Android app doesn't seem to play nicely with other VPN apps.

[JayDoubleu]

Is your feature request related to a problem? Please describe.

I'm using no-root firewall which mimics the actual VPN connectivity in order to control the traffic.
When no-root firewall is turned on, I can see that traffic from tailscale app is being routed to no-root firewall (VPN) however the tailscale communication is no longer working.

Describe the solution you'd like

tailscale to work alongside other VPN apps.

[bradfitz]

Does Android even allow multiple VPN apps at once?

/cc @eliasnaur

[JayDoubleu]

Hmm, the app UI has made an impression that tailscale is not using native Android API for VPN. Now I see this it not the case. I am going to raise another issue about it.

[eliasnaur]

There can be only one active VPN connection at a time on Android. From the VPNService documentation:

There can be only one VPN connection running at the same time. The existing interface is deactivated when a new one is created.

I don't know no-root firewall, so feel free to re-open this issue if you think something could be done to support your use-case.

[JayDoubleu]

That's fine. It works with Island work profile so I should be fine using two VPN's at once using this method :)

[jace]

Stumbled into this looking for a similar solution. @JayDoubleu how does this work? Do the work profile apps get to use a separate VPN from the personal profile?

I use AdGuard Android as a HTTPS ad-blocker, and turning it off causes visible degradation to my internet experience. Since it operates as a VPN, it's mutually incompatible with Tailscale.

AdGuard does have the ability to co-exist with other VPNs, although for now support is limited to Tor (via Orbot) and AdGuard VPN. An official integration would be nice.

[JayDoubleu]

@jace precisely. VPN connection seems to be working separately in each profile

[jace]

I can confirm that it works when using Shelter.

Tailscale in the work profile identifies itself as a separate device, and its VPN is not available in the personal profile.

However, I can clone Chrome and SSH apps into the work profile and use them to access work machines, which serves the purpose.

[jace]

I asked AdGuard if they'd consider integration with Tailscale and they pointed out they already support a SOCKS proxy, which many VPN providers offer.

In Tailscale's case, the SOCKS proxy needs to be running on localhost, but this was requested and turned down in #3424. It'll be nice if Tailscale reconsiders this.

AdGuard Android is the main reason I can't have Tailscale turned on all the time. While I have Tailscale configured to use my AdGuard Home DNS server, DNS-based blocking is not nearly as effective. The quality degradation with AdGuard turned off is jarring.

[fgfg163]

@jace You can install Tailscale and Every Proxy on Shelter, Every Proxy export a SOCKS5 port. This consumes a lot of battery because all traffic will go through Easy Proxy.

[Willie169]

I have Tailscale and Socks5 server with UDP in work profile, and TrackerControl in personal profile using Socks5 proxy. SSH over Tailscale works fine in Termux in personal profile. But Rustdesk in personal profile still can't be connected from other machine using the Tailscale ip (the packets are sent but no response from phone, ping phone works, as inspected in that machine). It can connect when Rustdesk is in work profile but to use accessibility service (for input control) it needs the app to be in personal profile.