Automatically VPN on Wi-Fi Network on GrapheneOS (Preferably FOSS)

Jack12

Hi all,

I’m using a Google Pixel 8a (128GB) running GrapheneOS, and I’d like to automate my VPN usage based on the Wi-Fi network I'm connected to. Specifically:

I want my VPN (Proton VPN, WireGuard-based) to automatically enable when I'm not connected to my home Wi-Fi, and

Automatically disable when I’m back on my home Wi-Fi.

I already have WireGuard installed and working, and I'm primarily looking for a free and open-source (FOSS) way to automate this. Ideally, I'd like to avoid proprietary apps, but I understand GrapheneOS has some limitations.

After doing some research, it seems that this kind of automation may not be fully possible using only FOSS tools on GrapheneOS (without root). So I’m now open to paid solutions, as long as they are privacy-respecting and preferably open-source, or at least trustworthy.

My key requirements:

GrapheneOS-compatible (no root)

Automatic VPN toggle based on Wi-Fi SSID

Works with WireGuard or Proton VPN

Privacy-respecting (ideally no telemetry or bloat)

Is there any tool—FOSS or not—that can reliably do this on GrapheneOS?

Thanks in advance for any suggestions or workflows you've found!

Exhort14

The Proton app has an "excluded IP address" under split tunneling that might work for you? I assume you could put your home network IP address in and it would bypass the VPN.

Jack12

Thanks for the suggestion!

The "excluded IP" option under split tunneling is indeed intended for IP-based exceptions—like bypassing the VPN for certain local networks or specific servers.

However, this doesn’t quite meet my needs because:

It doesn’t disable the VPN based on the Wi-Fi SSID.

It's based on IP addresses, not network names (SSID).

The VPN remains active even on my home network—only specific IPs are excluded from the tunnel.

So while helpful in some scenarios, it doesn't provide the full automation I'm looking for.

kriss

How about; WG-Tunnel

Jack12

kriss Thanks for your reply. It seems like this is exactly what I’m looking for. I’ll try it out over the coming week and let you know how it goes. Thanks again!

Jack12

kriss Update – it works! 🎉

Thanks again for the tip about WG Tunnel – I wanted to let you (and others) know that I now have everything working exactly as I hoped:

✅ VPN (WireGuard via Proton) automatically enables on mobile data
✅ VPN disables on trusted Wi-Fi (based on SSID)
✅ Internet works reliably in both cases
✅ No extra apps or root needed

The setup took a bit of trial and error, but WG Tunnel absolutely does the job once configured properly. I really appreciate the pointer – thanks again for putting me on the right track!

BeepBeep

Perhaps configure your home router to assign a fixed IP to your device and then use a split tunnel exception for that IP.

kriss

Good to read you got working the way you like it.

I also had to fiddle around with the settings to get it working the way I wanted. It's working very well.