0

I use ubuntu. The only apps I have in it are firefox and telegram, both downloaded through official channels. I use other apps with virtualization, so my main machine is mostly clean.

I use a VPN so everything goes to it through a tun interface. Here's my route -n output:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.8.1        0.0.0.0         UG    50     0        0 tun0
0.0.0.0         192.168.25.1    0.0.0.0         UG    600    0        0 wlp1s0
10.8.8.0        0.0.0.0         255.255.255.0   U     50     0        0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 virbr0
192.168.25.0    0.0.0.0         255.255.255.0   U     600    0        0 wlp1s0
192.168.25.1    0.0.0.0         255.255.255.255 UH    600    0        0 wlp1s0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
195.181.167.147 192.168.25.1    255.255.255.255 UGH   600    0        0 wlp1s0

I noticed this strange IP 195.181.167.147 which connects directly through my gateway, thus bypassing my VPN. The other bypasses were made by me using ufw: I added bypasses to 192.168.25.0/24 so I can access my local network

I don't know how it got there, but I had a cron job that bypasses by proton VPN for a dynamic IP, which is given by a domain name:

#!/bin/bash
HOSTNAME=my.domain.com
LOGFILE=$HOME/ufw$HOSTNAME.log
Current_IP=$(host $HOSTNAME | head -n1 | cut -f4 -d ' ')

if [ ! -f $LOGFILE ]; then
    /usr/sbin/ufw allow from any to $Current_IP port 1194 proto udp
    echo $Current_IP > $LOGFILE
else

    Old_IP=$(cat $LOGFILE)
    if [ "$Current_IP" = "$Old_IP" ] ; then
        echo IP address has not changed
    else
        /usr/sbin/ufw delete allow from any to $Old_IP port 1194 proto udp
        /usr/sbin/ufw allow from any to $Current_IP port 1194 proto udp
        echo $Current_IP > $LOGFILE
        echo iptables have been updated
    fi
fi

I thought the strange IP had something to do with this cron job. But I don't think my.domain.com ever had this IP. I don't even think this cron job alters routes. And I also think that I don't even know what this cron job is doing now that I'm looking better at it.

A simple google search on this IP gives one result of an user on reddit talking about Proton VPN, which is the VPN provider I use. But the post is gone now.

Does anybody have any idea of what is happening?

UPDATE:

here's the reddit cache: http://webcache.googleusercontent.com/search?q=cache:46CfMx_bnzQJ:https://www.reddit.com/r/ProtonVPN/comments/8s40e5/pfconf_configuration_for_protonvpn_macos_app/&num=1&hl=en&gl=uk&strip=1&vwsrc=0

I also didn't install anything from proton VPN, I use only open VPN with proton VPN configuration files

Improve this question

1 Answer 1

Reset to default
1

I think I found what's happening everytime I change my VPN connection to another country, this specific IP changes. Of course, it's the open VPN app making an out connection to the server so the connection doesn't go through the tun device for the open vpn client

Improve this answer
1
  • This is absolutely correct. When you change default gateway to the tunnel, you still need a route to the VPN server. As the post specific route generally wins, this works. This also means that any other traffic (e.g. http) to this host will follow this route.
    – vidarlo
    Jul 17, 2018 at 4:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .