References: <5661686A.4090305@...2070...> <1449656275-24934-1-git-send-email-iam@...2070...> <56694C04.6020904@...277...> <5669A739.2030901@...2070...> From: ValdikSS Message-ID: <5669AD8A.3060202@...2070...> Date: Thu, 10 Dec 2015 19:51:22 +0300 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="vG9kcOw6VnHrdMMsck6BHcEahPKEh02EF" Subject: Re: [Openvpn-devel] [PATCH v8-master] Add Windows DNS Leak fix using WFP ('block-outside-dns') List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Selva Nair , ValdikSS Cc: "openvpn-devel@lists.sourceforge.net" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --vG9kcOw6VnHrdMMsck6BHcEahPKEh02EF Content-Type: multipart/alternative; boundary="------------070705030802040904060504" This is a multi-part message in MIME format. --------------070705030802040904060504 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable No, I'm afraid it would fail by default since DNS queries are (usually) ma= de from svchost.exe. Whitelisting openvpn.exe is done to not to break OpenV= PN on UDP port 53. I could be incorrect tho. On 12/10/2015 07:31 PM, Selva Nair wrote: > > On Thu, Dec 10, 2015 at 11:24 AM, ValdikSS > wrote: > > Yes, I meant to leave the block all and permit openvpn.exe filters always= on and delete/re-add only the filters for the tun/tap interface. Well, its= probably > just a cosmetic change, so no strong opinion. > > Selva > > _______________________________________________ > Openvpn-devel mailing list > Openvpn-devel@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/openvpn-devel --------------070705030802040904060504 Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: quoted-printable No, I'm afraid it would fail by default=A0 since DNS queries are (usually) made from svchost.exe. Whitelisting openvpn.exe is done to not to break OpenVPN on UDP port 53. I could be incorrect tho.

On 12/10/2015 07:31 PM, Selva Nair wrote:

On Thu, Dec 10, 2015 at 11:24 AM, ValdikSS <iam@...2098...= 0...> wrote:

Yes, I meant to leave the block all and permit openvpn.exe filters always on and delete/re-add only the filters for the tun/tap interface. Well, its probably just a cosmetic change, so no strong opinion.

Selva

_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/op=
envpn-devel

--------------070705030802040904060504-- --vG9kcOw6VnHrdMMsck6BHcEahPKEh02EF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: https://keybase.io/valdikss iQIcBAEBCAAGBQJWaa2KAAoJEFzXIC7viPdyXi8P/Ru0Vq7rtzdyN+ZcJfv8cdAp v1hZsbD/Z6r5Zgw2+8MdifKKDOKOvfQK56N+FsrEPrF6FxCdvME/FrfnnXBwP6Wf 0UExLKBJuWfxVf/mgtHOlxkyvnW4lEQ2FoPxH62PmeCGvLCTrXiujyAsE/aq82HD R1wh59Q2zwIunARDcl5kKKT/78bl4GJFGq2ymF5g3lHHoEIvAMhVcaD2S8FiRm7h pRcEHamib5EZSwE9yWgGlF2l6ml6suBF8/rMrusKRx3p/+Blf8YTPf4XxfeWle95 ir4uWoNjHve2I7K7KQfsPgj77EEcbaX8Kfc5+SfTQ1k3U5IGNVNLap7unKSFwbZH gw2ux/Uxw+EmtC5vS7IABSpaYtbQPIae/3K3F+JsuKFZnuEZmZrH3JlKsCb4+o7p kqrI9xuC9Wg8ZbXeApObHofISeV1OdP8dzRquKvH4CoHvANrEwA4JDpRuyXGYqZo rKiUUkhDVTGpnhmDRQQgIJINwTGIqQbDDo5oiDej8pbYxPP21/74Kyo+NoRUjZR5 we2DFwGUSKFyB/Djo8EBDtH1prNSJTPgBuBUJcoyWbvIMhmkhLPy2KSzkS73akDp Ag7PB2vLL5CHrr1Wo6cvMwsf8yk5LgeoLnCYFVWIANU91mQvwIam109DoYbfql29 lnNCmh3OJjJIworW82QD =8/aT -----END PGP SIGNATURE----- --vG9kcOw6VnHrdMMsck6BHcEahPKEh02EF--