Exclude apps from "Block connections without VPN"

Byku

Like the title says. Is this possible? Right now I need to disable this setting manually every time I want to use a service like LocalSend, KDE Connect etc. Split tunneling and local network discovery in the VPN app won't work when "Block connections without VPN" is on. As I understand it, when I turn "Block connections without VPN" off and the VPN somehow disconnects during this period of time all net traffic will bypass the VPN server?

Cheers and props to all the GOS developers for their hard work!

TheGodfather

Byku It's possible to leave this activated and still use some apps without a VPN, but it has to be implemented by the VPN app. Most do not do that. If I remember correctly, RethinkDNS does.

Byku

I also found this:

https://developer.android.com/develop/connectivity/vpn#always-on

The way this is written does not make me certain 100% but it would seem that when always-on VPN disconnects the network traffic won't stop, it will just show a notification, it will stop only when block connections without VPN is turned on. Reason to keep block connections without VPN on.

Also according to this doc apps will be blocked when "block connections without VPN" is on and they are neither on allowed list or disallowed list:

When non-VPN traffic is blocked, apps that aren’t in an allowed list or in a disallowed list lose their network connection. Consider warning people when making allowed or disallowed lists. To learn more, see the following Per-app VPN section.

So if I understand this correctly excluding an app from inside the VPN interface should make it bypass "block connections without VPN", alas it doesn't. I don't know if this is a Graphene or Android thing (used iOS before).

Hat

"Block connection without VPN", is like the OS closing all network doors except the VPN tunnel through the Internet.

The last GOS release fix several issues about VPN leaks.

My understanding of the initial report from @ryrona is that there were no leaks to the internet with "Block connection without VPN". But it was leaks on the local network with the apps using multicast.

Here I have observed that apps are able to send multicast packets not going out over the VPN, but instead going to the local network, despite killswitch being enabled. This even with apps like Mullvad VPN app that clearly says it blocks all local network traffic.

For instance Mullvad VPN (and probably more VPN apps) has this option Local network sharing and it uses local multicast. So enabling Local network sharing, data could travel outside the VPN, only locally even with "Block connection without VPN".

I think the leaks was without Local network sharing enabled. So probably with this option enabled in the last GOS release will open a risk to data leak in local network. And "Block connection without VPN" disabled could leak data to the internet.

Byku

Hat Mullvad is what I'm using also, but in order to send data on local network I need to do both enable "Local network sharing" and disable "Block connection without VPN". Otherwise devices won't show. The only app that works while having "Block connection without VPN" enabled is Syncthing, It would be nice to be able exclude apps from blocking on the system level so "Block connection without VPN" could be kept on all the time except for designated apps.

Hat

Byku Locally between GOS profiles with ftps protocol, there is no need to enable "Local network sharing" and disable "Block connection without VPN".
I didn't try between devices.

Hat

I did some tests between GOS and Windows.
I couldn't access my SFTP server on my phone from my computer, access was refused. Probably for the same reason that it's not possible to browse the Pixel disc freely from a computer.

I can also confirm that I couldn't use the sharing apps with "Block connections without VPN" enabled. I don't know if this is a design flaw in the VPN app or a flaw in Android.
The Bluetooth even with better speed transfer these days is still not handy.

The only tip I see to stop internet traffic when using your sharing apps is to not connect to your WiFi router and turn off mobile data.

If you doubt that many people will be able to check for data leaks with Mobile Data disabled, you could disable the SIM instead.

ignoramous

rethinkdns developer here

Hat I can also confirm that I couldn't use the sharing apps with "Block connections without VPN" enabled. I don't know if this is a design flaw in the VPN app or a flaw in Android.

Definitely not Android. As for VPN apps, supporting certain usecases is made harder by the sandbox (for instance, on Android, VPN apps do not get assigned net_admin capabilities, which is okay, but is also limiting). As for Rethink DNS + Firewall, we definitely want to support apps like Syncthing and KDE Connect, but just that given other open issues and feature requests, we've never got around to prioritizing it (the app is open source, we do welcome pull requests). I mean, it has been 2 years since we first started supporting IPv6, and there's still an ongoing, painful struggle with it...

Hat

Finally not sure if this is more convenient or secure than to use a USB cable.

kbv

Translated to English by other8026 using DeepL. Original below...

Hello,
I don't know if my problem is in the right place in this thread.
I'm currently trying to de-google myself as much as possible. That's why I bought a Google Pixel 7 with GrapheneOS.
Unfortunately, the following configuration that I used on the Samsung A54 does not work here.
I have set up a VPN tunnel with wireguard to my home network on the Samsung. This allows me to access the NAS externally without opening ports in the Fritzbox. This access seems more secure to me.
With the Google Pixel, external access only works until I activate the VPN tunnel. Then I can no longer establish a connection.
This is a disaster because I not only have pictures and videos on the NAS but also my calendar, contacts and password safe, notes...
And I access these with at least 3 devices. So I am relatively self-sufficient from the collection services of google, microsoft and co. At least when it works.
Does anyone have any idea where the problem is coming from?

Translated with DeepL.com (free version)

hallo,
ich weiß nicht ob mein Problem jetzt in diesem Thread richtig aufgehoben ist.
ich versuche mich gerade so weit es geht zu entgoogeln. Deshalb habe ich mir ein Google Pixel 7 mit GrapheneOS zugelegt.
Folgende Konfiguration die ich bislang auf dem Samsung A54 genutzt habe funktioniert hier leider nicht.
Auf dem Samsung habe ich einen VPN- Tunnel mit wireguard zu meinem Heimnetz eingerichtet. Damit kann ich von extern auf die NAS zugreifen ohne Ports in der Fritzbox zu öffnen. Mir scheint dieser Zugriff sicherer.
Beim Google Pixel funktioniert der externe Zugriff nur so lange bis ich den VPN Tunnel aktiviere. Dann kommt keine Verbindung mehr zu stande.
Das ist insofern eine Katastrophe weil ich nicht nur Bilder und Videos auf der NAS habe sondern auch Kalender, Kontakte und Passwortsafe, Notizen...
Und da greife ich mit mindestens 3 Geräten zu. So bin ich relativ autark von den Sammeldiensten von google, microsoft und co. Jedenfalls dann, wenn es funktioniert.
Hat vielleicht jemand eine Idee wo das Problem herkommt?

other8026

kbv Hi kbv! Although we understand that not everyone speaks English, we do ask that people use English here on the forum so that more people can read the posts. Feel free to use a translation site or service like DeepL or Google Translate if necessary.

I'll edit your post in a few minutes with an English translation.