Can someone explain VPN routing in Graphene?

chmed

I've installed the Netbird application on my device. Netbird is a system of managing wireguard VPN clients in a peer to peer arrangement. I've been running a Netbird VPN between several of my machines for sometime now. My hope was to add this android device as another Netbird client that can reach the Netbird subnet and access those other machines while still reaching "the regular" internet without using the VPN. I'm getting odd behavior with the VPN enabled and I need to know what Graphene is doing in order to troubleshoot where my issues are coming from.
It seems that I'm looking for what is called "split-tunnel" VPN which would direct all traffic to the normal network interface except traffic on the subnet that Netbird is using.
Can someone explain how Graphene/Android routes traffic wrt VPNs and where I can change settings related to this?

VAULT

chmed Hi... I use Proton VPN and you can turn on Split Tunneling in its settings.

chmed

Netbird doesn't have options like that in the settings of the app. It's really a different type of application than Proton. Rather than trying to hide/secure your activity on the wide open web, or allow you to reach services in a particular geographic area, Netbird is largely designed for connecting computers together on a private network. I'm in contact with the developers of Netbird but I'm trying to find more info about what Graphene OS (and perhaps the underlying AOSP) does fundamentally with VPNs.

Oggyo

@chmed
Looks like Netbird is very similar to Tailscale. I use Tailscale and can achieve what you mention in the OP. This is the default configuration.
If I need all traffic to be routed by a specific host - there is an option to use it as an "Exit Node".

I had to turn off the "Private DNS" in the Network settings of GOS. For some reason, the private DNS I'm using doesn't work with Tailscale.

chmed

Oggyo Yes, Tailscale is very similar.
I just tried setting the Private DNS to off instead of auto and I seem to be getting the same behavior.
1) If I have wifi off and my mobile data is the only data, I cannot reach a regular website from the web browser while Netbird is connected. If I switch wifi on, then I can connect to both regular websites & my VPN connected services.
2) My Netbird VPN only shows 1 peer when I connect only over mobile data. If I connect to my local wifi, then all my peers are available.
3) I've tried connecting via wifi at another location but not all of my peers were available and it didn't appear that I could reach any regular websites. (My peers are distributed among several different locations).