Machine-in-the-Tunnel: Practical Connection Inference, DNS Injection, and Defenses for Modern VPNs

Abstract

According to 2025 statistics, approximately 33% of Internet users have used a VPN, and this number continues to grow. When a user connects to a typical VPN server, all of their traffic is tunneled through the server, which forwards the traffic on the user's behalf. This encrypted tunnel protects VPN users from a wide range of common real-world adversaries, including ISPs, governments, local network attackers, and upstream eavesdroppers. However, little research has examined what an active in-path adversary can infer about traffic traversing such a tunnel. In this paper, we demonstrate that a blind in-path attacker (e.g., a compromised router between the VPN client and VPN server) can reliably confirm whether a VPN user is communicating through the encrypted tunnel with an IP address in a set large enough to cover 50 major social-media and news domains. Since modern content-distribution infrastructure causes many services to share IP addresses, identifying communication with an IP address alone does not reveal the specific service being accessed. We therefore extend the attack by poisoning the DNS entry for the target domain, enabling an in-path attacker to observe the victim's TLS Server Name Indication (SNI). Depending on the operating system, the attacker can infer requests for specific domains associated with the target IP address, poison the DNS cache, or induce a denial-of-service condition. Finally, we design and implement light-weight helper modules for Linux VPN servers that leverage existing connection-tracking mechanisms to detect and block spoofed packets injected by in-path adversaries, mitigating these attacks across multiple transport- and application-layer protocols, including TCP, DNS, QUIC, and DTLS.