search

Rafficer / linux-cli-community

Linux command-line client for ProtonVPN. Written in Python.
https://protonvpn.com
GNU General Public License v3.0
1.29k stars 195 forks source link

[Enhancement] Allow multicast DNS on local interfaces in killswitch mode 2 #247

Open Floppy opened 3 years ago

Floppy commented 3 years ago

Describe the bug The killswitch iptables config filters out multicast DNS, so hosts aren't accessible via mDNS names on local networks; i.e. I can't ssh to my machine running the VPN by name, only by IP.

Expected behavior Multicast DNS should be allowed on the default interface as well as local network access.

Possible solution I think the right solution is to add the mDNS IP 224.0.0.251 as a rule the same as the local network specifier at https://github.com/ProtonVPN/linux-cli/blob/1190545a4293332824b28fe442f95f7be44b65d5/protonvpn_cli/connection.py#L849. I'll have a go and send a PR.

Concerns I'm not sure what the security implications are of doing this... any thoughts?

Floppy commented 3 years ago

It actually only needs UDP on one port:

-A OUTPUT -d 224.0.0.251/32 -o eth0 -p udp -m udp --dport 5353 -j ACCEPT
-A INPUT -s 224.0.0.251/32 -i eth0 -p udp -m udp --sport 5353 -j ACCEPT