Martin Vahlensieck
Martin is a PhD student at the University of Basel. He first came into contact with BSD when he wanted to build a firewall.
Sessions
A challenge when setting up VPNs is the proper modification of the routing table. This is needed, so that all traffic goes through the VPN interface and is encrypted, except the encrypted traffic generated by the VPN interface. Even so, this approach has its pitfalls, which can cause leaking unencrypted traffic[[1]].
Network namespaces offer a way to categorically solve this problem. Network namespaces partition the network interfaces present in a host. A process running in a given network namespace only sees the interfaces present within that network namespace. If only the VPN interface is present, traffic will have to go through this interface, making it impossible to send traffic through another interface by accident.
On OpenBSD network namespaces are called routing domains. Combine routing domains with Wireguard, which is routing domains aware out of the box, offer safer VPNs, while also simplifying configuration. A similar effect can be achieved for other VPNs by using virtual machines.
In this talk we go over the problems when just modifying the routing table, how routing domains work and can be used.
Have you ever come across a piece of software and wanted to try it out immediately? But the installation instructions are curl|sh which, besides security and safety concerns, only work on Linux and you happen to use FreeBSD? And building it from source code would require installing a bunch of dependencies?
Well, there is an obvious solution to all these problems: Use a VM! But how quickly can you get a VM up and running? With SSH properly configured. And the network. And a port exposed to the outside? This talk introduces a tool that does exactly that: create and configure temporary VMs in a low friction way.
Features include:
- Create temporary VMs running in-memory from templates.
- Automatic configuration of pf(4) for NAT, port forwarding, and strict filtering of outbound connections.
- Automatic setup of SSH (including proper configuration of the host keys): Just do "ssh tmp0" and you're connected!
This talk will also give insights into various challenges in the design process such as:
- How to coordinate between multiple instances without using a daemon?
- How to keep state to a minimum?