Remove ProtonVPN

Site Development Tool Suggestions
230

It’s been a while since the last time I posted here but here are my 2 cents.

I’m on macOS and have both Mullvad and ProtonVPN, and I did two simple tests:

  1. Does my IP leak when I switch VPN servers?
  2. Does my IP leak when my VPN connection is stable?

They are simple because I just used curl and nothing more, and in the commands below en0 is my default network interface while utun6 is the VPN interface.

Mullvad

  1. Does my IP leak when I switch VPN servers?
% curl --interface en0 https://ifconfig.me
curl: (6) Could not resolve host: ifconfig.me

% curl --interface utun6 https://ifconfig.me
curl: (6) Could not resolve host: ifconfig.me

All good here, Mullvad drops traffic to both interfaces while I’m switching servers.

  1. Does my IP leak when my VPN connection is stable?
% curl --interface en0 https://ifconfig.me  
curl: (7) Failed to connect to ifconfig.me port 443 after 244 ms: Couldn't connect to server

% curl --interface utun6 https://ifconfig.me
xx.xx.xx.xx%

All good here too, all the traffic to the default interface is dropped while the tunnel interface is up. The IP is the VPN IP.

Mullvad passes both tests.

ProtonVPN

  1. Does my IP leak when I switch VPN servers?
 % curl --interface en0 https://ifconfig.me
xx.xx.xx.xx%

% curl --interface utun6 https://ifconfig.me
curl: (45) Couldn't bind to 'utun6'

While the tunnel interface is down the default interface leaks my real IP. It seems like there’s a window after you initiated server switch and before it you’re actually connected to the new server during which you’re leaking your real IP. Note that that window doesn’t start right after you initiated server switch but it starts at some point later.

  1. Does my IP leak when my VPN connection is stable?
% curl --interface en0 https://ifconfig.me
xx.xx.xx.xx%

% curl --interface utun6 https://ifconfig.me
xx.xx.xx.xx%

While I can use both interfaces, traffic from both seems to go through the VPN server, so no issues here. Although I’d expect the default interface to drop the traffic.

Why Mullvad does not leak traffic while ProtonVPN does?

I think the reason why Mullvad doesn’t leak your IP is they actually use the firewall on macOS (pf) to implement the to drop all traffic that doesn’t go through the VPN interface. This is the right thing to do and I’d expect every serious VPN provider to do this. I’ve also verified this on my machine:

% sudo pfctl -a "*" -s rules
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "mullvad" all fragment reassemble
anchor "*" all {
pfctl: DIOCGETRULES: Invalid argument
}
anchor "mullvad" all {
scrub all fragment reassemble
  ...
  block return out quick proto tcp from any to any port = 53
  block return out quick proto udp from any to any port = 53
  pass quick on utun6 all flags S/SA keep state
  block return out quick all
  block drop quick all
}

ProtonVPN, on the other hand, goes the lazy path and just uses the network extension on macOS and hopes Apple will do the right job not leaking your IP address. Network extensions are known for not doing the right job, so ProtonVPN is leaking as the result. We can also confirm ProtonVPN doesn’t touch the firewall:

 % sudo pfctl -a "*" -s rules
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
anchor "*" all {
pfctl: DIOCGETRULES: Invalid argument
}

I believe the reason they leak on Linux might be related to the firewall as well.

On a personal note

I probably understand why Proton does what they do, they’re reusing the iOS implementation where you need to have a network extension and can’t control the firewall, and they don’t want to pour additional effort into the macOS app as it requires time and money to do right. So they just put a note in their docs that the kill switch is buggy on Apple platforms and called it a day.

I contacted Proton about this first time I discovered the issue but I never heard back, so I just moved to Mullvad as they go above and beyond to prevent issues like these. And you can see this in their code.

I also left Proton ecosystem a while ago because I just can’t trust them to protect my privacy online. They cut too many corners in their products and sometimes this leads to privacy erosion like this. If they don’t care enough about protecting my IP then how can I be sure they care enough about the rest?

So I also voted for ProtonVPN removal until they resolve these issues. It’s proved they leak IP on both macOS and Linux. I would be for removal even if their representative comes here and promises to fix both issues as Proton is well known for promising something and not delivering for years.