Suggestions for minimizing VPN leaks

Probably9857

My current setup:

I run a few self-hosted services on my local network
I have apps on my phone that I want to be able to connect to these services
I have all apps in one profile
I use Mullvad VPN with split tunneling, and allowing connections w/o VPN (killswitch off)

Are there improvements I could make to this setup that would mimimize VPN leaks while still allowing me to access the self-hosted services on my LAN?

The problem with separate profiles:

The apps that connect to the local network need to be able to share data with other apps (copy & paste, save files where other apps can access them)

The problem with Private Space:

My self-hosted services require a certificate to be installed
It seems like it's not possible to install certificates in the Private Space

My tentative conclusion is that my desired setup can only work if all apps are in the same profile.

Given all of that, what setup would you recommend that will (in order of priority):

Allow selected apps to connect to self-hosted services on my LAN
Allow those apps to share data with other apps
Minimize the potential for VPN leaks

Thanks in advance for any suggestions.

Sigismund

Probably9857 Are there improvements I could make to this setup that would mimimize VPN leaks while still allowing me to access the self-hosted services on my LAN?

Run mullvad on your router. If you can't with current one see if you can get a refurbished PC for opnsense.

ryrona

Probably9857 My self-hosted services require a certificate to be installed

Maybe check if authentication to the service can be done by other means than installing a certificate on each client device?

I think the private space solution sounds like the most secure one in your use-case, as you would have fairly good control over which data reached internet through VPN and which data reached services on your local network. The solution by @Sigismund is of course also worth considering, but doesn't offer the same strong boundary between VPN bridged internet and local network services.

mrket

Probably9857 You could use the Wireguard app directly with Mullvad, and add the machine(s) running your local services as additional peers (which means setting up Wireguard on them as well), I do this but with IVPN.

To also control which apps can access your LAN, you could use Rethink with multiple Wireguard tunnels, though in my experience Wireguard in general is fairly buggy when used through Rethink.

Either of these options should allow you to keep the kill switch on.

Probably9857

ryrona

Private Space would be my first choice, if only the certificate issue could be fixed or worked around.

Sigismund

I already have OpenWrt on my router, so this is definitely a possibility. I've considered it before, but my limited networking skills, plus having an entire household of devices to deal with (not all of which would use the VPN) always intimidated me.

I'm going to research this further and reconsider. It would definitely be an improvement on my current setup if I could manage to get it working. Thanks for the suggestion.

Sigismund

ryrona Maybe check if authentication to the service can be done by other means than installing a certificate on each client device?

Of course I may be wrong but I suspect this is not the authentication that is cert based but rather browser won't allow to connect with a self signed cert,example would be vaultwarden.

ryrona fairly good control over which data reached internet through VPN and which data reached services on your local network

I'd argue that same if not higher level of control can be achieved via opnsense but of course it will require more work. To each their own.

Probably9857

Sigismund browser won't allow to connect with a self signed cert,example would be vaultwarden.

Yes, exactly this