert 2:

Event: ApplicationControlLogEvent
remote addr = 192.168.1.1

Edit: this happens even with DROP_DEFAULT_ROUTE=true

Edit 2: I noticed in each case, the remote IPs were in the 192.168.x.y range, so I made the local network much smaller and it hasn't happened again since!

New:

LOCAL_NETWORK=192.168.100.0/24

Old:

LOCAL_NETWORK=192.168.0.0/16

[edgd1er]

you may check inside the container if openvpn is still up, what is the default route, and what interface are up.

Normally, default route is removed when vpn connection is up, so whenever openvpn is stopped/killed, the down.sh script stops all apps. Without default route no traffic can reach the gateway.

Worst case scenario, for any reason your openvpn has stopped, the down script was not fired. transmission is still running. default route was not removed .... very unlikely though.

Is your image up to date ?
Could this be specific to PIA and its port forwarding feature ?

[AdamLMark]

Thanks for your reply, edgd1er!

Routes:

root:/# ip r
0.0.0.0/1 via 10.58.112.1 dev tun0
default via 172.28.0.1 dev eth0
10.0.0.243 dev tun0 scope link
10.58.112.0/24 dev tun0 proto kernel scope link src 10.58.112.27
128.0.0.0/1 via 10.58.112.1 dev tun0
172.28.0.0/16 dev eth0 proto kernel scope link src 172.28.0.2
172.98.80.124 via 172.28.0.1 dev eth0
192.168.0.0/16 via 172.28.0.1 dev eth0

Looks like the default route was not deleted... I will try setting DROP_DEFAULT_ROUTE

Yes, the image is up to date (stable). It is brand new as of a few days ago.

[AdamLMark]

I set DROP_DEFAULT_ROUTE=true and the routing table no longer has the default route:

root:/# ip r
0.0.0.0/1 via 10.5.112.1 dev tun0
10.0.0.243 dev tun0 scope link
10.5.112.0/24 dev tun0 proto kernel scope link src 10.5.112.31
128.0.0.0/1 via 10.5.112.1 dev tun0
172.28.0.0/16 dev eth0 proto kernel scope link src 172.28.0.2
178.249.214.102 via 172.28.0.1 dev eth0
192.168.0.0/16 via 172.28.0.1 dev eth0

[AdamLMark]

Unfortunately, that didn't help. Just got another Untangle alert!

[usma0118]

strange.. i am using Cilium network policy to restrict traffic. i haven't faced this issue.

[AdamLMark]

It has been 2 months now with no alerts from Untangle. Edit 2 seems to have resolved the issue!