Best way to use Wireguard + Transparent Orbot?

IjvatArIdy

Hi,

what is the best way to use a Wireguard VPN + transparent Orbot with GrapheneOS? Is there a single VPN app that allows to combine both, or do I have to use Magisk with custom iptables, rules and routes to combine both VPNs and not being limited to a single one? Ideally I would like all traffic except DHCP to go through VPN, and I want selected apps that do not support SOCKS proxy to go through the onion network by selecting them in Orbot. Thanks!

Probably9857

IjvatArIdy

You'll probably need to clarify what you mean by "combine". Do you mean you want all traffic routed through both VPN and Tor (if so, in which order?), or do you mean you want some traffic through the VPN and other traffic through Orbot? [I see you have edited your post.]

I suspect the latter might be possible with Rethink DNS, but I will be interested to learn if anyone has that working.

akc3n

IjvatArIdy suggest reading:
https://blog.pastly.net/posts/2016-11-12-vpn-tor-not-net-gain/
and
https://blog.pastly.net/posts/2019-10-17-you-want-tor-browser-not-a-vpn/
About the author: https://blog.pastly.net/about/

mmobder

IjvatArIdy rethinkdns, allows me to use wireguard+nextdns+tor(orbot+cromite)
cromite allows proxy exceptions for important sites that blocks tor
rethinkdns allows on-devise blocklists, so you can save on battery for redundant network requests to nextdns.

I think there is no alternative that allows it.

IjvatArIdy

Probably9857 By combining I mean use a Wireguard VPN service to route everything except DHCP through, including a transparent Tor connection through Orbot for some apps. As Orbot acts also as a VPN for the OS in this context, this is not possible by default with Android because of the single VPN limitation. However I know it is at least possible by rooting the device with Magisk, and I am wondering if this would also be possible through some kind of app that acts as a single VPN for the OS, but that would allow to combine Wireguard + Onion.

IjvatArIdy

Anyone knows about this? Is there any app-based solution for this without rooting my device? Thanks!

[deleted]

IjvatArIdy Have you looked at the MullvadVPN for Android app? Some of what you describe can be done via settings inside the MullvadVPN app (which uses WireGuard protocol). It does cost money but it's not expensive.

IjvatArIdy

[deleted] No I have not? What can be done with this apps that allows to combine a VPN with Tor tunelling? I could not really find information about this for their app. Thanks!

[deleted]

IjvatArIdy I think you want something like: https://github.com/Gedsh/InviZible

IjvatArIdy

[deleted] So I have been looking at InviZible and sing-box and it looks like these two could possibly be combined to provide the functionalities I was looking for. Not sure yet how to use sing-box, I have to dig more. Thanks!

[deleted]

akc3n I believe I've had chats with pastly via the Tor IRC channels. He is a very smart person indeed and reading his About the author link you posted pretty much says all one needs to know.

missing-root

No idea what "transparent orbot" is supposed to mean.

If you mean routing some apps through tor, others through a VPN, then RethinkDNS is the app to use

Last time I used it it was actively developed but not ready. VPN connections dropping, leaking traffic etc

Channeling random apps through orbot is not great though. You rely on exit nodes, which are rare and likely often in government controls.

Using apps with actual onion services (SimpleX, Monerujo, Cwtch, F-Droid?, ...) helps here.

ignoramous

rdns dev here

missing-root VPN connections dropping

We've got better with handling WireGuard dropped connections without having to drain battery (for example, when we were looking for solutions to this, we found that some WireGuard apps like Proton for Android resort to forcefully keeping connection to its VPN server "online" ALL the time). These improvements will land in v055o, the next version due within a few days/weeks.

missing-root leaking traffic etc

Yikes. This one's serious. Do you have repro steps on this? We fix all reported leaks on priority. Thanks.

NetRunner88

Check user advanced mode in settings of orbot.
It will run a socks proxy so you can have VPN on the whole system and configure each app to use socks proxy on localhost port 9050
Fdroid, Molly, Telegram SimpleX can work with Tour over VPN that way.

missing-root

ignoramous I reported everything, thanks :)

The traffic leaking occurs when using VPN with Split tunneling and the wireguard connection is dropped, afaik.

When split tunneling (poorly needed for a ton of apps) you need to turn off "block connections without the VPN"

This may result in leakage

ignoramous

missing-root The traffic leaking occurs when using VPN with Split tunneling and the wireguard connection is dropped, afaik

Gotcha. I checked just now on the latest (developer) build I'm using and this scenario does not happen.

I've noted your report here: https://github.com/celzero/rethink-app/issues/1805 (and will remember to test for this scenario once when v055o, the next version, is released).