Connection outside the VPN allowed when persistent tun is selected

[llima27]

Hi,

I'm using OpenVPN on Android/Google TV. It works very well, even with Tasker to manage different VPN servers required for different apps.

However, I've noticed that even though persistent tun is checked, the connection seems to fall back to no VPN while I'm switching servers. Is this by design, i.e. is persistent tun only supposed to deny connections while reconnecting to the same server?

If yes, is there a way to stop all connections while a connection is not active?

Thanks,
Luiz

[schwabe]

Yes, this is by design. See also the FAQ on this topic:

Nicht-VPN-Verbindungen blockieren ("Killswitch")

It is often desired to block connections without VPN. Other apps often use markting terms like "Killswitch' or "Seamless tunnel' for this feature. OpenVPN and this app offer persist-tun, a feature to implement this functionality.

_ The problem with all these methods offered by apps is that they can only provide best effort and are no complete solutions. On boot, app crashing and other corner cases the app cannot ensure that this block of non VPN connection works. Thus giving the user a false sense of security._

The only reliable way to ensure non VPN connections are blocked is to use Android 8.0 or later and use the "block connections without VPN" setting that can be found under Settings > Network & Internet > Advanced/VPN > OpenVPN for Android > Enable Always ON VPN, Enable Block Connections without VPN

The problem is that Google does not expose the always on vpn setting on android TV. It might be possible to enable this via using Android MDM/Deviceadmin as that has typically has access to these settings even if they are hidden.

[llima27]

Thank you for the prompt reply, Arne.

My use case is not of absolute security, so while I appreciate the point of the FAQ you sent, it's not a concern for me. My situation is that I use Tasker to switch the VPN server when I load a certain streaming app. However, while OpenVPN is disconnecting the current connection and connecting to the other server, the app connects directly and loads the profile for the wrong location.

I was hoping that with persistent tun this period in between connections would be "offline" but I think you're saying persistent tun only works for reconnections of the same connection, correct?

Tasker itself is able to block all connections, so I tried to disconnect the VPN, block connections, and then connect to the new server. Unfortunately in that small window of opportunity the app connects directly.

Incidentally, I tried using OpenVPN 3 because it connects much faster. It helps this use case, but I've been unable to cast to my device while using OpenVPN 3. I appreciate it's experimental but if you're unaware of this problem then I'd be happy to report in a thread of its own.

Many thanks again.

[schwabe]

Yeah the small window you are seeing is a problem. I could do thing to improve this but only to a certain degree and overall for most people that need that feature, the always on functionality of the OS is the right thing anyway. I know of the problem with OpenVPN3 and it will be fixed eventually.

[llima27]

Well, remember me if you're even around that area of the code and do "the thing" that will help. :-)

Many thanks again for your replies. Very insightful.