Desvription:
This document contains information on the measures that can be taken against the "LocalNet" and "ServerIP" attacks described by Mathy Vanheof in the paper "Bypassing Tunnels: Leaking VPN Client Traffic by Abusing Routing Tables" (#VU563667). The attacks are also described at https://tunnelcrack.mathyvanhoef.com/.
With the attacks described, it is important to mention that they do not compromise the actual VPN tunnel. Data transmitted through the VPN tunnel is still secure.
Instead, an attempt is made to divert data traffic intended for the VPN tunnel to another destination before the tunnel in order to be able to read it in plain text or to operate as a so-called man-in-the-middle.
In the scenarios described, a rogue access point is used as the access medium, which suggests to a WLAN client that it is connecting to a known and trusted SSID. This goal is usually most easily achieved on public WLAN networks.
On the access point controlled by the attacker, the routing can now be changed by assigning IP addresses so that the data traffic is redirected accordingly.
All attacks and their variants are described in the following CVE messages in addition to the explanations in the paper:
LocalNet attacks:
ServerIP attacks:
In the default setting, both the Advanced VPN Clients for Windows and macOS are vulnerable to both attacks (LocalNet and ServerIP).
We have compiled detailed technical information on this topic for you in a PDF document:
1. LANCOM Advanced VPN Client for Windows
1.1 Countermeasurements against LocalNet attacks
For the LANCOM Advanced VPN Client for Windows, the LocalNet attack can be prevented by enabling the “Full Local Network Enclosure Mode” option. As a result, all network traffic will be sent through the tunnel.
Alternatively, the integrated Advanced VPN Client Firewall can be configured such that only VPN traffic is allowed outside the tunnel (using the “Permit IPsec protocol” firewall option), with dedicated exceptions for, e.g., the local network printer.
1.2 Countermeasurements against ServerIP attacks
The traffic leak to arbitrary IP addresses (CVE-2023-36673) can be prevented by configuring an IP address instead of a domain name in the VPN configuration. Authenticated DNS variants (DNSSEC) are not supported yet.
Additionally, the integrated Advanced VPN Client Firewall can be configured such that only VPN traffic is allowed outside the VPN tunnel. This can be achieved by setting the “Permit IPsec protocol” firewall option and removing all other firewall rules (see step 1.1).
2. LANCOM Advanced VPN Client for macOS
2.1 Countermeasurements against LocalNet attacks
For the LANCOM Advanced VPN Client for macOS, the LocalNet attack can be prevented only partially by enabling the “Full Local Network Enclosure Mode” option. Network traffic to and from the standard gateway will not be routed into the VPN tunnel.
Alternatively, a third-party firewall can be configured such that only VPN traffic is allowed outside the tunnel, with dedicated exceptions for, e.g., the local network printer.
2.1 Countermeasurements against ServerIP attacks
The traffic leak to arbitrary IP addresses (CVE-2023-36673) can be prevented by configuring an IP address instead of a domain name in the VPN configuration. Authenticated DNS variants (DNSSEC) are not supported yet.
Additionally, a third-party firewall can be configured such that only the VPN protocols are allowed outside the VPN tunnel, which are ISAKMP (UDP port 500) and IPsec NAT-T (UDP port 4500).
