search

StreisandEffect / streisand

Streisand sets up a new server running your choice of WireGuard, OpenConnect, OpenSSH, OpenVPN, Shadowsocks, sslh, Stunnel, or a Tor bridge. It also generates custom instructions for all of these services. At the end of the run you are given an HTML file with instructions that can be shared with friends, family members, and fellow activists.
https://twitter.com/streisandvpn
Other
23.19k stars 1.99k forks source link

private IP (192.168.x.x.) scan for netbios (UDP 137) forwarded to public interface #1785

Open chymian opened 4 years ago

chymian commented 4 years ago

I did set up a streisand server the last week on one of my VPS. My provider sent me an abuse-mail due to the fact, that a networkscan for ip 192.168.1.0/24 on port 137/UDP was forwarded out of the public interface.

Expected behavior:

Don't forward private IPs to public Net.

Actual Behavior:

forward private IP to public interfaces, which is forbidden. since only shadowsocks and wireguard are actually used, I suggest, it's a wireguard misconfig. can it be a firewall misconf, or a wg-driver pbl?

Modification of ansibel-role

since UBU16.04 is far too old, I modified the roles to use standard debian pks where necessary (old/incompatible ppas), which works fine. due to the fact that the openVPN-networks are overlapping with existing networks, (because everybody uses 10.8.0.0), I changed the openVPN IPs to 10.188.0.0 & 10.189.0.0 see: pastebin

Steps to Reproduce:

?

[ contents of streisand-diagnostics.md here ]

Ansible Information

Streisand Information

Enabled Roles

chymian commented 4 years ago

This behavior renders streisand VPN-Server into a malfunctioning SW, which does not stick to the RFCs and is per se not allowed to access the internet - and nobody of the developers care? really?