LAN Access with VPN

GrapheneOS

Probably9857 They likely don't realize they need to do that and may view the way it works as a bug. This applies to the standard configuration for excluding apps from the VPN or allowing traffic to pass through to a local network, which both get blocked by the leak blocking toggle. It probably doesn't really make sense but that's how it's designed and changing it in GrapheneOS to allow more traffic through wouldn't be a good idea.

TrustExecutor

GrapheneOS
I can confirm this happens also with the official WireGuard app when connecting to an IPv4 address in the 192.168.x.x range. Even when the "Exclude private IPs" checkbox in the WireGuard peer settings is set. The only solution I have found is to toggle it off when I want to reach devies on LAN.

TRInvictus

https://discuss.grapheneos.org/d/11111-lan-ip-access-troubles

I had the same question as you have, it's part of my post above.

It seems that android just generally blocks any connection to LAN when "block connections without VPN" is on. Doesn't matter if there is an actual valid VPN connection available or not. I haven't found an answer to that behaviour yet, my own guess, and I may be wrong, is that VPN apps use tunnels, which have an own LAN IP address (you can see them with eg. a terminal), so I assume that "block connections without VPN" categorically blocks any connection to LAN IPs with no exception to avoid bypassing the actual VPN (=tunnel). As said, it's my own guess and it might be wrong.

dialecticdaemon

GrapheneOS Hello - first off, thanks for the help! Curious and eager, I am asking you to give us a small step-by-step guide on how to set up functionality to reach a local admin panel IP (LAN) over the router without turning the "Blocking Without VPN" feature off with one of the known VPN apps (WG Tunnel/Rethink/Mullvad). I believe I speak for the majority - no one has figured it out yet. Importantly, even if the connection would fail & there would be no internet e.g., no connection to the VPN; the LAN network should still be reachable.

userofgos

dialecticdaemon I believe I speak for the majority - no one has figured it out yet.

This is because no VPN app has setup their app to work that way as GrapheneOS already said.

GrapheneOS It's possible for the VPN app to route traffic to the local network itself in order to permit it. These apps could implement their local network traffic toggle this way in order for it to not be considered a leak due to the VPN app routing the traffic itself.

So it seems the fix must take place within the VPN apps and not GrapheneOS

Onlyfun

dialecticdaemon yes, the app is called Rethink DNS. I'm linking last years version due to later updates dont work for me(no internet).

So to access router's control panel need to toggle on 'bypass proxy' for browser. And one more warning, it sometimes sends dns queries to google, weird just checked now and no dns leaks showed.

dialecticdaemon

userofgos Yes, but as of now, as I understand it, there is no feasible application offering a solution... or am I wrong? What do you think - is using a different work profile to access local IPs an option, or does this pose a security risk?

gonzalo

I will jump into this with something related but the other way around, can I have a VPN only to access a remote LAN but get my normal traffic out of the VPN? Meaning route an internal 10.0.0.0/24 over a VPN and the rest out of it

bagel

gonzalo that is sorta what tailscale does, so i assume another vpn app can do that too

dialecticdaemon

Onlyfun Hey - so you checked the logs and found that it was sending DNS queries to Google, but didn't show a DNS leak? Did I understand this correctly? If so, that would inherently render this setup insecure

Onlyfun

dialecticdaemon Not correct.

I meant to warn that sometimes testing for dns leaks(queries sent elsewhere than to a dedicated endpoint that I set) has had google / microsoft among results.

While typing the warning text I just in case did another test and no leaks were captured.
There was no logs involved, simply used this https://mullvad.net/en/check

Onlyfun

Onlyfun and another check right now again has google among results. All network settings right now are same as they were a week ago when I first posted here.

dialecticdaemon

Onlyfun thy for clarifying

Rambler

Panther5362 There is a LAN Access option on PIA in the Network Settings. Most VPN apps have them. I use Syncthing to route files across my LAN, each device has a VPN running 100% of the time, local files pass through without a problem.