I use ubuntu. The only apps I have in it are firefox and telegram, both downloaded through official channels. I use other apps with virtualization, so my main machine is mostly clean.
I use a VPN so everything goes to it through a
tun interface. Here's my
route -n output:
Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.8.8.1 0.0.0.0 UG 50 0 0 tun0 0.0.0.0 192.168.25.1 0.0.0.0 UG 600 0 0 wlp1s0 10.8.8.0 0.0.0.0 255.255.255.0 U 50 0 0 tun0 169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 virbr0 192.168.25.0 0.0.0.0 255.255.255.0 U 600 0 0 wlp1s0 192.168.25.1 0.0.0.0 255.255.255.255 UH 600 0 0 wlp1s0 192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 126.96.36.199 192.168.25.1 255.255.255.255 UGH 600 0 0 wlp1s0
I noticed this strange IP
188.8.131.52 which connects directly through my gateway, thus bypassing my VPN. The other bypasses were made by me using ufw: I added bypasses to
192.168.25.0/24 so I can access my local network
I don't know how it got there, but I had a cron job that bypasses by proton VPN for a dynamic IP, which is given by a domain name:
#!/bin/bash HOSTNAME=my.domain.com LOGFILE=$HOME/ufw$HOSTNAME.log Current_IP=$(host $HOSTNAME | head -n1 | cut -f4 -d ' ') if [ ! -f $LOGFILE ]; then /usr/sbin/ufw allow from any to $Current_IP port 1194 proto udp echo $Current_IP > $LOGFILE else Old_IP=$(cat $LOGFILE) if [ "$Current_IP" = "$Old_IP" ] ; then echo IP address has not changed else /usr/sbin/ufw delete allow from any to $Old_IP port 1194 proto udp /usr/sbin/ufw allow from any to $Current_IP port 1194 proto udp echo $Current_IP > $LOGFILE echo iptables have been updated fi fi
I thought the strange IP had something to do with this cron job. But I don't think
my.domain.com ever had this IP. I don't even think this cron job alters routes. And I also think that I don't even know what this cron job is doing now that I'm looking better at it.
A simple google search on this IP gives one result of an user on reddit talking about Proton VPN, which is the VPN provider I use. But the post is gone now.
Does anybody have any idea of what is happening?
here's the reddit cache: http://webcache.googleusercontent.com/search?q=cache:46CfMx_bnzQJ:https://www.reddit.com/r/ProtonVPN/comments/8s40e5/pfconf_configuration_for_protonvpn_macos_app/&num=1&hl=en&gl=uk&strip=1&vwsrc=0
I also didn't install anything from proton VPN, I use only open VPN with proton VPN configuration files