[Feature Request] VPN forcing for the WiFi Android hotspot

[git70]

Is it possible to implement network traffic directing by VPN for devices connected to the Android device via the WiFi hotspot?
This is very disturbing behavior now that hotspot connections are leaking into a cellular ISP.
The user trusts "Killswitch" and "Always on VPN", but suddenly it turns out that there is an exception.
I have no even notification or warning, I discovered it by accident.
There are use scenarios in oppressive countries where such behavior can have catastrophic effects...

Edit:
https://github.com/mullvad/mullvadvpn-app/blob/master/docs/security.md
"...The main purpose of the app is to allow the user to make all network/internet traffic to and from the device travel via an encrypted VPN tunnel..."
Even here you can be misled and understand "All Network/Internet Traffic" as literally ALL

[ovosimpatico]

It is out of their control. Android has limitations on VPN apps, and some traffic is leaked on a regular Android phone.

Look at their official blog post: https://mullvad.net/en/blog/2022/10/10/android-leaks-connectivity-check-traffic/

[git70]

For some people it can be very dangerous because the user is not aware of this behavior.

I respect and appreciate your care for every (even the smallest) security and privacy details (the above blog entry is the best proof) and I understand that you are limited by the operating system API.

Although @thestinger was a bit nervous when I called the hotspot behavior "leakage" (everyone has the right to define the word "leakage", and I had no bad intentions) and this matter has a low priority in their system, it is the only hope for me and similar people are repairing this behavior / leakage in GrapheneOS (I have no illusions that Big G will fix it).

[faern]

I agree that we should update our documentation around this! Sorry for being unclear. It is true that the app (and no other VPN app) can automatically tunnel tethered devices.

However, you can install a socks proxy app on your Android device and configure your other devices to use it. When you connect to the Android device's WiFi you can configure it to use the proxy on the port you have configured. The tethered device can then go via the VPN tunnel (since the traffic from the socks proxy app will go through the tunnel)

@sabercodic You have done this. Maybe you have better instructions to provide?

[git70]

This is a great idea!
Or alternatively simply start a separate VPN tunnel on the connected device (on the hotspot client).

Maybe it is worth updating the last blog entry or even creating a new article so that more users are aware of the behavior of the Android hotspot?

In my country, the consequences of the lack of this information may be terrible. Give yourself a situation when during the anti -government protest on the streets the only access to the Internet is via VPN - then one person wants to run a hotspot so that others can use and suddenly it turns out that they connect without VPN :(

[faern]

We should of course improve our documentation! But I must also say that if the consequences of not using a VPN is so high, I'd recommend checking your connection before doing anything online: https://mullvad.net/check/

[thestinger]

Android VPN support is per-profile for a reason. It allows not tying every profile together. It's not clear how that could be properly extended to tethered devices with an app-based VPN. Routing it through the Owner profile VPN would not be respecting the existing privacy model not tying the traffic together.

[git70]

Where do you see disinformation and a reason for banning?
Put the slack or drink less coffee ...
Above, all friends explained to me the issue and gave help, only you attack me because I am not a programmer and specialist.

I am not your enemy and I am not related to the GrapheneOS competition (you have no competition, you are the best!) At least 200 people in my country began to use GOS thanks to me and many of them support the project of subsidies (I also). It's sad that you treat me like an enemy.

I have the impression that if I was called Mike Kuketz (or maybe it's true?), I would receive a full explanation of the problem instead of a ban.
Instead of removing my question from your tracker, it was enough for me to answer that the hotspot matter is not easy to solve.
I asked my question only because this post opened the hope of solving the problem ...

Sorry for littering the offtopic thread...

[git70]

I agree that we should update our documentation around this! Sorry for being unclear. It is true that the app (and no other VPN app) can automatically tunnel tethered devices.

@faern
Now I thought that in connection with this article, maybe it is worth writing a second one because things are related from the point of view of some users and it is worth informing them about how the hotspot works.
Something like that

[alfredonodo]

Hi,
I know this is an old discussion. However, there is good news.
In particular I found that there are at least 3 ways to get hotspot traffic properly routed in the VPN:

1. For a general user with stock Android, via a proxy, specifically an open source one on f-droid SocksTun or sing-box or closed source on play store.
2. For average users, using lineage OS and its forks such as /e/ OS or iodè OS, as they have, as of android 12+, an option in the operating system settings: Allow clients to use VPNs ().
3. For advanced users, using a rooted device, as described here.

Thank you

P.S. lineage OS commits:
https://review.lineageos.org/c/LineageOS/android_packages_modules_Connectivity/+/369206
https://review.lineageos.org/c/LineageOS/android_frameworks_base/+/258516/2
https://review.lineageos.org/c/LineageOS/android_packages_apps_Settings/+/368814

[thestinger]

For average users, using lineage OS and its forks such as /e/ OS or iodè OS, as they have, as of android 12+, an option in the operating system settings: Allow clients to use VPNs

The LineageOS feature implements this very incorrectly and has major leaks. It's far worse doing this than following the intended approach of per-profile VPNs which implies not routing entirely separate devices through the Owner user VPN. It's not how it's designed to work and is not good for privacy compared to a per-device VPN route. The correct way to implement it for tethered devices would be a per-device route which requires a different kind of VPN integration than what per-profile VPN apps provide.

Everything you've referenced is improperly implemented and bad for privacy due to leaks and routing traffic which shouldn't go through the Owner user through it. That is not a good thing, and is a cross-device leak within how the Android VPN model is meant to work.

[thestinger]

You're trying to reduce privacy by introducing a leak, not fixing one. It worked as intended before, but you want to use an implementation of routing some of the traffic via the Owner user VPN which still bypasses it when it goes down, etc. It doesn't even attempt to make VPN lockdown mode work for it. You are far better off using a reliable VPN connection for each device where each one can get their own exit IP and doesn't simply stop using a VPN whenever the VPN goes down in Owner.

[alfredonodo]

For average users, using lineage OS and its forks such as /e/ OS or iodè OS, as they have, as of android 12+, an option in the operating system settings: Allow clients to use VPNs

The LineageOS feature implements this very incorrectly and has major leaks. It's far worse doing this than following the intended approach of per-profile VPNs which implies not routing entirely separate devices through the Owner user VPN. It's not how it's designed to work and is not good for privacy compared to a per-device VPN route. The correct way to implement it for tethered devices would be a per-device route which requires a different kind of VPN integration than what per-profile VPN apps provide.

Everything you've referenced is improperly implemented and bad for privacy due to leaks and routing traffic which shouldn't go through the Owner user through it. That is not a good thing, and is a cross-device leak within how the Android VPN model is meant to work.

Do you have any references for your claims? Because according to my tests I see no leaks using solutions 1) and 2).

[thestinger]

The LineageOS implementation definitely has leaks when the VPN goes down which has been repeated talked about by DivestOS and they've talked about potentially removing the feature due to it.

It also does not fit into the per-profile model used by Android's VPN support which would require that it used a separate VPN route for each tethered device, not something that fits with using the Owner VPN for it. You get better privacy using a per-device route than making all of the traffic across devices get tied together so that you always have the same IP across each device. This can be considered another kind of leak, similar to if a profile was able to send traffic through another profile's VPN which is a known bug in the standard Android VPN support via multicast packets (https://grapheneos.org/features#improved-vpn-leak-blocking).