Eddie Android blocking local network despite configuration

[Jamertol 0]

I have set up Eddie for Android. I have 2.4 (VC26) which I believe is the lastest version. Android version is 10, lastest LineageOS.

In my Laptop when Eddie is connected it routes all the traffic to the VPN except local traffic, since I have the option checked. I can do 192.168.1.15 and it will not go through the VPN, but will go to my local device.

This is not the case with Eddie for Android in my phone. In Eddie for Android I have gone to Settings -> System -> Exclude local networks from the VPN (Checked) . But despite this, the local network is not reacheable unless I disconnect from the VPN.

I have tried all the combinations with the Android config settings. I have set up Block connections without VPN on and off, Always-on VPN on and off. The only time I can access my local devices is when the VPN is off AND Block connections without VPN is off.

Is this a bug or am I doing something wrong? The setting 'Exclude local networks from the VPN' is on, so I do not understand why it does not work.

[OpenSourcerer 1435]

Cannot confirm on LOS 17.1.
Maybe Eddie logs will help.

[Jamertol 0]

22 hours ago, OpenSourcerer said:

Cannot confirm on LOS 17.1.
Maybe Eddie logs will help.

I have check the logs and nothing in there. Is there any configuration setting I need to set up to have a more verbose log?

We are using the same OS. Can you tell me what you have in 'Block connections without VPN' and 'Always-on VPN' or any other configuration you think it matters?

[OpenSourcerer 1435]

2 hours ago, Jamertol said:

I have check the logs and nothing in there.

Let us be the judge of that. It was an indirect request for those logs.
 

2 hours ago, Jamertol said:

Can you tell me what you have in 'Block connections without VPN' and 'Always-on VPN' or any other configuration you think it matters?

If you mean the Android settings, both are off. Log output of my Eddie client is in the file. This is what we asked of you.

New.txt

[Jamertol 0]

This is the logs with the two Android settings also off

 

eddielog.txt

After the last connection you see in the logs, I tried to connect to a couple of local services and they did not go through.

[Jamertol 0]

I am still having this issue. I am not sure if not having the PlayStore or Goolag services in my phone has anything to do with it not working, but my guess is it should not.

Any idea what I can do to debug it?

[OpenSourcerer 1435]

Oh, sorry, I was writing something here but never sent it. I think some visitors came by at the time.
Hm. Your network at 10.10.10.0/24 seems to be correctly excluded. From the logs alone this looks like it should work as intended.
 

1 hour ago, Jamertol said:

I am not sure if not having the PlayStore or Goolag services in my phone has anything to do with it not working, but my guess is it should not.

It doesn't. Eddie does not use Google APIs; would be a scandal if it did

[Jamertol 0]

Well, I can tell you it is not. Several apps can connect fine when the VPN is off (and Block connetions without VPN is off too), fail to connect when the VPN is on and connect fine again the moment I turn the VPN off.

What else can I do to debug this issue?

[OpenSourcerer 1435]

Try a support ticket, maybe professional support can help you further. Be sure to report back here regardless of the result.

[subzone 0]

Hi,
Just want to add me too to this post.
My local network is blocked, despite the setting. If fact no configuration settings in Eddie seem to be taking effect as I cannot even change UDP to TCP.

I am using latest android and ASUS ROG 3 phone.

[OpenSourcerer 1435]

Cannot confirm on both LOS 17.1 and 18.1, so no idea why it's not working for you.

[King0777 0]

Same problem on android with latest eddie.
I had to add my local network addresses as custom route directives :
route-ipv6 my_ipv6_prefix::/64 net_gateway
route 192.168.0.0 255.255.255.0 net_gateway

[OpenSourcerer 1435]

1 hour ago, dragoworld235 said:

route-ipv6 my_ipv6_prefix::/64 net_gateway

You can remove this, it does not what you think it does:

Quote

--route-ipv6 args
              Setup IPv6 routing in the system to send the specified IPv6 network into OpenVPN's tun.

Meaning, whatever you enter there will explicitly be routed via VPN, as opposed to --route telling OpenVPN which v4 networks should be routed through which v4 hop (e.g., local network over the physical interface hop).
The route-ipv6 arguments you entered might even cut you off of v6 connectivity completely. With two arguments you gave that directive two networks to route via VPN, one of which might be the v6 gateway address. But maybe it doesn't work, and OpenVPN throws a warning. Look into the log.

So the only thing making it work for you is really --route alone.

[King0777 0]

43 minutes ago, OpenSourcerer said:

You can remove this, it does not what you think it does:
Meaning, whatever you enter there will explicitly be routed via VPN, as opposed to --route telling OpenVPN which v4 networks should be routed through which v4 hop (e.g., local network over the physical interface hop).
The route-ipv6 arguments you entered might even cut you off of v6 connectivity completely. With two arguments you gave that directive two networks to route via VPN, one of which might be the v6 gateway address. But maybe it doesn't work, and OpenVPN throws a warning. Look into the log.

So the only thing making it work for you is really --route alone.

That's strange because it is added as an exclude route as you can see with the log. And adding it allows connecting to my SMB share via ipv6 when at home, but SMB is not working when the route-ipv6 is missing. I notice the exclusion of the 192.168.0.0 is set twice, once by using the switch, and once by my route exclusion directive, so I can remove mine.

[OpenSourcerer 1435]

Ah, yes, I missed the note that we're on an Android topic here. Just one more reason to hate hijacking and "same problem" posts, they simply add nothing but confusion. 😡

Some background: Because we're on Android, the tunnel config is done by the VPNService API, not by OpenVPN. Eddie must translate all directives regarding VPN connection buildup to their proper VPNService.Builder calls, in this case the addRoute() method. The thing with that: It only accepts routes to include, not to exclude. So what Eddie needs to do is to calculate all subnets to include around the subnets you don't want to be included, in your case for v4 it'd be 0.0.0.0/1, 128.0.0.0/2, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, and smaller and smaller, and v6 is done similarly. You should be able to see this in the logs as well.

On PC, though, the behavior is as quoted. Don't be surprised there.