-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathmodes.html
More file actions
484 lines (446 loc) · 22.4 KB
/
Copy pathmodes.html
File metadata and controls
484 lines (446 loc) · 22.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>dezhban — enforcement modes</title>
<style>
:root {
--ground: #17181a;
--panel: #1f2024;
--panel-2:#25262b;
--code: #202126;
--line: #31333a;
--line-2: #3d404a;
--ink: #e9e6de;
--muted: #9a9891;
--faint: #6f6f6b;
--brass: #cda34e;
--brass-dim: #8a7233;
--allow: #6fc39a;
--block: #e2705d;
--stopped:#838891;
--mono: ui-monospace, "SF Mono", "JetBrains Mono", Menlo, Consolas, "Liberation Mono", monospace;
--sans: system-ui, -apple-system, "Segoe UI", "Helvetica Neue", Arial, sans-serif;
--maxw: 1080px;
}
* { box-sizing: border-box; }
body {
margin: 0;
background:
radial-gradient(1100px 520px at 78% -8%, rgba(205,163,78,0.10), transparent 60%),
var(--ground);
color: var(--ink);
font-family: var(--sans);
font-size: 16px;
line-height: 1.65;
-webkit-font-smoothing: antialiased;
text-rendering: optimizeLegibility;
}
.page { max-width: var(--maxw); margin: 0 auto; padding: 72px 24px 96px; }
.eyebrow {
font-family: var(--mono);
font-size: 0.72rem;
letter-spacing: 0.28em;
text-transform: uppercase;
color: var(--brass);
margin: 0 0 18px;
}
h1 {
font-family: var(--mono);
font-weight: 700;
font-size: clamp(2rem, 5vw, 2.9rem);
line-height: 1.06;
letter-spacing: -0.01em;
text-wrap: balance;
margin: 0 0 20px;
}
h1 .wire { color: var(--brass); }
.thesis { max-width: 68ch; color: var(--muted); font-size: 1.075rem; margin: 0; }
.thesis b { color: var(--ink); font-weight: 600; }
.thesis .g { color: var(--allow); font-weight: 600; }
h2 {
font-family: var(--mono);
font-size: 0.82rem;
font-weight: 700;
letter-spacing: 0.22em;
text-transform: uppercase;
color: var(--muted);
margin: 0;
display: flex;
align-items: center;
gap: 14px;
}
h2::after { content: ""; flex: 1; height: 1px; background: var(--line); }
section { margin-top: 64px; }
.modes { display: grid; grid-template-columns: 1.05fr 0.95fr; gap: 22px; margin-top: 30px; align-items: start; }
@media (max-width: 780px) { .modes { grid-template-columns: 1fr; } }
.card {
background: var(--panel);
border: 1px solid var(--line);
border-radius: 4px;
padding: 26px 24px 28px;
display: flex;
flex-direction: column;
gap: 22px;
}
.card.primary { border-color: var(--brass-dim); box-shadow: 0 0 0 1px rgba(205,163,78,0.18), 0 18px 40px -28px rgba(205,163,78,0.5); }
.card.primary { border-top: 3px solid var(--brass); }
.card.fallback { border-top: 3px solid var(--line-2); }
.card.fallback .mode-kicker { color: var(--faint); }
.card > header { display: flex; flex-direction: column; gap: 10px; }
.badge-row { display: flex; align-items: center; gap: 10px; }
.pill {
font-family: var(--mono);
font-size: 0.64rem;
letter-spacing: 0.18em;
text-transform: uppercase;
border-radius: 999px;
padding: 4px 11px;
font-weight: 700;
}
.pill.primary { color: var(--ground); background: var(--brass); }
.pill.fallback { color: var(--stopped); border: 1px solid var(--line-2); }
.mode-kicker {
font-family: var(--mono);
font-size: 0.7rem;
letter-spacing: 0.18em;
text-transform: uppercase;
color: var(--brass);
}
.card h3 { font-family: var(--mono); font-size: 1.35rem; font-weight: 700; margin: 0; letter-spacing: -0.01em; }
.card .tag { color: var(--muted); font-size: 0.95rem; line-height: 1.5; }
.card .tag b { color: var(--ink); font-weight: 600; }
/* finite state machine (vertical) */
.fsm { display: flex; flex-direction: column; align-items: stretch; }
.state {
border: 1px solid var(--line-2);
border-left: 3px solid var(--stopped);
background: var(--panel-2);
border-radius: 3px;
padding: 13px 16px;
display: flex;
align-items: center;
gap: 12px;
}
.state .dot { width: 10px; height: 10px; border-radius: 50%; background: var(--stopped); flex: none; box-shadow: 0 0 0 4px rgba(131,136,145,0.14); }
.state .body { display: flex; flex-direction: column; gap: 1px; min-width: 0; }
.state .name { font-family: var(--mono); font-weight: 700; font-size: 0.98rem; letter-spacing: 0.02em; }
.state .sub { font-family: var(--mono); font-size: 0.74rem; color: var(--muted); letter-spacing: 0.01em; }
.state .badge {
margin-left: auto;
font-family: var(--mono);
font-size: 0.6rem;
letter-spacing: 0.16em;
text-transform: uppercase;
color: var(--faint);
border: 1px solid var(--line-2);
border-radius: 999px;
padding: 3px 9px;
white-space: nowrap;
}
.state.allow { border-left-color: var(--stopped); }
.state.armed { border-left-color: var(--allow); }
.state.armed .dot { background: var(--allow); box-shadow: 0 0 0 4px rgba(111,195,154,0.16); animation: pulse 2.4s ease-in-out infinite; }
.state.armed .badge { color: var(--allow); border-color: rgba(111,195,154,0.4); }
.state.danger { border-left-color: var(--block); }
.state.danger .dot { background: var(--block); box-shadow: 0 0 0 4px rgba(226,112,93,0.16); }
@keyframes pulse { 0%,100% { box-shadow: 0 0 0 3px rgba(111,195,154,0.05); } 50% { box-shadow: 0 0 0 6px rgba(111,195,154,0.22); } }
.edge { display: flex; align-items: center; gap: 10px; padding: 7px 0 7px 15px; margin-left: 12px; border-left: 2px dashed var(--line-2); }
.edge .glyph { font-family: var(--mono); color: var(--brass); font-size: 0.85rem; line-height: 1; margin-left: -21px; width: 12px; text-align: center; background: var(--panel); }
.edge .cond { font-family: var(--mono); font-size: 0.72rem; color: var(--muted); line-height: 1.4; }
.edge .cond em { color: var(--brass); font-style: normal; }
.rules { display: flex; flex-direction: column; gap: 12px; }
.rule-block { display: flex; flex-direction: column; gap: 6px; }
.rule-head { font-family: var(--mono); font-size: 0.68rem; letter-spacing: 0.14em; text-transform: uppercase; color: var(--faint); display: flex; align-items: center; gap: 8px; }
.rule-head .swatch { width: 8px; height: 8px; border-radius: 2px; flex: none; }
pre { margin: 0; background: var(--code); border: 1px solid var(--line); border-radius: 3px; padding: 12px 14px; overflow-x: auto; font-family: var(--mono); font-size: 0.76rem; line-height: 1.7; color: var(--ink); }
pre .c { color: var(--faint); font-style: italic; }
pre .kp { color: var(--allow); }
pre .kb { color: var(--block); }
pre .empty { color: var(--muted); font-style: italic; }
.leak-note {
font-family: var(--mono);
font-size: 0.74rem;
line-height: 1.55;
color: var(--muted);
border: 1px dashed var(--block);
background: rgba(226,112,93,0.06);
border-radius: 3px;
padding: 12px 14px;
}
.leak-note b { color: var(--block); }
.zero-note {
font-family: var(--mono);
font-size: 0.74rem;
line-height: 1.55;
color: var(--muted);
border: 1px dashed var(--brass-dim);
background: rgba(111,195,154,0.06);
border-radius: 3px;
padding: 12px 14px;
}
.zero-note b { color: var(--allow); }
.decide { background: var(--panel); border: 1px solid var(--line); border-radius: 4px; padding: 30px 28px; margin-top: 30px; }
.q { font-family: var(--mono); font-size: clamp(1.05rem, 2.4vw, 1.4rem); line-height: 1.4; color: var(--ink); text-wrap: balance; margin: 0 0 24px; padding-left: 16px; border-left: 3px solid var(--brass); }
.branches { display: grid; grid-template-columns: 1fr 1fr; gap: 18px; }
@media (max-width: 680px) { .branches { grid-template-columns: 1fr; } }
.branch { border: 1px solid var(--line-2); border-radius: 3px; padding: 18px 18px 20px; background: var(--panel-2); }
.branch.yes { border-color: var(--brass-dim); }
.branch .answer { font-family: var(--mono); font-size: 0.72rem; letter-spacing: 0.16em; text-transform: uppercase; margin: 0 0 10px; display: flex; align-items: center; gap: 8px; }
.branch.yes .answer { color: var(--allow); }
.branch.no .answer { color: var(--stopped); }
.branch .verdict { font-family: var(--mono); font-weight: 700; font-size: 1.05rem; margin: 0 0 8px; }
.branch .verdict .rec { font-size: 0.62rem; letter-spacing: 0.16em; text-transform: uppercase; color: var(--ground); background: var(--brass); border-radius: 999px; padding: 3px 8px; margin-left: 8px; vertical-align: middle; }
.branch p { margin: 0; color: var(--muted); font-size: 0.92rem; line-height: 1.55; }
.cases { display: grid; grid-template-columns: 1fr 1fr; gap: 18px; margin-top: 22px; }
@media (max-width: 680px) { .cases { grid-template-columns: 1fr; } }
.case { border: 1px solid var(--line); border-radius: 3px; padding: 16px 18px; }
.case h4 { font-family: var(--mono); font-size: 0.74rem; letter-spacing: 0.06em; margin: 0 0 6px; color: var(--ink); }
.case h4 span { color: var(--muted); font-weight: 400; }
.case p { margin: 0; font-size: 0.88rem; color: var(--muted); line-height: 1.55; }
.leak { display: inline-flex; align-items: baseline; gap: 6px; font-family: var(--mono); margin-top: 10px; }
.leak .n { font-size: 1.05rem; font-weight: 700; }
.leak .n.bad { color: var(--block); }
.leak .n.good { color: var(--allow); }
.leak .lbl { font-size: 0.68rem; letter-spacing: 0.08em; text-transform: uppercase; color: var(--faint); }
.kicker-note { margin-top: 22px; padding: 14px 16px; border: 1px dashed var(--brass-dim); border-radius: 3px; background: rgba(205,163,78,0.05); font-size: 0.92rem; color: var(--muted); }
.kicker-note b { color: var(--brass); font-weight: 600; }
.table-wrap { overflow-x: auto; margin-top: 30px; border: 1px solid var(--line); border-radius: 4px; }
table { border-collapse: collapse; width: 100%; min-width: 620px; font-size: 0.9rem; }
th, td { text-align: left; padding: 14px 18px; border-bottom: 1px solid var(--line); vertical-align: top; }
thead th { font-family: var(--mono); font-size: 0.72rem; letter-spacing: 0.14em; text-transform: uppercase; background: var(--panel-2); color: var(--ink); }
thead th:first-child { color: var(--faint); }
thead th.primary-col { color: var(--brass); }
tbody th { font-weight: 500; color: var(--muted); font-size: 0.82rem; white-space: nowrap; }
tbody tr:last-child td, tbody tr:last-child th { border-bottom: none; }
td.primary-col { color: var(--ink); }
td.fallback-col { color: var(--muted); }
td .hl-bad { color: var(--block); font-family: var(--mono); font-size: 0.85rem; }
td .hl-good { color: var(--allow); font-family: var(--mono); font-size: 0.85rem; }
footer { margin-top: 64px; padding-top: 22px; border-top: 1px solid var(--line); font-family: var(--mono); font-size: 0.72rem; letter-spacing: 0.04em; color: var(--faint); display: flex; flex-wrap: wrap; gap: 6px 18px; }
footer b { color: var(--muted); font-weight: 500; }
.reveal { opacity: 0; transform: translateY(12px); animation: rise 0.6s cubic-bezier(0.2,0.7,0.2,1) forwards; }
.reveal:nth-child(2) { animation-delay: 0.06s; }
.reveal:nth-child(3) { animation-delay: 0.12s; }
@keyframes rise { to { opacity: 1; transform: none; } }
@media (prefers-reduced-motion: reduce) {
* { animation: none !important; transition: none !important; }
.reveal { opacity: 1; transform: none; }
}
</style>
</head>
<body>
<div class="page">
<header class="reveal">
<p class="eyebrow">dežbān · دژبان · the gatekeeper</p>
<h1>Two ways to <span class="wire">cut the wire</span></h1>
<p class="thesis">dezhban has one <b>primary</b> mode and one <b>fallback</b>. The <span class="g">VPN
guard</span> is always on — it enforces the entire time, so if the tunnel drops, nothing leaks. The
<b>country-blocklist</b> is a best-effort fallback for hosts with no VPN: it only <b>reacts</b> after the
next poll, so it can shrink the leak window but never close it. The difference lives in the
<b>resting state</b> — the guard is armed even when all is well; the fallback is simply off.</p>
</header>
<section class="reveal">
<h2>The guard, and the fallback</h2>
<div class="modes">
<!-- VPN GUARD — PRIMARY -->
<article class="card primary">
<header>
<div class="badge-row">
<span class="pill primary">Primary</span>
<span class="mode-kicker">interface-aware · always-on</span>
</div>
<h3>VPN / full-tunnel guard</h3>
<span class="tag">Watches your <b>tunnel</b>. Blocks by <b>network interface</b>. The GUARD baseline
is enforced the whole time, so a tunnel drop is cut with a <b>zero leak window</b>. Use it whenever
you're behind a full-tunnel VPN.</span>
</header>
<div class="fsm" role="img" aria-label="VPN guard: GUARD resting state is always enforcing and only lets the tunnel egress; transitions to FULL-BLOCK when the exit country is forbidden, and back via a windowed probe.">
<div class="state armed">
<span class="dot"></span>
<span class="body">
<span class="name">GUARD</span>
<span class="sub">ALWAYS ON — only the tunnel may egress</span>
</span>
<span class="badge">resting · armed</span>
</div>
<div class="edge"><span class="glyph">▼</span><span class="cond">VPN exit country <em>forbidden</em> · or country unknown</span></div>
<div class="state danger">
<span class="dot"></span>
<span class="body">
<span class="name">FULL-BLOCK</span>
<span class="sub">tunnel egress cut — endpoint kept open to reconnect</span>
</span>
</div>
<div class="edge"><span class="glyph">▲</span><span class="cond">windowed probe: <em>exit allowed again</em> → back to GUARD</span></div>
</div>
<div class="rules">
<div class="rule-block">
<span class="rule-head"><span class="swatch" style="background:var(--allow)"></span>GUARD ruleset</span>
<pre><span class="c"># dezhban ruleset — default-deny outbound.</span>
<span class="kp">pass</span> quick on lo0 all no state
<span class="kp">pass</span> out quick on { utun4 } all no state
<span class="kp">pass</span> out quick to { 178.252.141.142 } no state
<span class="kb">block drop</span> out all</pre>
</div>
<div class="rule-block">
<span class="rule-head"><span class="swatch" style="background:var(--block)"></span>FULL-BLOCK ruleset</span>
<pre><span class="c"># dezhban ruleset — default-deny outbound.</span>
<span class="kp">pass</span> quick on lo0 all no state
<span class="kp">pass</span> out quick to { 178.252.141.142 } no state <span class="c"># reconnect path</span>
<span class="kb">block drop</span> out all</pre>
</div>
<p class="zero-note"><b>Leak window: 0 s.</b> The guard is standing policy, not a poll result — there
is no moment where physical egress is permitted, so a tunnel drop cannot leak.</p>
</div>
</article>
<!-- COUNTRY BLOCKLIST — FALLBACK -->
<article class="card fallback">
<header>
<div class="badge-row">
<span class="pill fallback">Fallback</span>
<span class="mode-kicker">destination-aware · reactive</span>
</div>
<h3>Country-blocklist</h3>
<span class="tag">Watches your <b>public IP's country</b>. Blocks by <b>destination</b>. For hosts
<b>not</b> behind a full tunnel — while your country is allowed it applies no rules at all.</span>
</header>
<div class="fsm" role="img" aria-label="Country-blocklist: ALLOW resting state with firewall off, transitions to BLOCK when the country is in the blocklist, and back when it clears.">
<div class="state allow">
<span class="dot"></span>
<span class="body">
<span class="name">ALLOW</span>
<span class="sub">firewall OFF — network fully open</span>
</span>
<span class="badge">resting</span>
</div>
<div class="edge"><span class="glyph">▼</span><span class="cond">public IP country <em>∈ blocklist</em> ×hysteresis · or unknown & failClosed</span></div>
<div class="state danger">
<span class="dot"></span>
<span class="body">
<span class="name">BLOCK</span>
<span class="sub">default-deny + DNS/geo allowlist</span>
</span>
</div>
<div class="edge"><span class="glyph">▲</span><span class="cond">country <em>leaves blocklist</em> ×hysteresis → back to ALLOW</span></div>
</div>
<div class="rules">
<div class="rule-block">
<span class="rule-head"><span class="swatch" style="background:var(--stopped)"></span>ALLOW ruleset</span>
<pre><span class="empty">∅ no rules installed — outbound is wide open</span></pre>
</div>
<div class="rule-block">
<span class="rule-head"><span class="swatch" style="background:var(--block)"></span>BLOCK ruleset</span>
<pre><span class="c"># dezhban ruleset — default-deny outbound.</span>
<span class="kp">pass</span> quick on lo0 all no state
<span class="kp">pass</span> out quick proto { udp tcp } to { 1.1.1.1 8.8.8.8 } port 53
<span class="kp">pass</span> out quick to { <geo-API provider IPs> } no state
<span class="kb">block drop</span> out all</pre>
</div>
<p class="leak-note">Lowering <b style="color:var(--ink)">pollInterval</b> (even to 3 s) shrinks the
leak window — it <b>never closes it</b>. A transition commits only after
<b>hysteresis × pollInterval</b>, and while the country looks fine there are no rules at all.</p>
</div>
</article>
</div>
</section>
<section class="reveal">
<h2>Which mode do I want?</h2>
<div class="decide">
<p class="q">If your VPN silently drops, do you care that traffic keeps flowing on your real connection —
exposing your real IP?</p>
<div class="branches">
<div class="branch yes">
<p class="answer">▸ Yes, I care</p>
<p class="verdict">→ VPN guard <span class="rec">recommended</span></p>
<p>GUARD is always on, so a drop is cut in <b style="color:var(--allow)">0 seconds</b>. True
regardless of whether your provider ever routes you through a forbidden country — that only decides
whether FULL-BLOCK ever fires; otherwise you just stay in GUARD.</p>
</div>
<div class="branch no">
<p class="answer">▸ No, I don't</p>
<p class="verdict">→ Country-blocklist</p>
<p>The fallback. Only meaningful if the country you block is your <b style="color:var(--ink)">real
physical location</b> — and it can't promise zero leak at any poll interval.</p>
</div>
</div>
<div class="cases">
<div class="case">
<h4>Case A — <span>physically inside the forbidden country</span></h4>
<p>On a drop, your real IP resolves to the blocked country, so the fallback <b style="color:var(--ink)">eventually</b>
blocks — but only after the next poll, and the detection poll itself travels over the exposed line.</p>
<p class="leak"><span class="n bad">≤ 90 s</span><span class="lbl">leak · pollInterval × hysteresis</span></p>
</div>
<div class="case">
<h4>Case B — <span>physically in an allowed country</span></h4>
<p>On a drop, your real IP resolves to an allowed country, so the fallback stays in ALLOW and
<b style="color:var(--block)">never blocks</b>. Your real IP leaks indefinitely.</p>
<p class="leak"><span class="n bad">∞</span><span class="lbl">leak · the fallback is blind here</span></p>
</div>
</div>
<p class="kicker-note">Being sure your provider has <b>no servers in the forbidden country</b> only cancels
FULL-BLOCK — you simply stay in GUARD the whole time. You lose nothing by choosing the guard; keep
<code>blockedCountries</code> listed anyway as a free backstop. <b>Don't</b> run guard mode without a
VPN, though — GUARD needs a tunnel to pass traffic, which is why it's a deliberate opt-in.</p>
</div>
</section>
<section class="reveal">
<h2>Side by side</h2>
<div class="table-wrap">
<table>
<thead>
<tr>
<th scope="col"></th>
<th scope="col" class="primary-col">VPN guard · primary</th>
<th scope="col">Country-blocklist · fallback</th>
</tr>
</thead>
<tbody>
<tr>
<th scope="row">Firewall primitive</th>
<td class="primary-col">which <b>interface</b> may egress</td>
<td class="fallback-col">destination-IP allowlist</td>
</tr>
<tr>
<th scope="row">What it inspects</th>
<td class="primary-col">tunnel up/down + exit country</td>
<td class="fallback-col">public IP's country</td>
</tr>
<tr>
<th scope="row">Rules when healthy</th>
<td class="primary-col">GUARD always applied</td>
<td class="fallback-col">none — network fully open</td>
</tr>
<tr>
<th scope="row">Guards against</th>
<td class="primary-col">tunnel leak + forbidden VPN exit</td>
<td class="fallback-col">originating from a forbidden country</td>
</tr>
<tr>
<th scope="row">Leak window if VPN drops</th>
<td class="primary-col"><span class="hl-good">zero</span> — guard is always on</td>
<td class="fallback-col"><span class="hl-bad">full leak</span> — blind to tunnels</td>
</tr>
<tr>
<th scope="row">Requires a VPN?</th>
<td class="primary-col">yes — GUARD needs a tunnel to pass traffic</td>
<td class="fallback-col">no</td>
</tr>
<tr>
<th scope="row">Config</th>
<td class="primary-col"><code>vpn.enabled: true</code></td>
<td class="fallback-col"><code>vpn.enabled: false</code> (default)</td>
</tr>
</tbody>
</table>
</div>
</section>
<footer>
<b>rulesets:</b> verbatim from <code>dezhban print-rules</code>
<b>configs:</b> primary → dezhban.vpn-guard.json · fallback → dezhban.example.json
<b>read-only:</b> nothing here touches the firewall
</footer>
</div>
</body>
</html>