Time doesn't sync correctly after restart with always on vpn

DeletedUser368

I'm sorry if the title is confusing, but I'll explain the issue better here.

I use Mullvad VPN and have enabled the "Always On" feature along with the option to block connections outside of the VPN. When I turn my phone on after it has been powered off for a few hours (without the always-on vpn), the time is usually off by about an hour, but it corrects itself within a few seconds. However, when I have the always+on feature and block connections outside of the vpn enabled, the time never syncs correctly after restart

r00xxbr

here the same problem with openvpn, and no find way to fixed, any one can help?

lGsgw0

Same issue here on three Pixel 9a devices. I'm using the WG Tunnel app / Always-on VPN / Block connections without VPN. Following a phone shutdown like overnight, time corrects itself only after toggling "Automatic date and time" off/on.

No such issue on my Pixel 6, however! Same setup. Maybe a bug related to newer hardware @GrapheneOS ? All four phones running on GrapheneOS build 2025112101.

Novalissoide

https://discuss.grapheneos.org/?q=time%20

lGsgw0

Thank you but I know how to use the search.

It is not a hardware fault, since three Pixel 9a devices are affected and time is not drifting without the Always-on VPN (or at least then automatically re-synchronizes so quickly after power-up, that I couldn't notice).

It also is not a network misconfiguration like blocked GrapheneOS domains, as Pixel 6 uses the exact same VPN configuration without any such issues.

So, it more likely might be a design fault or some software issue only affecting newer hardware. (?)

lGsgw0

https://discuss.grapheneos.org/d/27877-time-not-staying-accurate-after-shutdown

(Pixel 9a)

lGsgw0

After some further investigation without Always-on VPN it seems that the Pixel 9a internal hardware clock is really bad as opposed to the Pixel 6, which has no issues keeping correct time after a prolongued shutdown. No idea if there are different hardware revisions of Pixel 9a on the market, which might fix that problem.

Yet it remains to be found, why on Pixel 9a (and Pixel 8a) the time does not automatically re-synchronize when Always-on VPN is enabled. Manually toggling "Automatic date and time" to off/on does the trick while Always-on VPN keeps running. Any hint on what might cause this (software) issue @GrapheneOS ?

lGsgw0

Update on Pixel 9a with GOS build 2025121201:

With Always-on VPN enabled, re-synchronization after full shut-down takes place after approximately 60 seconds.
With Always-on VPN disabled, it's however instantaneous after power-up.

23Sha-ger

lGsgw0
Why don't you keep the "automatic time" on? There are no leaks, it connects to time.grapheneos.org.
With always-on VPN, the time sync service launches before the VPN tunnel, and fails. The next attempt
when the tunnel is established, it will get the correct time.

lGsgw0

23Sha-ger
Thanks but it is activated. This is basically about two findings:

1) Internal hardware clock on some Pixels (maybe mainly a-versions? like on Pixel 9a) is highly inaccurate. No idea if this could expand the attack surface...
2) Always-on VPN at least delays the automatic re-synchronization significantly, as per your explanation, after a phone shutdown (like over night)

Ladida

lGsgw0

I have the same issue and I NEVER had the problem drifting time with 5 earlier Pixel models running GOS.

When using it in airplane mode, and occasionally switching phone off, it simply drifts. Not just seconds but hours.

I wish there was a possibility to sync to the GPS signal

pixel47233

Ladida I wish there was a possibility to sync to the GPS signal

I see this you raised this issue in a separate thread: https://discuss.grapheneos.org/d/29445-how-to-gps-time-sync-device-drifting-in-airplane-mode.

One potential problem is that some VPN implementations depend on some degree of time accuracy. For example, Unreliable Monotonic Counter is one of the documented Known Limitations of WireGuard. More details are in the WireGuard paper. If a WireGuard peer's time drifts forwards or backwards, that can cause connection issues when establishing the tunnel. This can be more apparent if multiple devices, with different degrees of clock reliability, share the same WireGuard peer configuration (same identity/key).

There are multiple reports in this thread. It would be helpful to know if the GrapheneOS device can access the internet while the issue is occurring. This is one possible explanation:

A Pixel 9a, which has some reports of clock drift, is powered off and loses its time accuracy. The device is powered on and the Always-on VPN attempts to connect. Because of the inaccurate time, a VPN connection such as WireGuard can't be established. This means the device is effectively without network access and the GrapheneOS HttpsTimeClient can't receive time update data.

The way to fix that scenario would be to set the time manually or to temporarily disable the VPN. Depending on the amount of drift, it may be possible to just wait long enough for clock to catch up to the last valid WireGuard monotonic counter value.