# Leaking VPN traffic through non-RFC1918 local IP addresses

Mozilla VPN on Linux/iOS routes traffic to non-RFC1918 local subnets outside the tunnel, letting a rogue Wi-Fi hotspot leak nearly all IP traffic in plaintext.

- Payout: hidden
- Severity: medium
- Program: Mozilla
- Found by: vanhoefm
- Disclosed: 2024-11-08
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1987680
- Library page: https://bugbountylibrary.com/r/h1%3A1987680
- Tags: area:devices domain:network impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:ios tech:linux technique:recon vuln:info-disclosure

**Target:** VPN client local-network routing on Linux and iOS
**Root cause:** The VPN client treats any address in the DHCP-assigned local subnet as local and excludes it from the tunnel, without checking that the subnet is RFC1918.
**Steps:**
1. Configure a rogue AP/router to hand out a non-RFC1918 subnet such as `216.165.47.0/24` (or `0.0.0.0/1`/`128.0.0.0/1`).
2. Run `sudo ./vpn_tester.sh wlan0 wlan0 testnetwork abcdefgh --vpn-local nyu.edu` to create the test Wi-Fi network.
3. Connect the victim to SSID `testnetwork` (password `abcdefgh`) and enable Mozilla VPN.
4. Visit `http://nyu.edu` (IP `216.165.47.10`); observe ARP requests and HTTP request/response outside the tunnel in Wireshark.
**How found:** Part of a large study testing 66+ VPNs; researchers hypothesized that local-network exclusion logic trusts DHCP-provided subnets and tested non-RFC1918 ranges to see if traffic bypassed the tunnel.
**Exploitation:** A malicious Wi-Fi/Ethernet network assigns a non-RFC1918 local subnet; the VPN client then sends all traffic to that subnet outside the tunnel, allowing the attacker to intercept plaintext protocols, observe visited IPs, and forward traffic to real servers.
**Escalation:** Using `0.0.0.0/1` or `128.0.0.0/1` as the local subnet leaks nearly all IP-based traffic without prior knowledge of victim browsing habits.
**Insight:** VPN local-network exclusion is keyed on the DHCP-assigned subnet, not on RFC1918 membership; test rogue DHCP handing out public ranges (or /1 splits) to see if the client leaks traffic outside the tunnel.