DNS traffic can leak outside the VPN tunnel on Android

I don't use Mullvad, but I respect the shit out of them. This is a good, information dense explanation of the problem, their short term workaround and potential workarounds for others, as well as what will need to be fixed in Android. Good stuff.

<i>rethinkdns dev here</i><p>&gt; <i>these issues should be addressed in the OS in order to protect all Android users regardless of which apps they use.</i><p>Android&#x27;s <i>paranoid networking</i> has always had an exception for <i>System</i> and <i>OEM</i> apps (which include Google apps). Most such bugs fixes are unlikely to fix that core assumption. Some code refs: <a href="https:&#x2F;&#x2F;github.com&#x2F;celzero&#x2F;rethink-app&#x2F;issues&#x2F;224">https:&#x2F;&#x2F;github.com&#x2F;celzero&#x2F;rethink-app&#x2F;issues&#x2F;224</a><p>&gt; <i>The leak during tunnel reconnects is harder for us to mitigate in our app. We are still looking for solutions.</i><p>Android supports <i>seamless handover</i> between two TUN devices (on reconfiguration). It is tricky to get it right, but implementable.

This has been a long-standing issue with android, that no matter how much you want it to use internal dns servers only, it&#x27;ll decide to flip to cell and use those as it needs&#x2F;wants. I&#x27;ve observed adb debugs for times recently to see why&#x2F;when wireless was disconnecting, and it comes down to liveliness checks that if it can&#x27;t see or resolve something, it&#x27;ll simply bring up and try the cell data to do so.<p>It&#x27;s especially frustrating when using internal dns records that only live internal will randomly not work on a phone. I can see that the device is on wifi that is feeding internal dns servers with the records, but it&#x27;s resolving externally still for some android reason. This happens on my SO&#x27;s phone when using things all the time, but I really don&#x27;t use my phone in the house except to read books and rarely notice.<p>No idea how apple is about this, but the fact they try to proxy everything you do via their &quot;privacy&quot; vpn by default including dns as DOH, I can&#x27;t imagine it is any better trying to use what they&#x27;d see as a competing product, and we know how apple feels about those.

A few years ago, when I was testing various VPN set ups for a project, one thing I would do is have a MikroTik firewall device (hardware) sit between my computer and my main router, it’s only purpose would be to block any traffic, not dst for the IP address of the VPN server that the pc was connecting to.<p>This worked great to ensure that no traffic was leaked from pc to vpn server. The IP address of the VPN server you’re making use of rarely changes or if it does it’s easy enough to change on the MikroTik firewall.<p>Another method is to block all traffic not to the port&#x2F;protocol pair being used by the VPN server if you don’t know the servers IP address (or if it changes). As an example drop any traffic not dst UDP 1194 (based on the type of VPN, of course). MikroTik routers also have a great little tool called torch that allows you to quickly and easily watch traffic (in addition to of course, supporting packet captures. Mikrotik routers are very reasonably priced and range from as low as $30 up to $3000 - all with no software licenses, and they are very powerful and capable if you know what you’re doing.

The Problem with Android in regards to DNS: you just can&#x27;t set your own IPv6 DNS Server on that platform, it gets changed anytime anything happens to your wifi. There is no app, even for rooted android, which can disable the operating system from changing it.<p>When you are stuck with a router that always hands out IPv6 Adresses and doesn&#x27;t let you turn that off you are just screwed.<p>I don&#x27;t even know if you could install a firewall appliance behind that router and strip out the IPv6 DNS Servers it advertises.

I guess the safest setup is to have mobile data off on your phone and carry an OpenWRT hotspot to do the VPN bit upstream from the phone.

Any system where you don&#x27;t have root access in insecure by it&#x27;s very definition. Android and ios are hilarious.

Block connections without VPN is turning out to be as reliable as my self-control at an all-you-can-eat buffet…if I&#x27;m not mistaken, these DNS leaks can very much expose where you browse and even your location, which kinda defeats the whole purpose of a VPN (and yes, even with VPNs, Android might still leak your DNS info. If you&#x27;re really privacy-conscious, you might need to look beyond just using Android or keep your sensitive stuff off your phone)

Sometimes you wonder if those &quot;bugs&quot; are intentionally well placed or not. Especially since big tech has been known that they work together with a kinds of intelligence agencies. I just can&#x27;t believe that so many bugs like this in Android are there &quot;not intentionally&quot; at this point since this is not the first time I have heard about these kinds of bugs in Android.

I&#x27;ve sort of suspected this the case for a while. On VPN, MMS and Visual Voicemail still work on Android. Both of these require direct mobile access or they will get rejected (sometimes they are only on the mobile network, or else they requests get rejected if they don&#x27;t come from within the mobile network). I suspect the same is true of VoLTE. If there is a VPN, that would mess things up.<p>I found this out since on Mobile Linux, if you enable VPN, the VPN breaks all of those.<p>I don&#x27;t think there is a clear way to fix this on Android without breaking a lot of expected functionalty.

Luckily WireGuard doesn&#x27;t have this issue on desktop peers. Although I did run into DNS leaking due to my peer config having an exception for my local network address range. The way I resolved that is to setup dnsmasq on the server and set that as my primary DNS.<p>I will say that I wish there was a DisallowedIPs directive. It&#x27;s fun having to subtract a &#x2F;24 from 0.0.0.0&#x2F;0, although there are calculators you can use.

I think this finding originates with the GrapheneOS community [0]. Edit: I guess that may be the same user reporting both.<p>0: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;GrapheneOS&#x2F;status&#x2F;1782477984156311814" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;GrapheneOS&#x2F;status&#x2F;1782477984156311814</a>

I gave on trusting phones to secure data a long time ago. But my approach is, at least when on wifi, to allow access to the internet only if the device connects to a local vpn gateway. 100% leak proof and prevents almost all wifi&#x2F;lan&#x2F;mitm attacks.

I have also noticed that when using the FoxyProxy addon under Firefox, even with a SOCKS5 proxy in use, it will leak DNS requests through the direct connection unless you also set a manual proxy in the regular Firefox settings as well.

&gt; Depending on your threat model this might mean that you should avoid using Android altogether for anything sensitive<p>I once worked with someone who worked with someone that had previously been a major Android fanboy, but after doing some work that required a security clearance, they became an iPhone user and insisted their family get iPhones too.

I noticed this with my Android TV. Sometimes my location would leak and certain streaming sites stopped working (I&#x27;m outside the US).<p>Got an AppleTV and this issue stopped.

That&#x27;s unfortunate, they only recently rolled out prompts to push Android users away from their in-app always-on functionality to the built in version.

So, a closed source operating system can do things the user can&#x27;t control? I don&#x27;t know what&#x27;s more impressive, the fact people don&#x27;t apprehend this reality, or the fact people still rely on VPNs (especially a third party) for privacy or whatever.

Apologies if this is a dumb question—could a service like NextDNS help prevent this?

APNS traffic leaks outside of the VPN on iOS as well (except possibly OS-supported VPNs installed with a provisioning profile).<p>Apple doesn’t seem to care, as they don’t care about preserving your privacy wrt themselves.

If google wasn&#x27;t evil: then the default for all permissions would be to mock fake data that the app could never recognize as fake. Then you pick and choose which apps get REAL data.

Linux has network namespaces, which can be used to isolate programs so they don&#x27;t see any external networking when no VPN is available. Does android not use this for its VPN feature?

Mullvad&#x27;s security team should have found this problem on their own, and as soon as it appeared:<p>Inspect security empirically - you might <i>think</i> that your security must work, but that means nothing; you must investigate empirically: All data going to the Internet must pass through the gateway. Collect the packets on the gateway, not on the device, and inspect them for leaks. Finding leaks should be trivial at that point.<p>The only trick might be cellular connections: We don&#x27;t know that leaks aren&#x27;t unique to cellular connections. I know cellular gateways can be setup, but are the packets inspectable at a level that will reveal leaks?

This can also be detected by using the NetGuard firewall which acts as a vpn. Even in full lockdown mode, some kinds of newwork traffic gets through.

<i>We have reported the issues and suggested improvements to Google</i><p>Isn&#x27;t Android open source? Can they not fix it for them and submit a PR?

I don&#x27;t VPNs, nor Mullvad, but I do appreciate the transparency here. We need to support more companies like this.

toy with me for a bit, couldn&#x27;t Mullvad be another &quot;Encrochat&quot; in the making?<p>Encrochat was similarly marketed as absolutely trustable complete with experts covering &quot;we fixed this vulnerability&#x2F;exploit and you can trust us&quot; vibes (<a href="https:&#x2F;&#x2F;www.manchestereveningnews.co.uk&#x2F;news&#x2F;uk-news&#x2F;dads-secret-criminal-life-unmasked-29089865" rel="nofollow">https:&#x2F;&#x2F;www.manchestereveningnews.co.uk&#x2F;news&#x2F;uk-news&#x2F;dads-se...</a>)<p>Isn&#x27;t Mullvad the same thing?<p>Do you really think they would allow terrorists like Hamas use Mullvad to coordinate attacks? Coincidentally, Hamas does not trust any sort of VPN, opting for underground land lines.

Also apparently tethering traffic doesn&#x27;t go via the VPN? That&#x27;s a silly choice too.

I really _really_ want to love mullvad, but they still don&#x27;t ignore DMCA requests.

What if I have private dns set up on my phone?

I like Mullvad. Just wish they used less shitty providers - all of them are super dodgy from xtom (super unhinged owner) to m247. Mullvad presents a great image but their providers would probably sell netflow traffic for $7 a month to any interested party. They really do use the scum of the earth providers instead of investing in their own infra

used an exploit to get vpn working on router...

Can&#x27;t you just use a DNS provider that encrypts the traffic?