[mycall]

How hard is it for a firewall to block option 121 (and 33)?

Cloudflare WARP made a robust VPN but is not cheap.

[gruez]

It's probably more straightforward to have the firewall block all traffic from using the non-VPN interfaces (ie. blacklist approach) instead. In the other thread[1] there was disagreement about whether commercial VPN services actually implement their 'killswitch" in this way. Apparently NordVPN does not (hearsay), but neither side provided a good survey of other providers.

[1] https://news.ycombinator.com/item?id=40279632

[agwa]

Ignoring or blocking these options is trivial but ineffective since the DHCP server can still send a malicious subnet mask.

(Edited to replace "default gateway" with "subnet mask")

[peddling-brink]

Forgive my ignorance, but what could a malicious gateway do in this instance?

[agwa]

Whoops, I posted too early in the morning, I meant to say "malicious subnet mask" :-)

Basically, the DHCP server sends a subnet mask for an absolutely huge subnet (e.g. a /2), and the route for that subnet takes precedence over the VPN route. The attacker can only intercept 25% of the IPv4 address space with a /2 but that's still pretty bad.

[peddling-brink]

Clever, thanks!

[felixg3]

Cloudflare Warp is free, I think - if you create a Zero Trust Organisation for free and configure the Warp client to use it, you can use unmetered Warp+ with Argo routing without charge.