5

From my understanding, a VPN kill switch modifies routing to make sure that all traffic must be sent through the VPN's tunnel interface, and otherwise internet access is restricted. On desktop applications it seems quite obvious how this could be implemented since apps offering these sorts of services would have administrator privileges anyway and can modify routing tables.

However, when it gets to mobile platforms, applications don't have these permissions so I'm confused as to how a kill switch like this can even operate. Many providers of VPN services (Surfshark being an example) support a kill switch in their apps on all platforms, including iOS and Android.

On Android, blocking traffic outside of a VPN connection wasn't even possible up until Android 8.0+ (on 7.0+ an always-on option can be set too) yet these apps support Android 5.0+. In addition, this setting has to be manually turned on by the user which doesn't happen in the apps.

On iOS, it seems like a kill switch isn't even possible on any version: https://developer.apple.com/forums/thread/113636. I do know that there is an always-on setting that can be configured since iOS 6 however (like Android), and even though this isn't by any means a kill switch is this what these apps could be enabling?

I'm just curious as to how apps like this can claim to protect data leaks like such with a kill switch if they don't have the necessary permissions to modify routing options? In this case, will they be using OS features such as an "always-on" connection and passing it off as a kill switch because you're in theory meant to always be connected? Or is there actually a way that they might be able to disable internet across the whole of the device if a change of IP is detected?

I hope this is the right place to post a question like this, and if anyone has any details on how this might work it would be greatly appreciated.

2

Android VPN API

Android 4.0 (API Level 14) introduced VPN API so that app developers could provide their own VPN solutions. Android VpnService connects android system wide networking to the VPN gateway. Android 7.0 (API Level 24) introduced Always-on VPN package in VpnService. Always-on VPN can block connections that don’t use the VPN.

How VpnService connects Android networking to the VPN gateway

Always-on VPN allows the person using a device to block any network connections that don't use the VPN. When turning on this option, the Settings app warns people that they don't have an internet connection before the VPN connects. The Settings app prompts the person using the device to continue or cancel.

Blocked connections

A person using the device can force all traffic to use the VPN. The system blocks any network traffic that doesn’t use the VPN. People using the device can find the Block connections without VPN switch in the VPN options panel in Settings.

Apps don't need elevated privileges to access system APIs. Some APIs require user authorisation to grant access. The system UI also makes the person using the device aware of an active VPN connection.


Android Developers > Docs > Guides > VPN

Android Developers > Docs > Reference > VpnService

setAlwaysOnVpnPackage

8
  • Ah! So they do seem to be branding the system API's always-on features as a kill switch. However, this would mean that users on Android 7 (before the "block connections without VPN" became an additional feature) would just have the connection continuously trying to reauthenticate whilst possibly leaking data right? If that's correct, wouldn't it technically be wrong advertising that as a kill switch?
    – Letal1s
    Jul 10 at 12:54
  • Internet connection is terminated when connecting with always-on VPN. Reconnects and reauthentication also disconnect internet.
    – defalt
    Jul 10 at 16:15
  • Understood. In that case what's the difference between "always-on VPN" and the additional "block connections without VPN" that got added in Android 8? I've been looking at the documentation you linked and the only way I can make sense of it is if in Android 8 the blocking of connections then became optional as to being part of the always-on.
    – Letal1s
    Jul 10 at 16:26
  • Always-on reinitialise VPN after reboot and block connection blocks connection that aren't going through VPN.
    – defalt
    Jul 10 at 16:56
  • Maybe there's something I don't understand, but if reconnects and reauths disconnect internet in always-on, surely that's what block connection does as with both no data can be sent when the VPN disconnects? Or does block connection just stop the use of split-tunnelling too? Maybe I'll have to do some more reading on this subject.
    – Letal1s
    Jul 10 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.