GoKawiilAndroid NAT-T keepalive API lets apps bypass VPN lockdown mode
Security researchers found that Android's public NAT-T socket-keepalive API allows ordinary apps to send UDP packets directly to a router, bypassing Always-on VPN and 'Block connections without VPN' protections. Tests on a Pixel 8 Pro, Samsung SM-F966B, and Nothing A059, all running Android 16, confirmed that keepalive packets reached the physical gateway outside the VPN tunnel, with one device sustaining a leak for over 24 hours. The root cause traces to changes in Android's startNattKeepaliveWithFd function, where validation checks tying the socket to the caller's VPN policy were added and later removed.
GoKawiil's interpretation of the reporting above, not reported fact.
This flaw undermines a core privacy guarantee that Android users rely on when they enable strict VPN enforcement, since even correctly configured lockdown settings can leak identifiable traffic to the local network. Because the issue stems from a systemic gap in Android's trust model rather than a single app's bug, it likely affects many devices across manufacturers until Google patches the underlying API validation.
- Android's NAT-T keepalive API can send UDP/4500 packets outside the VPN tunnel even with Always-on VPN and lockdown enabled.
- The leak was confirmed on three different OEM devices (Pixel, Samsung, Nothing) running Android 16.
- The root cause is a lapsed validation check in Android's keepalive offload code that fails to verify the app's current VPN policy before allowing direct router access.
GL.iNet Beryl AX (GL-MT3000) Travel Router — If you can't fully trust a phone's VPN lockdown to keep stray packets off your network, moving the tunnel to the router is a solid fix. The GL.iNet Beryl AX is a pocket-sized Wi-Fi 6 travel router with built-in WireGuard and OpenVPN client support, so every device behind it rides the same tunnel. It also makes a handy test bench for watching exactly what your phone sends upstream.
See GL.iNet Beryl AX (GL-MT3000) Travel Router on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: supuk.ch — Armin Šupuk, 2026-09-11
Published there as: “Android NAT-T keepalive offload bypasses VPN lockdown”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.