Firejail: ExpressVPN issue

[vguarnaccia]

Not sure if this is the best place to post this but I had an issue with the internet when using Firejail in conjunction with ExpressVPN.

After much troubling shooting, I realize it's because ExpressVPN symlinks /etc/resolv.conf -> /var/lib/expressvpn/resolv.conf. Ergo, I have to add whitelist /var/lib/expressvpn/resolv.conf to whitelist-var-common.local.

[vguarnaccia]

In order to use the browser plugin, one should whitelist all of /var/lib/expressvpn/.

[SkewedZeppelin]

If at all possible I'd recommend you instead use the native/real clients directly instead of using a wrapper as provided. ie. use OpenVPN or the NetworkManager VPN modules instead of the VPN providers program.

[vguarnaccia]

Do you think I should do so for security or performance reasons?

Thanks for replying.

[SkewedZeppelin]

Assuming for example that it is just an (potentially outdated) OpenVPN client + wrapper:

Security: Newer versions might have more bugfixes.
Performance: Newer versions might have more optimizations
Privacy: You don't necessarily know what else the client might be doing
Your distro's version might also have more aggressive compiler options set which can be more secure (-fstack -fpie -fpic) and/or more performant (-O3)
etc.

at the same time the wrapper might be making extra changes to ensure that it is correctly working (ie. no dns leaks)

you gain some you lose some :grinning:

[chiraag-nataraj]

@SkewedZeppelin Completely OT, but this is why I've set up a mini router which sets up my VPN and ensures there are no DNS leaks and stuff. That way, I just let my laptop connect as normal without VPN. As a side bonus, anything which connects to the hotspot goes through the VPN :D