In your step 4, what happens when the VPN traffic gets routed over option 121 pushed routes?
Don't you block it - thus blocking your entire VPN?
> OR it will attempt to go through the more specific option 121 pushed malicious routes added by the compromised DHCP server (depending on the destination ip of the outbound packets).
This right here... we don't want our VPN-secued traffic going out over routes broadcast by the malicious DHCP server, so you block it... right?
How does that traffic leave the local network and reach the VPN server?
Don't you block it - thus blocking your entire VPN?
> OR it will attempt to go through the more specific option 121 pushed malicious routes added by the compromised DHCP server (depending on the destination ip of the outbound packets).
This right here... we don't want our VPN-secued traffic going out over routes broadcast by the malicious DHCP server, so you block it... right?
How does that traffic leave the local network and reach the VPN server?