Signing in to corporate Wifi breaks all networking

Harald

Hello everyone. I am having an unusual problem with Wifi.

My employer offers a Wifi network for our personal devices. It is an “open” network with a captive portal, once we login to the portal with our company credentials then we have access to the Internet. However, it will only work until the next reboot of the device.

After rebooting, attempting to access any website in Vanadium shows an error that “this site is not secure” (even when the site is normally HTTPS), and when selecting “continue anyway” it is unable to find the server IP address. All apps are unable to contact their respective Internet services.

Curiously, the inability to connect to the Internet persists even if I switch to mobile data or to my own Wifi network at home, and even if I reboot again. The only solution is to forcibly reset all Wifi/BT/Mobile settings under Settings > System.

I have been able to reproduce this for several days now. If I login to the corporate Wifi and reboot, it breaks all Internet access through all access points, until I forcibly reset Wifi settings.

This does not happen with my iOS device. What is going on here?

evalda

This is likely related to WiFi mac address randomization... Tap on the gear icon next to that WiFi network in Settings, select "per-network" randomization in Privacy option, then reconnect to your WiFi network, pass captive portal and you should be all good.

Harald

evalda Fortunately I am at work to test this right now. I can confirm that all three MAC address options produce the same result. There is still no Internet access after using the corporate Wifi and rebooting.

evalda

Harald Thanks for letting us know... Were you able to pass captive portal after changing Mac randomization options or you didn't see the portal page?

Harald

evalda The captive portal login page always comes up after changing the option or forgetting the network. Even when the Internet is otherwise not working.

Edit: I am also always able to login to it too, in case that was unclear

evalda

I see, thanks... Do you think there a change the captive portal installs some kind of configuration profile (not to be confused with user profiles) that screws up networking?

EDIT: can you try it on stock Android to see if GOS makes any difference?

Harald

evalda That’s a possibility, maybe even likely, but why would GrapheneOS allow this sort of profile to be installed without prompting the user? Why would the profile persist after “forgetting” the network, and only go away by using the system’s Wifi/BT/Mobile Network reset?

If that were the case, how would I block the profile, or alternatively how would I get rid of it without losing all my saved networks + WPA keys?

I can confirm that this issue does not occur in iOS but it would be a couple days before I can flash the stock Pixel ROM and test it here at work.

evalda

Thanks! I don't have a similar WiFi to research it... Would be interesting to hear how it works with stock Pixel...

You can link this post in gos-offtopic room on matrix if you like, maybe others will have more insight

Harald

I have narrowed down the problem to the presence of Orbot. It seems that the system believes Orbot to be the system-wide VPN and because there is no network access until I login to the captive portal upon reboot, its kill-switch blocks all connections. This is despite Orbot not being configured to start on boot nor to be the system-wide VPN.

The kill-switch also blocks Orbot itself from connecting to anything. Laughable, right? Only going to the system Network settings and "forgetting" the VPN will allow network access.

evalda

Harald Good on you for figuring it out!

Interesting I have always on VPN (regular VPN not Orbot) and don't have this issue with captive portals. I think GOS bypasses VPN for captive portals exactly for that reason - VPN can't connect before you pass captive portal and blocking Internet if VPN is not running would block access to the captive portal... Chicken and egg of sorts. So GOS bypassing VPN for captive portals seem to work reliability for me.

There must be something different about Orbot which makes it break in that scenario.

lbschenkel

Stupid question, but did you check that both switches are off in Android VPN settings? One is for "always on" and the other for "block connections".

Harald

lbschenkel Indeed, it is set to block connections as well. Orbot is set up to act as a VPN for certain specific apps, and I do want it to block non-Orbot connections for those apps. However, I do not want it to block it for all apps. And in any case, connectivity should be restored once Orbot connects to the Tor network.

Seems that GOS is unaware of Orbot's split-tunneling which causes this problem.

Harald

evalda To be more clear, it is still allowing access to the captive portal. But the kill-switch functionality blocks access even after signing in to the captive portal.