fix shared VPN/Tor server leak bug

[adrelanos]

problem description:

If a Tor entry guard is running on the same server (same IP) as the VPN server (same IP), and if VPN breaks down, Tor may connect directly to the VPN if it happened to choose that Tor relay (same IP) as entry guard. This is not that unlikely, because a lot VPN providers support VPN port forwarding, use public IPs and people host Tor servers behind VPN's.

(partial solution):

(A partial solution for this to set the VPN VM's firewall rules to allow connections only to the VPN server. Specifying destination port in that firewall rule should help a lot. Some cases will not be solved (like VPN running on 443).)

full solution:

A full solution is to allow only user tunnel to connect to the open internet. All other users not.

TODO:

• Implement the full solution.
• Build on top of the development branch.

starting point:

This was fixed in a similar firewall project. This was fixed in whonix-ws-firewall and whonix-gw-firewall. (These are firewalls tailored for Whonix that will not work as drop in replacement for vpn-firewall.)

tickets:

• https://phabricator.whonix.org/T460
• https://phabricator.whonix.org/T158

git commits:

• https://github.com/Whonix/whonix-gw-firewall/commit/00724fd517e66fed0fb52051635aecb9f8e8dca3
• https://github.com/Whonix/whonix-gw-firewall/commit/c26d7395e1d0a6d03ffca320109869bdb5b383a7
• Kicksecure/usability-misc@9148278

documentation and implementation notes [as footnotes]:

• https://www.whonix.org/wiki/Next#VPN_before_Tor
• https://www.whonix.org/wiki/Tunnels/Connecting_to_Tor_before_a_VPN#Setup_Tor_before_a_VPN_.28User_-.3E_Tor_-.3E_VPN_-.3E_Internet.29

The usability-misc package simplifies this by requesting less file creation from the user. [1] [2]

---

Footnotes:

[1] The user needs to comment in a few things to make it work. Here in vpn-firewall we could emulate/duplicate these configuration files and have them commented in by default.
[2] Can conflict with whonix-(gw|ws)-firewall but not with usability-misc. [3]
[3] Not have same file names as in usability-misc package so these can still be co-installed.

---

Bounty too low?:

1. Go to https://www.bountysource.com/issues/33959514-shared-vpn-tor-server-leak-bug
2. Click on "Developers"
3. Click on "Get Started"
4. Select Status "Bounty too low"
5. Enter your offer and press "Save".

[adrelanos]

This is done in development branch.