Unpatched iOS bug blocks VPNs from encrypting all traffic
This is why I use a "slug" when I use a VPN.<p>A "slug" is a layer-2 bridge, with no IP address configured, that still enforces a TCP/IP whitelist.  So it does not "use" a hop on the network route, and you can't see the device, but as it bridges traffic it enforces a (very simple) ruleset.<p>In my case, I use my own VPN hosts that transact over TCP22 ... and so my network "slug" allows <i>only tcp port 22 traffic</i>.  Everything else is blocked.<p>This means that no matter how badly behaved (or buggy) my VPN software is (I use sshuttle[1]) the bad behavior is blocked by the slug.<p>The slug itself has almost zero attack surface as it is a BSD based system that <i>has no IP address configured</i> and runs no network services.<p>I keep meaning to write up a blog entry about this ...<p>[1] <a href="https://sshuttle.readthedocs.io/en/stable/" rel="nofollow">https://sshuttle.readthedocs.io/en/stable/</a>