linux-cli-community
linux-cli-community copied to clipboard
Rafficer
[Enhancement] Allow multicast DNS on local interfaces in killswitch mode 2
Describe the bug The killswitch iptables config filters out multicast DNS, so hosts aren't accessible via mDNS names on local networks; i.e. I can't ssh to my machine running the VPN by name, only by IP.
Expected behavior Multicast DNS should be allowed on the default interface as well as local network access.
Possible solution
I think the right solution is to add the mDNS IP 224.0.0.251 as a rule the same as the local network specifier at
https://github.com/ProtonVPN/linux-cli/blob/1190545a4293332824b28fe442f95f7be44b65d5/protonvpn_cli/connection.py#L849. I'll have a go and send a PR.
Concerns I'm not sure what the security implications are of doing this... any thoughts?
It actually only needs UDP on one port:
-A OUTPUT -d 224.0.0.251/32 -o eth0 -p udp -m udp --dport 5353 -j ACCEPT
-A INPUT -s 224.0.0.251/32 -i eth0 -p udp -m udp --sport 5353 -j ACCEPT