RethinkDNS IP leaks

aeououoieaeuaie

So.. I have private space, with RethinkDNS inside, set as Always-on + kill switch, and connected to a Wireguard VPN.

Google services are installed in that private space, logged into a throw-away account that is not used anywhere else.

I used Google Takeout (Access Log Activity). Out of 2527 events it gives me (past month), almost all exit from the VPN... except for 3:

8xxxxxxxxxxx,2026-03-15 16:40:05 UTC,135.xxx.yyy.zzz,,No,,,,Os : ANDROID_OS.,Other,Other,,
8xxxxxxxxxxx,2026-03-15 16:40:05 UTC,135.xxx.yyy.zzz,,No,,,,App : GMM_APP. Os : ANDROID_OS.,Maps,Other,,
8xxxxxxxxxxx,2026-03-15 16:40:05 UTC,135.xxx.yyy.zzz,,No,,,,App : GMM_APP. App Version : 106847476. Os : ANDROID_OS. Os Version : 16. Device Type : MOBILE.,Maps,Other,,
8xxxxxxxxxxx,2026-03-15 16:40:04 UTC,82.xxx.yyy.zzz,,No,,,,App : OTHER_APP. Os : ANDROID_OS. Os Version : 16. Device Type : MOBILE.,Other,Other,,
8xxxxxxxxxxx,2026-03-15 16:40:02 UTC,135.xxx.yyy.zzz,,No,,,,Os : ANDROID_OS. Device Type : MOBILE.,Other,Other,,
8xxxxxxxxxxx,2026-03-15 16:40:01 UTC,135.xxx.yyy.zzz,,No,,,,Os : ANDROID_OS. Device Type : MOBILE.,Other,Other,,
8xxxxxxxxxxx,2026-03-15 16:40:00 UTC,135.xxx.yyy.zzz,,No,,,,Os : ANDROID_OS.,Other,Other,,
8xxxxxxxxxxx,2026-03-15 16:40:00 UTC,135.xxx.yyy.zzz,,No,,,,App : PLAY_APP. App Version : 48.9.30. Os : ANDROID_OS. Device Type : MOBILE.,Play,Other,,
8xxxxxxxxxxx,2026-03-15 16:39:59 UTC,82.xxx.yyy.zzz,,No,,,,App : OTHER_APP. Os : ANDROID_OS. Os Version : 16. Device Type : MOBILE.,Other,Other,,
8xxxxxxxxxxx,2026-03-15 16:34:22 UTC,135.xxx.yyy.zzz,,No,,,,Os : ANDROID_OS.,Other,Other,,
8xxxxxxxxxxx,2026-03-15 16:34:22 UTC,135.xxx.yyy.zzz,,No,,,,App : OTHER_APP. Os : ANDROID_OS. Os Version : 16. Device Type : MOBILE.,Other,Other,,
8xxxxxxxxxxx,2026-03-15 16:34:18 UTC,135.xxx.yyy.zzz,,No,,,,App : OTHER_APP. Os : ANDROID_OS. Os Version : 16. Device Type : MOBILE.,Other,Other,,

8xxxxxxxxxxx,2026-03-09 01:28:44 UTC,135.xxx.yyy.zzz,,No,,,,Os : ANDROID_OS. Device Type : MOBILE.,Other,Other,,
8xxxxxxxxxxx,2026-03-09 01:28:44 UTC,135.xxx.yyy.zzz,,No,,,,App : OTHER_APP. Os : ANDROID_OS. Os Version : 16. Device Type : MOBILE.,Other,Other,,
8xxxxxxxxxxx,2026-03-09 01:28:43 UTC,135.xxx.yyy.zzz,,No,,,,App : PLAY_APP. App Version : 48.9.30. Os : ANDROID_OS. Device Type : MOBILE.,Play,Other,,
8xxxxxxxxxxx,2026-03-09 01:15:44 UTC,62.xxx.yyy.zzz,,No,,,,App : GSA_APP. Os : ANDROID_OS. Os Version : 16. Device Type : MOBILE.,Other,Other,,
8xxxxxxxxxxx,2026-03-09 01:12:37 UTC,135.xxx.yyy.zzz,,No,,,,App : GSA_APP. Os : ANDROID_OS. Os Version : 16. Device Type : MOBILE.,Other,Other,,
8xxxxxxxxxxx,2026-03-09 01:12:36 UTC,135.xxx.yyy.zzz,,No,,,,App : GSA_APP. Os : ANDROID_OS. Os Version : 16. Device Type : MOBILE.,Other,Other,,
8xxxxxxxxxxx,2026-03-09 01:12:23 UTC,135.xxx.yyy.zzz,,No,,,,App : GSA_APP. Os : ANDROID_OS. Os Version : 16. Device Type : MOBILE.,Other,Other,,

(Note that at 2026-03-15 16:39:59, the OTHER_APP blissfully finished its business bypassing the VPN, while other connections did go though it.)

Config: Network tab has everything off; in Settings has on-device log, notification, and at that point it (erroneously) had Auto-start on power-up. Device: Pixel 9A, kept current.

Anyone knows why is this happening, is it down to Rethink or the OS, and how to make it not happen?

Johnnyloans

@littlerack @randomname

aeououoieaeuaie almost all exit from the VPN... except for 3:

Good day! Sorry about the mean commenter :[

All android devices have a vpn leak issue. Google is aware for close to a year about this and seemingly doesnt care much. Your issue is probably related.

Grapheneos has more fixes for this than other android OS

Our priority is fixing leaks rather than an issue causing an annoyance where a reboot might be required to get connectivity again since leak blocking is working properly for it. We have 1 full-time developer mainly working on resolving VPN issues right now.

Source:
https://xcancel.com/GrapheneOS/status/2034412540520718785#m

Note that "1 developer" is a significant portion of their nonprofit, donation-funded team.

mmobder

aeououoieaeuaie do you have private DNS "OFF"?

ignoramous

aeououoieaeuaie Anyone knows why is this happening, is it down to Rethink or the OS, and how to make it not happen?

Are you using WireGuard in Simple mode or Advanced mode? If in Advanced mode, do you have Lockdown turned ON from Configure -> Proxy -> Setup WireGuard -> (that particular WireGuard config).

In the next version, v055v, we've made Lockdown for all Advanced mode WireGuards the default. On prior versions, it is set to off.

If you were running WireGuard in Simple mode (which is Lockdown by default and it cannot be even turned OFF in the current versions), it is worrying there will be leaks of any kind.

Though, keep in mind that in addition to actual "leaks" discussed above, System apps (usually the ones preinstalled) and the OS components (like for "connectivity checks") themselves can bypass even Lockdown / Block connections without VPN at will (and this isn't considered a "leak"). I'm not sure if that is also the case on GrapheneOS.

One thing you could do is, search for those IPs that "leaked" in Rethink's on-device logs at Configure -> Logs -> Network or Configure -> Network -> DNS (these logs are retained for 7 days or for upto 35000 entries each; whichever limit hits first). Tap on the entry if it is available on your device to bring up a bottomsheet. This bottomsheet contains a bunch of metadata around the connection entry. If Rethink did indeed make the connection outside of the WireGuard tunnel you setup, a chip in the top right-hand corner of the bottomsheet would not show "proxied...".

randomname

had same problem of ip leak a while ago but i dont remember if it was wg-tunnel or rethinkdns app. now i use official wireguard and dont have such issue.

aeououoieaeuaie

Johnnyloans I think this one is subtly different from the other leaks I've seen: it's not the VPN app misbehaving (there were no RDNS updates); it's not weirdness where the system thinks that the VPN app is using split routing (note Do not route private IPs is off) I've seen reported; and it's not system-level connections bypassing the VPN. This is a bona fide installed app (no idea which one, but it managed to authenticate to Google) making successful connections and bypassing the VPN while the kill switch is active.

I was hoping @ignoramous might catch this since I don't have enough data for a proper bug report.

mmobder

Johnnyloans All android devices have a vpn leak issue. Google is aware for close to a year about this and seemingly doesnt care much. Your issue is probably related.

Irena you have linked are not leaks, it's VPN stops working, read carefully, if you have it in Always On, etc.

Johnnyloans

mmobder

You're right that proton is talking about the vpn stops working. It could be Samsung or others have less issues with VPNs than vanilla aosp.

Vpn leaks are in aosp.

Our priority is fixing leaks rather than an issue causing an annoyance where a reboot might be required to get connectivity again ...

mmobder

Johnnyloans Vpn leaks are in aosp.

If one reads what's written and not own mind, then it's easy to interpret it as just a prioritisation note and not a confirmation there are leaks.

Johnnyloans

Johnnyloans Vpn leaks are in aosp.

mmobder If one reads what's written and not own mind, then it's easy to interpret it as just a prioritisation note and not a confirmation there are leaks.

GrapheneOS:

We already have fixes for 5 holes in Android's VPN leak protection. We're working on identifying all remaining issues and resolving those. The most severe issues are fixed but there are remaining bugs in the Android VPN APIs we need to resolve. It's a lot of work and not easy.

We have 5 fixes
There are remaining bugs in vpn that we need to resolve
We are identifying remaining issues.
Our priority is fixing leaks rather than the vpn stops working and you have to reboot.

This is break-fix not preventative measures or a double check for no issues.

mmobder

Johnnyloans "There are no known outbound VPN leaks on GrapheneOS when Private DNS is set to Off" https://github.com/GrapheneOS/os-issue-tracker/issues/6873#issuecomment-3684570463

Johnnyloans

mmobder There are no known ... leaks ... when Private DNS is set to Off

A prerequisite/constraint.

And if private dns is set to on?

Private DNS on is the default which most people are not of the fine-print of and won't touch?

Even if 100% of people switch it off. There are leaks present.

0.0.0.0/0 route VPNs can/do still work with private dns on. Some users might verify no leaks for a few minutes or hours then go about their day.

Edit:

You skipped over the first sentence to cherry pick a line that you thought proves your point?

You need to set Private DNS to Off when using a VPN to avoid leaks.

Johnnyloans

Johnnyloans most people are not of the fine-print

Not aware of

Johnnyloans There are leaks present

In aosp

mmobder

Johnnyloans Private DNS on is the default

Are you certain?

mmobder

Johnnyloans you're overcomplicating, a person comes, claims a leak on GOS/rethinkdns, you confirm there are leaks, probably "relevant", quote gos account as confirmation of known leaks and gos fixing them.

I've just pointed you're wrong in this confirmation, there are no known leaks on gos and as per the quote I've included, it shouldn't be there, as there seems to be some prevention mechanism. If the person was careful enough not to combine pDNS and VPN, then most likely there are some other reasons for what the OP observes.

Johnnyloans

Johnnyloans There are leaks present

In aosp

Correction again:
... And gos if private dns is on.

No leaks with it off.

TrustExecutor

mmobder Automatic is the default option for me, I haven't changed it. I don't know if this means "on" by defaults or uf some other mechanism sets what server to use.

dhhdjbd

TrustExecutor

it should be set to 'off', not 'automatic' either

mmobder

ignoramous 'm not sure if that is also the case on GrapheneOS.

It is. "Connectivity checks are performed for each network connection and for VPN connections on top of those. This allows the OS to choose the right underlying network for a VPN and to handle many types of captive portals without the user turning off their VPN." https://grapheneos.org/faq

aeououoieaeuaie

ignoramous

This is all Simple mode. v0.5.5t (F-Droid).

Note that GOS comes with zero Google stuff of any kind and does not use Google endpoints for system-level activity. It only allows installing Google services as regular apps, and this phone only has them installed in Private space.

I did find the events in RDNS logs. Two connections by Play Services marked as not proxied, to mtalk and securitydomain-pa. Both initiated at the same instant, as I unlocked the Private space. I was afraid this would be a race condition on start.

Not sure how to dump textual connection logs, so providing screenshots:

Connection list with a bit of context. Two connections at 16:39:59 do not have a key symbol.
1st failure.
2nd failure.
1st success right after, as a form of control.

Edit: Images disabled, replaced with links.

mmobder

aeououoieaeuaie Note that GOS comes with zero Google stuff of any kind and does not use Google endpoints for system-level activity

strange, I thought that Google servers are available for a lot of stuff in GOS, be it connectivity checks, location or widevine provisioning (though I can't recall what's the default for widevine).
Furthermore, for those who don't want to stand-out in network traffic as GOS users, it's recommended to ensure google-ones are used.
So it's definitely not zero and properly documented in FAQ