work profile bypasses always-on VPN

hexagonal-lattice

1) install work profile via shelter, in my may user profile
2) clone vanadium into work profile
3) open [NON-work] vanadium - my public IP is my VPN endpoint
4) open [work] vanadium - my public IP is my real IP !!

I've tried:

disabling work / re-installing shelter
multiple providers (proton & mozilla)
forgetting / re-setting up the VPN, and rebooting.

I read you don't/can't set up a VPN in the work_profile (whereas you would in a separate user_profile). Help!?

FWIW - I do you user_profiles for most things - separate user_profiles for the "hardware" apps that some devices require for setup, banking, and a user_profile with GSF for testing. But I use the work_profile for some apps I have to use as part of my "normal" workflow (IE need copy-paste to work, need to see notification content, etc), and shelter because the "auto freeze" functionality prevents me from forgetting to close apps that would otherwise run in the background.

GrapheneOS

hexagonal-lattice It's not bypassing the VPN but rather each profile including a work profile has their own VPN. It has always worked this way as far as we know. User profile VPN behavior used to be very odd but the work profile VPN always worked the way it does now other than leak blocking improving.

hexagonal-lattice

well that's interesting - vanadium (and other apps I installed) happily connected to the non-tunneled net while my main-profile was in always-on/block-without mode - but it appears my VPN app would not. VPN cloned to work profile timed out on login, until I disabled the main profile VPN.

Backing up: as part of triaging this, I had attempted to install protonvpn in the work profile, but logging in just hung; I assumed (given the behavior of other apps), I assume this was just confirmation you couldn't have "second" vpn. However, poking around I tried again, disabling always-on/block-without first ... and I was able to log in & setup VPN in the work profile. Then re-enable always-on/block without in the main profile. And now apps report the IP's I'd expect in both main & work.

Has something changed here? In an effort to narrow the post to my problem, I left out what prompted this - my work profile, which has been working as I'd expect for over a year, stopped having net connectivity _recently (within the last month or so?) I don't use it a ton so just ignore it, but finally sat down to fix it here. I don't recall ever setting up VPN there. Triaging that, I noticed that the work apps connected fine when I turned off always-on/block-without in my main profile's VPN.

None of this is making 100% sense to me. How is VPN + work profile supposed to work? And if you're intended to have two VPN's running (main + work), which is just fine - did something change in recent android updates here?

hexagonal-lattice

GrapheneOS thanks for your reply.

I assume you're familiar with recent changelogs - would you happen to be aware of any recent changes that would affect the way this works? I'm on a pixel6pro, default grapheneos update channels

until perhaps a _month ago apps I used in my shelter profile all connected to the net OK. This includes a paid music streaming, work notification app, and several other non-free apps I had to have access to in my "main" user such as mapping software.
then I first noticed spotify was only intermittently usable (apparently it was sometimes getting some net? IDK. My only "easy" triage step was to fire up Vanadium[work], which timed out on all http requests (unless I disabled main-profile VPN block-without)

I swear I checked public IP's a _year ago when I first set this up, and withOUT a work-profile VPN i was getting the masked public IPs everywhere. But of course that's been a while.

It's working now with a VPN each in main & work ... but I'd really like to have a clue what I was seeing. I'm not a "high value individual" threat model or anything, but this is all super concerning :(

situated_browsing549

hexagonal-lattice

Have you discovered anything else about this or looked into this any more?

roamer4223

I'm not an expert or anything, but I've been using a work profile through Shelter for years. I've used it on standard android and on GrapheneOS and the work profile has always had its own VPN slot as long as I have used one. All the apps in the work profile go through that VPN. I don't think anything has recently changed either. If I'm mistaken, do let me know though

DeletedUser131

This is as intended and has always been like that my dude. You need to setup a separate vpn connection for the work profile. It's also usefully like that, it isn't called a "work profile" for nothing, it is meant for work apps and data. Most companies require a vpn connection to make use of work apps and you don't want your main profile to route through that work vpn or your work apps through your vpn for personal use because then they wouldn't work. We happen to use this work profile for privacy reasons but it was not intended that way.