gstatic.com (a google domain) Connections On Stock Graphene OS On Startup

GrapheneOS

If you use an app like Netflix and it causes our RemoteProvisioning app to connect to our Widevine provisoning proxy followed by the app connecting to a Google API, that's not an OS issue. It's the app choosing to connect to a Google API. An app connecting to a Google API is not a GrapheneOS issue.

llama420

GrapheneOS This is the script I use to run it:
#!/bin/bash

GNIREHTET="./gnirehtet"
ADB=$(command -v adb)

if [ -z "$ADB" ]; then
echo "[!] 'adb' is not installed."
read -p "Install adb now using apt? (y/n): " ADB_INSTALL
if [[ "$ADB_INSTALL" =~ ^[Yy]$ ]]; then
sudo apt update && sudo apt install -y adb
ADB=$(command -v adb)
if [ -z "$ADB" ]; then
echo "[!] Failed to install adb. Exiting."
exit 1
fi
else
echo "[!] Cannot continue without adb. Exiting."
exit 1
fi
fi

DEVICE=$($ADB devices | grep -w "device" | awk '{print $1}')
if [ -z "$DEVICE" ]; then
echo "[!] No device detected."
echo " Make sure USB debugging is enabled and the device is authorized."
read -p "Press Enter to retry..."
DEVICE=$($ADB devices | grep -w "device" | awk '{print $1}')
if [ -z "$DEVICE" ]; then
echo "[!] Still no device detected. Aborting."
exit 1
fi
fi

echo "[+] Device detected: $DEVICE"

echo "[] Checking if gnirehtet START activity is available..."
$ADB -s "$DEVICE" shell cmd package resolve-activity --brief com.genymobile.gnirehtet.START | grep -q com.genymobile.gnirehtet
if [ $? -ne 0 ]; then
echo "[!] Gnirehtet app is not installed or broken."
read -p "Reinstall it now? (y/n): " INSTALL_CHOICE
if [[ "$INSTALL_CHOICE" =~ ^[Yy]$ ]]; then
echo "[] Installing gnirehtet APK..."
$GNIREHTET install
else
echo "[!] Cannot continue without a working gnirehtet client. Exiting."
exit 1
fi
else
echo "[+] Gnirehtet app is installed and functional."
fi

echo "Make sure the existing VPN always on/kill switch is disabled."
read -p "Press enter to link in."

echo "[*] Starting gnirehtet..."
$GNIREHTET run

llama420

GrapheneOS Just wanted to throw it out there since I led in kind of rudely. I genuinely do like your OS, even with this issue, the ability to block the network of specific apps and the overall security of the system is very impressive.

llama420

GrapheneOS Should also be noted that my PC has deny by default firewall rules that block google connections, mostly ruling out a PC side leak. The Gnirehtet app does have a green light for all connections though.

llama420

GrapheneOS Thank you for replying. These connections occur with nothing installed on the phone after a reboot/reinstall with nothing else running. Gnirehtet is installed via the adb connection to make reverse tethering work, but it doesn't consistently report these IPs, leading me to believe it's not the fault of that app. Its source code can be found here: https://github.com/Genymobile/gnirehtet. This IP mainly seems to connect after a reboot during the first connection with some occasional exceptions.

GrapheneOS

@llama420 You appear to be doing something strange that's resulting in this. What if you use RethinkDNS or another app or monitoring connections instead? Does it show up there? How do you know something else isn't causing it including this tethering setup you're using?

llama420

GrapheneOS The only thing it could be aside from stock OS functionality is the tethering setup, but it's open source and the connections aren't consistent based on its usage. The only consistency I've found in these IPs connecting is that they occur after the OS is rebooted and during the first connection, which leads me to suspect the OS. I've also found some AT&T (my phone service) and AWS connections in this manner when a SIM card was in on a fresh install, despite not being connected to cellular data. These google IPs remained the most consistent even after a fresh install with no SIM card.

I just tried out RethinkDNS and found connections for dns.google and sentitlement2.mobile.att.net under a standard WiFi connection with no cellular data in use. The dns.google domain returned a "SEND_FAIL" in RethinkDNS with no rule blocking it. All proxies are default/Graphene. My phone is set up as usual again, with minimal apps, but there could be interference somewhere. No AT&T app or anything associated, most blocked from the internet entirely. Only Proton things and IronFox have connections allowed.

llama420

GrapheneOS

Byku

other8026

Fresh install. First connection under gnirehtet showing google's 142.250.69.99, no SIM card:

[*] Starting gnirehtet...
2025-07-28 16:47:11.018 INFO Main: Starting relay server on port 31416...
2025-07-28 16:47:11.019 INFO Relay: Relay server started
2025-07-28 16:47:11.019 INFO Main: Checking gnirehtet client...
2025-07-28 16:47:11.159 INFO Main: Starting client...
Starting: Intent { act=com.genymobile.gnirehtet.START cmp=com.genymobile.gnirehtet/.GnirehtetActivity }
2025-07-28 16:47:13.414 INFO TunnelServer: Client #0 connected
2025-07-28 16:47:13.612 INFO UdpConnection: 10.0.0.2:7846 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.614 INFO UdpConnection: 10.0.0.2:38699 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.618 INFO UdpConnection: 10.0.0.2:44226 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.618 INFO TcpConnection: 10.0.0.2:48572 -> 8.8.8.8:853 Open
2025-07-28 16:47:13.632 INFO UdpConnection: 10.0.0.2:33137 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.637 INFO UdpConnection: 10.0.0.2:10176 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.643 INFO UdpConnection: 10.0.0.2:21299 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.654 INFO UdpConnection: 10.0.0.2:57409 -> 8.8.8.8:443 Open
2025-07-28 16:47:13.664 INFO UdpConnection: 10.0.0.2:60910 -> 23.133.168.244:123 Open
2025-07-28 16:47:13.666 INFO UdpConnection: 10.0.0.2:39187 -> 174.138.208.0:123 Open
2025-07-28 16:47:13.684 INFO UdpConnection: 10.0.0.2:55550 -> 54.39.23.64:123 Open
2025-07-28 16:47:13.735 INFO UdpConnection: 10.0.0.2:48135 -> 23.133.168.246:123 Open
2025-07-28 16:47:13.762 INFO TcpConnection: 10.0.0.2:37472 -> 51.222.159.116:443 Open
2025-07-28 16:47:13.860 INFO UdpConnection: 10.0.0.2:32665 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.915 INFO UdpConnection: 10.0.0.2:50659 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.989 INFO TcpConnection: 10.0.0.2:47266 -> 172.96.172.37:443 Open
2025-07-28 16:47:13.992 INFO TcpConnection: 10.0.0.2:48572 -> 8.8.8.8:853 Close
2025-07-28 16:47:13.996 INFO TcpConnection: 10.0.0.2:42176 -> 142.250.69.99:443 Open
2025-07-28 16:47:14.124 INFO TcpConnection: 10.0.0.2:37476 -> 51.222.159.116:443 Open
2025-07-28 16:47:14.191 INFO TcpConnection: 10.0.0.2:37472 -> 51.222.159.116:443 Close
2025-07-28 16:47:14.443 INFO TcpConnection: 10.0.0.2:42176 -> 142.250.69.99:443 Close
2025-07-28 16:47:14.459 INFO TcpConnection: 10.0.0.2:37482 -> 51.222.159.116:443 Open
2025-07-28 16:47:14.622 INFO TcpConnection: 10.0.0.2:42188 -> 142.250.69.99:443 Open
2025-07-28 16:47:14.623 INFO TcpConnection: 10.0.0.2:42186 -> 142.250.69.99:443 Open
2025-07-28 16:47:14.917 INFO TcpConnection: 10.0.0.2:37482 -> 51.222.159.116:443 Close
2025-07-28 16:47:14.952 INFO TcpConnection: 10.0.0.2:42186 -> 142.250.69.99:443 Close
2025-07-28 16:47:14.998 INFO TcpConnection: 10.0.0.2:42188 -> 142.250.69.99:443 Close
2025-07-28 16:47:15.056 INFO TcpConnection: 10.0.0.2:42208 -> 142.250.69.99:443 Open
2025-07-28 16:47:15.079 INFO TcpConnection: 10.0.0.2:42216 -> 142.250.69.99:443 Open
2025-07-28 16:47:15.501 INFO TcpConnection: 10.0.0.2:42208 -> 142.250.69.99:443 Close
2025-07-28 16:47:15.505 INFO TcpConnection: 10.0.0.2:42216 -> 142.250.69.99:443 Close
2025-07-28 16:47:24.499 INFO TcpConnection: 10.0.0.2:47266 -> 172.96.172.37:443 Close
2025-07-28 16:47:27.094 INFO TcpConnection: 10.0.0.2:37476 -> 51.222.159.116:443 Close

Uninstalled everything except for RethinkDNS (including gnirehtet), and disabled developer options in settings. RethinkDNS showed only Graphene and ntp.org connections.

Restarted and reinstalled gnirehtet (without reboot), all domains are Graphene and ntp.org:

[*] Starting gnirehtet...
2025-07-28 16:59:13.886 INFO Main: Starting relay server on port 31416...
2025-07-28 16:59:13.887 INFO Relay: Relay server started
2025-07-28 16:59:13.887 INFO Main: Checking gnirehtet client...
2025-07-28 16:59:14.022 INFO Main: Starting client...
Starting: Intent { act=com.genymobile.gnirehtet.START cmp=com.genymobile.gnirehtet/.GnirehtetActivity }
2025-07-28 16:59:16.287 INFO TunnelServer: Client #0 connected
2025-07-28 16:59:16.347 INFO TcpConnection: 10.0.0.2:36074 -> 8.8.8.8:853 Open
2025-07-28 16:59:16.375 INFO UdpConnection: 10.0.0.2:56885 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.379 INFO UdpConnection: 10.0.0.2:49414 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.380 INFO UdpConnection: 10.0.0.2:22616 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.381 INFO UdpConnection: 10.0.0.2:25076 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.384 INFO UdpConnection: 10.0.0.2:41205 -> 8.8.8.8:443 Open
2025-07-28 16:59:16.386 INFO UdpConnection: 10.0.0.2:1805 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.441 INFO UdpConnection: 10.0.0.2:57654 -> 54.39.196.172:123 Open
2025-07-28 16:59:16.441 INFO UdpConnection: 10.0.0.2:37256 -> 23.133.168.247:123 Open
2025-07-28 16:59:16.441 INFO UdpConnection: 10.0.0.2:38081 -> 159.203.8.72:123 Open
2025-07-28 16:59:16.444 INFO UdpConnection: 10.0.0.2:52812 -> 216.6.2.70:123 Open
2025-07-28 16:59:16.634 INFO UdpConnection: 10.0.0.2:51209 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.726 INFO TcpConnection: 10.0.0.2:36074 -> 8.8.8.8:853 Close

Removed gnirehtet once again, rebooted, and all domains are Graphene and ntp.org in RethinkDNS.

So somehow the reverse tether method returns google domains only on startup regardless of the time of installation or initialization. Other connections like dns.google or AT&T are likely tied to the SIM card or third party apps.

llama420

GrapheneOS

Byku

other8026

gstatic connection was picked up by RethinkDNS after a reboot with gnirehtet still installed. The fault appears to be with the reverse tether method itself and not the OS.

llama420

other8026

Byku

GrapheneOS

It appears I was wrong. I apologize for wasting your time, and I appreciate the effort you guys took to help me with this. Hopefully this will aid in future issues with reverse tethering.

Byku

llama420
sentitlement2.mobile.att.net - this one seems to be used for Wi-Fi calling by AT&T

Did RethinkDNS return the name of the app that did the dns.google query?

While you're at it you can also check RemoteProvisioner connections under Apps in Rethink. It should connect do remoteprovisioning.grapheneos.org.

other8026

llama420 I've also found some AT&T (my phone service) and AWS connections in this manner when a SIM card was in on a fresh install

I think this is expected. It is covered here https://grapheneos.org/faq#other-connections

llama420 I just tried out RethinkDNS and found connections for dns.google and sentitlement2.mobile.att.net under a standard WiFi connection with no cellular data in use.

Do you have a SIM card inserted again? Or do you happen to have an eSIM? You really need to test this without a SIM inserted or set up to verify the OS is not contacting Google domains.

I cannot test with the same setup as you, but I did try two different apps (one was RethinkDNS), and a custom DNS setup with a static IP and all that. I only see GrapheneOS domains popping up until I go to other sites with Vanadium or install apps. All on a device that I factory reset a few times and set up from scratch. If you can see those connections to Google domains, then it would only make sense that I would too. But considering that and your att connection, it sounds like you have a SIM set up or inserted.

llama420 Only Proton things and IronFox have connections allowed.

I wouldn't be surprised if Proton apps are contacting Google domains. Do you see the connections to gstatic before installing those apps?

llama420

other8026 Yeah, gstatic was the most consistent and appeared with no third party apps installed and no SIM after a fresh install. The RethinkDNS test was with a SIM card and IronFox/Proton apps installed. I use a physical SIM card, no eSIM. I'll reinstall again with no SIM and re-run the RethinkDNS test. It's definitely possible that Proton makes google connections, found some google fonts APIs from their Flatpak mailing app on Linux, though it's just a Chromium webview and not officially developed by them.

Byku No associated app in RethinkDNS for dns.google. I suspect it may have been IronFox since it also made quad9 dns queries around the same time which is what IronFox uses, but I have no way of knowing. The google IP returned by the reverse tether method did not appear at all in RethinkDNS testing under identical conditions.

wizoatk

llama420 The fault appears to be

[...]

Heisenbug – a bug that seems to disappear or alter its behaviour when you attempt to study it. Named after Werner Heisenberg, the physicist who first asserted the observer effect of quantum mechanics, which states that the act of observing a system inevitably alters its state.

GrapheneOS

llama420 It would still be good to know why the reverse tethering app triggers this connection. It isn't something which happens by default in a regular configuration.

GrapheneOS

llama420 What does RethinkDNS say is making the connection? It might not be able to identify it due to the usage of ADB shell, etc. but it might be helpful.

de0u

llama420 As the saying goes, "All's well that ends well".

llama420

wizoatk Ha, yeah. The irony...
GrapheneOS RethinkDNS linked gstatic to Download Manager, Downloads, com.android.providers.media, Sounds, and MTP Host. Gnirehtet was undetected by Rethink.

llama420

GrapheneOS Interestingly, just got gstatic without Gnirehtet installed on a new boot, though more apps are installed now. Will test further.

llama420

GrapheneOS May be tied to the debugging connection itself rather than Gnirehtet. New test without the phone plugged in came up clean except for AT&T. Maybe the adb Linux package is doing it.

llama420

GrapheneOS Here's a log of the android related Linux packages on my PC:
dpkg -l | grep -i 'android|sdk|ndk|adb|fastboot'
ii adb 1:34.0.4-1build3 amd64 Android Debug Bridge
ii android-libbase:amd64 1:34.0.4-1build3 amd64 Android base library
ii android-libboringssl:amd64 14.0.0+r11-4build1 amd64 Google's internal fork of OpenSSL for the Android SDK
ii android-libcutils:amd64 1:34.0.4-1build3 amd64 Android utils library for C
ii android-liblog:amd64 1:34.0.4-1build3 amd64 Android NDK logger interfaces
ii android-libziparchive:amd64 1:34.0.4-1build3 amd64 Library for ZIP archives
ii android-sdk-platform-tools-common 28.0.2+9 all Tools for interacting with an Android platform - Common files
ii libmfx1:amd64 22.5.4-1 amd64 Intel Media SDK -- shared library
ii mobile-broadband-provider-info 20230416-1 all database of mobile broadband service providers
ii python3-sentry-sdk 1.39.2-0.1 all New Python SDK for Sentry.io (Python 3)

« Previous Page Next Page »