DNS and VPN

DistinguishedKelp

I installed Proton VPN and enabled the kill switch feature in the app and always-on in system settings. In the process, I saw this note in the app:

When kill switch is on, you won't be able to connect to:

Websites and apps excluded from your VPN connection through split tunneling

Devices on your LAN

This is an issue because I host internal PKI, DNS, and apps. Am I able to fix this issue by defining hosts? For example, I saw a DNS app somewhere that let you specify DNS hostnames, or can I edit whatever Android's equivalent of /etc/host is?

GrouchyGrape

DistinguishedKelp this isn't possible using the Proton app. RethinkDNS should be capable of doing what your wanting.

words

DistinguishedKelp

No VPN app has implemented local routing when kill switch is enabled. I remember someone from the GrapheneOS team suggesting to use the standard Wireguard app and change the addresses wg option, but it didn't work for me.

Novalissoide

If so, consider the v0.5.5u version of RethinkDNS
https://github.com/celzero/rethink-app/releases

DistinguishedKelp

Is the inability to split tunnel due to Proton's VPN app, or how Android itself handles always-on VPN? If RethinkDNS works, then would that suggest it's the app itself and something like OpenVPN with proper configurations would also work? Or does RethinkDNS fundamentally change how the Android handles always-on? And would RethinkDNS weaken the improvements that GOS team have put into improving DNS leaks?

GrouchyGrape

DistinguishedKelp proton and split tunneling works, but it's an all or nothing approach. You can't have split tunneling sometimes (e.g. when on home WiFi) and disabled when on cellular without manually enabling/disabling it. RethinkDNS has frankly an insane amount of customization, it's very configurable.

I also self host and do DNS "stuff" at home. Personally, I just use the Proton app with always on split tunneling for specific apps and go on about my day.

DistinguishedKelp

GrouchyGrape I just use the Proton app with always on split tunneling

Ah, so kill switch != always on? That might have been my confusion, assuming that was Proton's way of guiding you to setup always on and not some additional proprietary functionality. All I'm after is DNS for local apps with some degree ensuring no DNS leaking and the VPN stays on, which the Android always on should provide, so that should work for me.

Novalissoide

DistinguishedKelp RethinkDNS also has excellent monitoring and logging of the traffic.

MetropleX

If you want to split tunnel using your VPN providers app, you can't also have block connections enabled under your VPN settings as those apps sitting outside the tunnel will have their connections blocked. If you want those apps outside the tunnel to work disable block connections.

SETTINGS>NETWORK AND INTERNET>VPN>COG ICON NEXT TO VPN PROVIDER>BLOCK CONNECTIONS WITHOUT VPN>TOGGLE ON/OFF AS REQUIRED