VPN Leak

Toasted_Mustard

I run Syncthing
(Yes I am aware of the recent Drama and have a strategy about that)
on my phone and a local device.
The local device was a complete fresh install that never interacted with my phone and the devices were never paired before.

When I opened the add remote device screen in the webinterface it suggested the id of my phone as if they saw each other via multicast discovery.

I turned the toggles to prevent bypass and autoconnect on.
In the vpn app local sharing and per app bypass is toggled off.

I do not yet know which software is the problem, the vpn, graphene or syncthing.
Meanwhile if the latter was the problem, it would still be a deficiency in one of the first two.

Probably9857

Toasted_Mustard

It would be helpful if you mention which VPN you're using. Not all VPN apps are well implemented.

indigomadelin

Toasted_Mustard id of my phone

Is it Syncthing ID or hostname visible to other devices on the LAN?

jacksonppp

In syncthing what are your settings for

Announce LAN Addresses
&
Global Announce Enabled

Toasted_Mustard

jacksonppp

These settings are enabled, yes.

But my expectation is, that the VPN should prevent leaking multicast, regardless of the setting in Syncthing.
Which it did in the past.
Global discovery is only natbreaking if the ID is pre-known.

Edit:
The syncthing shows as connected when I afterwards intentionally joined them by Global Discovery. And it shows the VPN exit IP, not the local one.

This supports my mental model, that unicast does not work but at least multicast emission and maybe even multicast reception.
But the phone does not see the other device in Local Discovery. So that may speak against multicast reception.

Toasted_Mustard

I do not know if the device name is visible.
It showed only IDs in the suggestion.

My phone does not see local devices and can not connect directly.
The symptoms look like multicast goes but not unicast.

The VPN is Mullvad in latest version.

ryrona

Toasted_Mustard My phone does not see local devices and can not connect directly.
The symptoms look like multicast goes but not unicast.

Since you know what unicast and multicast is, I assume you also know what Wireshark is and how to use it. Can you run Wireshark on your local device (computer?) to see what is going on.

If the VPN is configured to be always on and block connections not going through the VPN, multicast also should not leak. So if there is such a leak, we really want to know.

Toasted_Mustard But my expectation is, that the VPN should prevent leaking multicast, regardless of the setting in Syncthing.
Which it did in the past.

Yes, this is true, the settings in any app including Syncthing should not matter, as the apps specifically shouldn't be able to bypass the VPN, whatever they do.

ryrona

Toasted_Mustard The VPN is Mullvad in latest version.

Oh, one more thing. Can you double check that you haven't accidentally enabled split tunneling or LAN access in the Mullvad VPN app. Those must be turned off. The VPN apps themselves can allow other apps to bypass the VPN tunnel, and those two features are ways Mullvad VPN allows such bypasses. That is why they need to be turned off for a leak-proof experience.