Filtering by port / ip address support

[bizzbyster]

I have enabled my Windows client and changed its configuration to point to my qpep server. How can I know that it is connected? Is there a log or equivalent?

[bizzbyster]

@parvit any insight on this?

[parvit]

@bizzbyster QUIC protocol to my knowledge does not give feedback to the successful remote connection (it is based on udp), so the only way to know it is working is that:

1. You can connect to the internet with the client running (that's because the rerouting happens in any case, so if there is no connection to the remote server the packets are simply lost)
2. In the qpep server log there are connections incoming

[bizzbyster]

@parvit is it possible to reroute only those TCP connections originating from specific processes on the machine so that one could maintain a whitelist of those processes that are redirected to the qpep client?

[parvit]

@bizzbyster No i don't think that would be possible because WinDivert works per-packet, the connection abstraction is in our code and has not relation to the originating process.

[bizzbyster]

WinDivert uses Windows Filtering Platform, which has Connect Redirection. See https://docs.microsoft.com/en-us/windows-hardware/drivers/network/using-bind-or-connect-redirection.

I think this might be an example of WinDivert doing Connect Redirection -- https://github.com/jellever/StreamDivert.

It doesn't look like it implements a per process filter but it does seem to be selective on which TCP connections it redirects.

Thoughts?

[parvit]

The underlying platform is sure more powerful but it is not the api which windivert exposes, it only deals with packets (in fact it also is the case for the project you mentioned, if with more options).

You could implement a filter based on the destination port, but the options are not that great:

1. Add the not filtered ports to the main filter, but this incurs an heavy penalty in performance terms as per the windivert docs §8.5 Simple Filters: Currently WinDivert does not optimize the filter compilation, so it is up to the user application to ensure the filter is simple/optimized.

2. Handle it in the inbound handler: this incurs instead the risk of creating infinite loops, because the packets which should not be diverted could be captured again by the filter after reinsert.

[bizzbyster]

What about IP subnet exclusion and inclusion lists?

What I want to be able to do is shown here.

And the problem is I only want to redirect the traffic that is will be sent through the VPN tunnel.

So, for instance, if there is a Cisco AnyConnect VPN present and it is using split tunneling to only send some traffic to the VPN server, I would like to be able to configure QPEP so that it would send that same traffic to the QPEP server, which optimizes that VPN-bound traffic. Let me know if that doesn't make sense.

[parvit]

It is the same principle so you have the same limitations. Il Mar 5 Lug 2022, 21:17 bizzbyster ***@***.***> ha scritto:

…

What about IP subnet exclusion and inclusion lists? What I want to be able to do is shown here <https://docs.projectfaster.org/use-cases/vpn-over-satellite/vpn-client-software/optimizing-client-software#open-source-wan-optimizing-client-leveraging-quic-http-3> . And the problem is I only want to redirect the traffic that is will be sent through the VPN tunnel. So, for instance, if there is a Cisco AnyConnect VPN present and it is using split tunneling to only send some traffic to the VPN server, I would like to be able to configure QPEP so that it would send that same traffic to the QPEP server, which optimizes that VPN-bound traffic. Let me know if that doesn't make sense. — Reply to this email directly, view it on GitHub <#8 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AWGJD4FYH4DIMUHSG64O2WTVSSC6HANCNFSM52KFVD4Q> . You are receiving this because you were mentioned.Message ID: ***@***.***>