3 ms·

An alternative solution is to connect through Wireguard. On Android(not sure about iOS) you can force certain applications to use the VPN connection. WG uses UD

An alternative solution is to connect through Wireguard. On Android(not sure about iOS) you can force certain applications to use the VPN connection. WG uses UDP to establish connection so the exposure is minimal.

emilburzo 4y ago
I haven't tried Wireguard so far, but from past experiences VPNs usually make mobile devices use more battery, I assume because they keep the radio on more than required (keepalive? just having to process VPN broadcast traffic?) and can't sleep so much. Plus, personally I'm trying to reduce the amount of "trusted just because it's on the LAN" stuff and go more for a "zero-trust" approach as much as possible.
- VTimofeenko 4y ago
  WG can live without keepalives(though it can use them), there is no real "session" concept. A peer will just connect back when the traffic starts flowing. I keep an eye out on my battery usage and never noticed it being in the list. On the zero-trust front - it's not really meant to completely replace authentication but it does help with minimizing attack surface. It does help with encrypting traffic, especially for stuff that does not talk https.
  - emilburzo 4y ago
    Nice, I need to try out Wireguard then, it sounds like things really improved in the VPN world.
    - VTimofeenko 4y ago
      Yeah, having worked with an OpenVPN setup in the past - wireguard is definitely a breath of fresh air. It can be a little bit tough to setup depending on the rest of the network stack(openrc/network manager/systemd/systemd-network, etc), but it's very flexible. Wg-quick (typically comes as part of wireguard-tools on distros) is extremely handy for the initial testing.
solarkraft 4y ago
A big problem with VPNs on mobile devices is that you can only have one running at a time. A completely arbitrary limitation as far as I know, but I haven't found any way around it on Android. Worse yet, some network filtering solutions also use the VPN feature.
- VTimofeenko 4y ago
  Hm, yes, I never noticed that. One (maybe a bit involved) way around it is to route the packets on "server" if rolling your own VPN and setup the filtering there. It does defeat the purpose of the local apps though.

emilburzo 4y ago

I haven't tried Wireguard so far, but from past experiences VPNs usually make mobile devices use more battery, I assume because they keep the radio on more than required (keepalive? just having to process VPN broadcast traffic?) and can't sleep so much. Plus, personally I'm trying to reduce the amount of "trusted just because it's on the LAN" stuff and go more for a "zero-trust" approach as much as possible.

VTimofeenko 4y ago
WG can live without keepalives(though it can use them), there is no real "session" concept. A peer will just connect back when the traffic starts flowing. I keep an eye out on my battery usage and never noticed it being in the list. On the zero-trust front - it's not really meant to completely replace authentication but it does help with minimizing attack surface. It does help with encrypting traffic, especially for stuff that does not talk https.
- emilburzo 4y ago
  Nice, I need to try out Wireguard then, it sounds like things really improved in the VPN world.
  - VTimofeenko 4y ago
    Yeah, having worked with an OpenVPN setup in the past - wireguard is definitely a breath of fresh air. It can be a little bit tough to setup depending on the rest of the network stack(openrc/network manager/systemd/systemd-network, etc), but it's very flexible. Wg-quick (typically comes as part of wireguard-tools on distros) is extremely handy for the initial testing.

solarkraft 4y ago

A big problem with VPNs on mobile devices is that you can only have one running at a time. A completely arbitrary limitation as far as I know, but I haven't found any way around it on Android. Worse yet, some network filtering solutions also use the VPN feature.

VTimofeenko 4y ago
Hm, yes, I never noticed that. One (maybe a bit involved) way around it is to route the packets on "server" if rolling your own VPN and setup the filtering there. It does defeat the purpose of the local apps though.