ignoramous
commented
2 weeks ago Thanks.
LAN-only: already there (isolate rule)
I think you misunderstand what Isolate does? It basically block ALL connections except to domains/IPs explicitly trusted (allowed) for the Isolated app.
Tasker: Seeing that folks who use Tasker are usually programmers, we are waiting for one among them to send a PR. We may yet implement this ourselves, but it isn't priority given other 300 other open issues & feature requests.
SSID: Easier but requires location permission, which we are reluctant to add.
Per-app block backgrounded apps: #720
KDE Connect: We don't use it, so it is unlikely we ever fix it ourselves. From what you describe (port knocking with UDP, connect with TCP), this is not likely a straight-forward fix given the way we setup WireGuard.
Per-app LAN routes: These can't be excluded per-app (only per-Tunnel). This is an Android limitation.
calebj
Lanius-collaris
I am trying to move away from privacy measures that require root, and this app is very close to meeting my needs. Here is my own use case; it's similar to Dyras's here. I'm just looking for dialogue and suggestions at this point.
My network at home has routes to other sites and several internal subnets, along with DNS and IP based privacy filters. When away, I use WG tunnels on my laptop and phone for all traffic so it behaves just as if I was still home. My phone only has exceptions for LAN scanning and speed test apps, and the wifi calling service. When it's connected to my home WLAN, Tasker deactivates the WG tunnel.
I also use two root apps on the phone for network privacy: AFWall+ to limit which apps can reach the internet and/or the WLAN, and AdAway in hosts file mode for DNS blocking.
There are also some apps which need to be proxied over a different WG tunnel. At home it works fine, but I have to deactivate the home tunnel to use the other one while away.
A root-free VPN app that can do all of this in always-on+killswitch mode would be phenomenal. I know Rethink can do most of the things I mentioned already (and do them better), and I am hoping the rest is coming soon.
Here are my findings; let me know if I missed anything:
Here is my troubleshooting for KDE Connect, er, connectivity:
Like in #1016, #1507 and #1618, I couldn't get KDE Connect to reach LAN IPs except when "do not route private IPs" was enabled, or the local IP range was added as a bypass universal firewall rule. In the logs, the outgoing identity packet (UDP) shows as approved, but from an unknown app. It works via WG Tunnel in lockdown mode, so it is definitely possible using a tunnel.
As it turns out, the identity packet is sent by the phone and received by the laptop fine. The code responsible for this is here, by the way. The problem occurs when the laptop tries to connect back via TCP. When the phone is using a WG proxy, the connection is rejected outright (RST reply), and with no proxy, the laptop sends SYN, hears no reply, and sends retransmissions until it gives up. Making incoming connections work should clear up the issues with KDE Connect, I think. It should help Syncthing as well.
For what it's worth, I've confirmed that KDE Connect works on two different Wireguard apps on two different phones, all of them in always-on+lockdown mode. The handshake proceeds normally each time: the phone sends a UDP identity packet to the laptop, and the laptop connects to the advertised TCP port.
Finally, I have two QoL suggestions that would streamline my and many others' use cases if and when the missing features are implemented:
First, having a place to define IP aliases/lists and allow/deny those in firewall rules would make managing them much easier than copying the addresses into each app's rules list. As an example, the WG app's option of "exclude private IPs" creates a list of 30 allowed IP ranges to carve out the IANA special use blocks. I have different subnets and remote sites that only some apps need access to. I can manually fill in the rules, but IP/subnet lists would be much easier to work with.
Secondly, if the app itself is going to check the SSID, a user-friendly "allow [app] to access local network?" prompt similar to the new app block prompt would be very nice. This would essentially be a bypass rule, but per-app and/or SSID(s), and with the option for a special alias that always refers to the currently connected LAN's subnet. Most apps don't need LAN access and the ones which do are fairly obvious, so it makes sense to alert on any unexpected activity. And as long as the rules could be edited (as they are now), routed subnets like I and other power users have can easily be added.