Real-ip leaked with VPN turned on

kabut · 2024-09-26T15:06:07.567Z

I recently experience an issue on GL.iNet GL-MT3000 router. My VPN was connected throughout but a window of a few minutes my data was leaked. I suspect this since my corp tailscale client on my machine blocked me for a few minutes and that can happen if tailscale becomes aware of the real-ip.

VPN config
client
dev tun
proto udp
remote 443
resolv-retry infinite
nobind
persist-key
persist-tun
persist-remote-ip
verify-x509-name name
auth-user-pass
comp-lzo
keepalive 10 60
verb 3
auth SHA256
cipher BF-CBC
data-ciphers-fallback BF-CBC
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA

I did not have "Block Non-VPN Traffic" setting turned on at that time. Would it help to turn it on? I also have the VPN set as Global Proxy on the router.

admon · 2024-09-26T15:44:11.608Z

Do you have any proof that it was an IP leak and not just some other issue like a connection timeout?

kabut · 2024-09-26T16:00:34.081Z

admon:

have any proof that it was an IP leak and not just some other issue like a connection timeout

Not really but the issue persisted for 2-3minutes and in that window the tailscale client got into a "Blocked" state. The issue resolved itself after a restart.

admon · 2024-09-26T16:26:28.540Z

This could be anything - without proper testing no way to troubleshoot, imho.

kabut · 2024-09-26T17:00:49.633Z

admon:

out proper testing no way to troubleshoot, imho.

I spoke with the VPN provider (for the router VPN client) and they said that there was an error " Error 6050 usually means that the connection was successful, but the post-connection call to our servers to verify a "good" connection failed, so the connection was terminated ." in that timeframe which could explain. I think the VPN client on the router probably did not handle that error properly.

Am not able to retry the router with this error simulated, however could you check with the team if VPN client is handling such class of errors?

kabut · 2024-10-03T21:24:28.474Z

Any update here?

xize11 · 2024-10-04T07:15:59.771Z

this happens when you just switch it to on?

Correct?

make sure its only checked against turning on, for turning off such things are normal because the killswitch won't work on a manual user interaction.

as a work around you can enable Block Non-VPN Traffic.

or when you want more advanced fine control:

via luci -> network -> firewall, and then remove the forwarding zone wan from the lan zone, if vpn policies fail you can type ip rule in the cli you will find the mark for wan, then just make a traffic rule allowing every traffic with this mark to passthrough wan like:

src: any zone
dest zone: wan
match mark: (a hexadecimal long string from ip rule)
target/action: accept

kabut · 2024-10-04T15:42:38.590Z

xize11:

as a work around you can enable Block Non-VPN Traffic.

I have turned on Block Non-VPN Traffic and since then I have not hit this issue yet. Actually I hit this issue just once so far and I checked with my VPN provider, it was during a window when the server returned Error 6050.

I would have to do some research on the LUCI settings to understand the previous recommendations better before applying them on the router.

HalfLife · 2024-12-12T17:05:14.372Z

I would just use Wireguard with the Block Non-VPN Traffic option enabled. Never had a leak with that.

We should wait to use TailScale as a primary option until they have added a killswitch.

system · 2025-06-10T17:05:54.063Z

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.