IssueTracker

Which hardware is this on?  (Is it missing kernel option for IPv6?)

These logs are generated by original ASUS Google Nexus 7 WiFi [2012]:  it has been just upgraded via OTA with official firmware 4.4 (KRT16S).
I don't know if the kernel option for IPv6 is installed because I've not compiled the kernel but I'm using the official Google version.  
Anyway this issue is common for many users as I can see from the lot of feedbacks I receive from users of my VPN applications.

I've the same issue. Nexus 7, Android 4.4 KitKat.Please fix it soon.

Same problem Nexus 7(2013) android 4.4

Same problem on Nexus 7 with 4.4. I rely on this functionality for connectivity while on  the road. With travel plans just a week away, I'm seriously considering a Windows 8 tablet. There's no way I'll be getting the new Nexus 10 now - not when something as important as this can be broken so easily.

Can you send a full bugreport of the failure to me at rgreenwalt@google.com?

That specific error copypasted in the report is supposed to be innocuous, but there is most likely an underlying problem.
The requested bugreport will help identify the issue.


https://android.googlesource.com/platform/system/netd/+/master/SecondaryTableController.cpp
 around line 474

    //try and set up for ipv6. ipv6 nat came in the kernel only in 3.7, so this can fail
    ret = execIptables(V6,
            "-t",
            "nat",
            add ? "-A" : "-D",
            LOCAL_NAT_POSTROUTING,
            "-o",
            iface,
            "-m",
            "mark",
            "--mark",
            mark_str,
            "-j",
            "MASQUERADE",
            NULL);

I've also got this problem on a Nexus 7 (2012, WLAN only) after the update to Android 4.4 last weekend. This breaks my connectivity while on the road, as I am no longer able to use tethering via Bluetooth to my Samsung smartphone, making the tablet nearly useless away from my home network (open WLAN hotspots are not that common in Germany due to legal difficulties).

I'd really appreciate a fast fix for this problem.

Same here on 4.4 kitkat now nexus useless when out! & lack of adhoc wifi adds insult to injury!

Same problem here too , my nexus 7 2012 is no useless due to that error or thatbproblem with the vpn

I wiah u fix it soon :)

[Comment deleted]

I've just updated my ASUS Google Nexus 7 WiFi [2012] to android 4.4 KitKat via OTA, and i have the same issue.

I have same problem on Nexus10 after I received official update to 4.4

I have a Nexus tablet 10. After installing Android 4.4 Bluevpn stopped working. Tried to use the TunKo did not help. Help please

I have the same problem too. After upgrading to 4.4 my nexus 7 is now less useful than before.

[Comment deleted]

[Comment deleted]

The VpnService class cannot register the "tun0" interface into the routing table;  I've tested the same code for Android 4.4 and 4.3:

Android 4.4

shell@android:/ $ cat /proc/net/route
cat /proc/net/route
Iface   Destination     Gateway         Flags   RefCnt  Use     Metric  Mask        MTU     Window  IRTT
wlan0   00000000        0100A8C0        0003    0       0       0       00000000        0       0       0
wlan0   00000000        0100A8C0        0003    0       0       305     00000000        0       0       0
wlan0   0000A8C0        00000000        0001    0       0       305     00FFFFFF        0       0       0
wlan0   0100A8C0        00000000        0005    0       0       0       FFFFFFFF        0       0       0


Android 4.3

shell@android:/ $ cat /proc/net/route
cat /proc/net/route
Iface   Destination     Gateway         Flags   RefCnt  Use     Metric  Mask        MTU     Window  IRTT
tun0    00000000        00000000        0001    0       0       0       00000080        0       0       0
wlan0   00000000        0100A8C0        0003    0       0       0       00000000        0       0       0
wlan0   00000000        0100A8C0        0003    0       0       308     00000000        0       0       0
tun0    00000080        00000000        0001    0       0       0       00000080        0       0       0
wlan0   0000A8C0        00000000        0001    0       0       308     00FFFFFF        0       0       0
wlan0   0100A8C0        00000000        0005    0       0       0       FFFFFFFF        0       0       0

I have this same issue with my Google nexus 5. This is a huge feature for me and I'm sure many others. Please fix as soon as possible.

[Comment deleted]

The Linux kernel 3.4.0 was introduced since Android version 4.2 (Jelly Bean); now I've in my Nexus 7 (2012) [firmware KRT16S] the old kernel version 3.1.10-gee1a0b2.   Maybe the issue is due to the kernel regression?  

Is it related to?
https://code.google.com/p/android/issues/detail?id=61948

#22
VPN on Android 4.4 seems to depend on, or at least assume it is run on, a kernel with support for IPv6 NAT, available in Linux kernel 3.7 and later.

Another difference for the same code:

VpnService.Builder builder = new VpnService.Builder();
builder.setMtu(1500);
builder.addAddress("10.0.0.1",24);      
builder.addDnsServer("8.8.8.8");
builder.addDnsServer("8.8.4.4");
builder.addRoute("0.0.0.0", 0);
ParcelFileDescriptor parcel = builder.setSession("VPN Tether Connection").establish();  

Android 4.3:
11-30 12:24:49.458: D/VpnJni(146): Address added on tun0: 10.0.0.1/24
11-30 12:24:49.458: D/VpnJni(146): Route added on tun0: 0.0.0.0/0
11-30 12:24:49.458: I/Vpn(146): Established by com.test_vpn on tun0

Android 4.4:
11-29 17:18:02.925: D/VpnJni(493): Address added on tun0: 10.0.0.1/24
11-29 17:18:03.055: I/ip6tables(120): ip6tables v1.4.11.1: can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?)
11-29 17:18:03.055: I/ip6tables(120): Perhaps ip6tables or your kernel needs to be upgraded.
11-29 17:18:03.055: I/ip6tables(120): ip6tables terminated by exit(3)
11-29 17:18:03.055: E/Netd(120): exec() res=0, status=768 for /system/bin/ip6tables -t nat -A st_nat_POSTROUTING -o tun0 -m mark --mark 60 -j MASQUERADE
11-29 17:18:03.155: I/Vpn(493): Established by com.test_vpn on tun0

The message "Route added on tun0: 0.0.0.0/0" is not in the log:  means that builder.addRoute("0.0.0.0", 0);  has no effect.

Method "addRoute" for class VpnService.Build changed:

version 4.3:

         public Builder addRoute(String sAddress, int prefixLength) {
            InetAddress address = InetAddress.parseNumericAddress(sAddress);
            check(address, prefixLength);

            int offset = prefixLength / 8;
            byte[] bytes = address.getAddress();
            if (offset < bytes.length) {
                for (bytes[offset] <<= prefixLength % 8; offset < bytes.length; ++offset) {
                    if (bytes[offset] != 0) {
                        throw new IllegalArgumentException("Bad address");
                    }
                }
            }
            mRoutes.append(String.format(" %s/%d", address.getHostAddress(), prefixLength));
            return this;
        }

version 4.4:
         public Builder addRoute(String sAddress, int prefixLength) {
            InetAddress address = InetAddress.parseNumericAddress(sAddress);
            check(address, prefixLength);

            int offset = prefixLength / 8;
            byte[] bytes = address.getAddress();
            if (offset < bytes.length) {
                for (bytes[offset] <<= prefixLength % 8; offset < bytes.length; ++offset) {
                    if (bytes[offset] != 0) {
                        throw new IllegalArgumentException("Bad address");
                    }
                }
            }
            mRoutes.add(new RouteInfo(new LinkAddress(address, prefixLength), null));
            return this;
        }
 
Where:  

    public RouteInfo(LinkAddress destination, InetAddress gateway) {
        this(destination, gateway, null);
    }

the "gateway" is null and the "iface" is null for the constructor method:

    /**
     * Constructs a RouteInfo object.
     *
     * If destination is null, then gateway must be specified and the
     * constructed route is either the IPv4 default route <code>0.0.0.0</code>
     * if @gateway is an instance of {@link Inet4Address}, or the IPv6 default
     * route <code>::/0</code> if gateway is an instance of
     * {@link Inet6Address}.
     *
     * destination and gateway may not both be null.
     *
     * @param destination the destination prefix
     * @param gateway the IP address to route packets through
     * @param iface the interface name to send packets on
     */
    public RouteInfo(LinkAddress destination, InetAddress gateway, String iface) {
        if (destination == null) {
            if (gateway != null) {
                if (gateway instanceof Inet4Address) {
                    destination = new LinkAddress(Inet4Address.ANY, 0);
                } else {
                    destination = new LinkAddress(Inet6Address.ANY, 0);
                }
            } else {
                // no destination, no gateway. invalid.
                throw new IllegalArgumentException("Invalid arguments passed in: " + gateway + "," +
                                                   destination);
            }
        }
        if (gateway == null) {
            if (destination.getAddress() instanceof Inet4Address) {
                gateway = Inet4Address.ANY;
            } else {
                gateway = Inet6Address.ANY;
            }
        }
        mHasGateway = (!gateway.isAnyLocalAddress());

        mDestination = new LinkAddress(NetworkUtils.getNetworkPart(destination.getAddress(),
                destination.getNetworkPrefixLength()), destination.getNetworkPrefixLength());
        mGateway = gateway;
        mInterface = iface;
        mIsDefault = isDefault();
        mIsHost = isHost();
    }

I have the same issue after my Nexus 10 was automatically upgraded to Kitkat. BlueVPN connection can be established with my Blackberry phone, but doesn’t have data flow.

I have connected nexus 10 and my mobile phone using BlueVPN. Connection establised, but I cant browse using Chrome  :-( ???

For me (Nexus 10), BlueVPN connects but browsing doesn't work.

This has broken my routine and would appreciate a quick fix!

i  my n7 2012 and i got the very same issue i hope they got fixed as soon as possible  

Whats up with guys at google...scrapping one or the other connectivity options in Android with every major release. Last it was with bluetooth and this time around its with VPN. WTH!!

-N7 2012 user (BlueVPN app unable to process data flow)

I have a Nexus 10. I occasionally connected online with my Nokia N8. Now there's no browsing. It seems to be the same problem as everyone else has - the Adroid 4.4 updating - and very irritating. Please fix as soon as possible.

The KitKat version introduces several bugs on VPN module and other functionalities.
You can perform the downgrade of your Nexus device to the previous Jelly Bean 4.3 version, waiting Google will fix all these issues.  Here are the instructions:

http://productforums.google.com/forum/#!msg/nexus/9B1a9GvqbMs/2kJnY8eQCRAJ

BlueVPN connection not work in my Nexus 4 after update Android to 4.4. I am upset

BlueVPN connection not work in my Nexus 7 after update Android to 4.4. I am upset

There is something wrong in one of these steps:

VpnService.java ( row 471 )

   public ParcelFileDescriptor establish() {
            mConfig.addresses = mAddresses;
            mConfig.routes = mRoutes;

            try {
 ->>           return getService().establishVpn(mConfig);  //  ConnectivityService.establishVpn
            } catch (RemoteException e) {
                throw new IllegalStateException(e);
            }
        }

ConnectivityService.java ( row 3637 )  

    public ParcelFileDescriptor establishVpn(VpnConfig config) {
        throwIfLockdownEnabled();
        int user = UserHandle.getUserId(Binder.getCallingUid());
        synchronized(mVpns) {
 ->>          return mVpns.get(user).establish(config);  //  Vpn.establish
        }
    }          
       
Vpn.java  ( rows  393 / 394 )  

   public synchronized ParcelFileDescriptor establish(VpnConfig config) {
                        ........
            mInterface = interfaze;

            // Fill more values.
            config.user = mPackage;
            config.interfaze = mInterface;
            config.startTime = SystemClock.elapsedRealtime();
            mConfig = config;
            // Set up forwarding and DNS rules.
            mVpnUsers = new SparseBooleanArray();
            token = Binder.clearCallingIdentity();
            try {
->>             mCallback.setMarkedForwarding(mInterface);
->>             mCallback.setRoutes(interfaze, config.routes);     //  ConnectivityService.VpnCallback.setRoutes
                mCallback.override(mInterface, config.dnsServers, config.searchDomains);
                addVpnUserLocked(mUserId);
            } finally {
                Binder.restoreCallingIdentity(token);
            }
        } catch (RuntimeException e) {
            updateState(DetailedState.FAILED, "establish");
            IoUtils.closeQuietly(tun);
            // make sure marked forwarding is cleared if it was set
            try {
                mCallback.clearMarkedForwarding(mInterface);
            } catch (Exception ingored) {
                // ignored
            }
            throw e;
        }
        Log.i(TAG, "Established by " + config.user + " on " + mInterface);
                .............
    }  
       
ConnectivityService.java ( rows 3771 / 3779 )  

        public void setRoutes(String interfaze, List<RouteInfo> routes) {
            for (RouteInfo route : routes) {
                try {
 ->>                mNetd.setMarkedForwardingRoute(interfaze, route);  // NetworkManagementService.setMarkedForwardingRoute
                } catch (RemoteException e) {
                }
            }
        }

        public void setMarkedForwarding(String interfaze) {
            try {
 ->>               mNetd.setMarkedForwarding(interfaze);  // NetworkManagementService.setMarkedForwarding
            } catch (RemoteException e) {
            }
        }
               
NetworkManagementService.java  ( rows 1473 / 1520 )  

    public void setMarkedForwarding(String iface) {
        mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);
        try {
->>        mConnector.execute("interface", "fwmark", "rule", "add", iface);  // NativeDaemonConnector.execute
        } catch (NativeDaemonConnectorException e) {
            throw e.rethrowAsParcelableException();
        }
    }
       
    public void setMarkedForwardingRoute(String iface, RouteInfo route) {
        mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);
        try {
            LinkAddress dest = route.getDestination();
 ->>        mConnector.execute("interface", "fwmark", "route", "add", iface,
                  dest.getAddress().getHostAddress(), dest.getNetworkPrefixLength());  // NativeDaemonConnector.execute
        } catch (NativeDaemonConnectorException e) {
            throw e.rethrowAsParcelableException();
        }
    }  
       
NativeDaemonConnector.java ( row 292 )
       
        public NativeDaemonEvent execute(String cmd, Object... args)
            throws NativeDaemonConnectorException {
->>      final NativeDaemonEvent[] events = executeForList(cmd, args);  // --->>  the native class CommandListener manages the command socket
        if (events.length != 1) {
            throw new NativeDaemonConnectorException(
                    "Expected exactly one response, but received " + events.length);
        }
        return events[0];
    }
       
CommandListener.cpp  ( rows 283 / 309 )  
https://android.googlesource.com/platform/system/netd/+/refs/heads/kitkat-release/CommandListener.cpp
       
        int CommandListener::InterfaceCmd::runCommand(SocketClient *cli, int argc, char **argv) {
                ...............
             //     0       1       2        3          4           5        6      7
        // interface route add/remove iface default/secondary dest    prefix gateway
        // interface fwmark  rule  add/remove    iface
        // interface fwmark  route add/remove    iface        dest    prefix
               
        if (!strcmp(argv[1], "fwmark")) {
            if (!strcmp(argv[2], "rule")) {
                .........
                if (!strcmp(argv[3], "add")) {
->>                 if (!sSecondaryTableCtrl->addFwmarkRule(argv[4])) {     // SecondaryTableController.setFwmarkRule(iface, true)
                        cli->sendMsg(ResponseCode::CommandOkay,"Fwmark rule successfully added", false);  
                    } else {
                        cli->sendMsg(ResponseCode::OperationFailed, "Failed to add fwmark rule", true);
                    }
                }
                                ........
                return 0;
            } else if (!strcmp(argv[2], "route")) {
                .........
                if (!strcmp(argv[3], "add")) {
->>                if (!sSecondaryTableCtrl->addFwmarkRoute(argv[4], argv[5], atoi(argv[6]))) {  // SecondaryTableController.addFwmarkRoute
                        cli->sendMsg(ResponseCode::CommandOkay, "Fwmark route successfully added", false);  
                    } else {
                        cli->sendMsg(ResponseCode::OperationFailed, "Failed to add fwmark route", true);
                    }
                }
                                .......                        
                return 0;
            }
                        ......
                }
                .........
        }

SecondaryTableController.cpp  ( rows 475 / 516+534 )    
https://android.googlesource.com/platform/system/netd/+/refs/heads/kitkat-release/SecondaryTableController.cpp

        int SecondaryTableController::setFwmarkRule(const char *iface, bool add) {
        .........
->>   ret = execIptables(V6,            // NetdConstants.execIptables
            "-t",
            "nat",
            add ? "-A" : "-D",
            LOCAL_NAT_POSTROUTING,
            "-o",
            iface,
            "-m",
            "mark",
            "--mark",
            mark_str,
            "-j",
            "MASQUERADE",
            NULL);
          .......
       
        }
       
        int SecondaryTableController::addFwmarkRoute(const char* iface, const char *dest, int prefix) {
->>     return setFwmarkRoute(iface, dest, prefix, true);
        }
       
       
        int SecondaryTableController::setFwmarkRoute(const char* iface, const char *dest, int prefix,
                                                                                                 bool add) {
                int tableIndex = findTableNumber(iface);
                if (tableIndex == -1) {
                        errno = EINVAL;
                        return -1;
                }
                int mark = tableIndex + BASE_TABLE_NUMBER;
                char mark_str[11] = {0};
                char chain_str[IFNAMSIZ + 18];
                char dest_str[44]; // enough to store an IPv6 address + 3 character bitmask

                snprintf(mark_str, sizeof(mark_str), "%d", mark);
                snprintf(chain_str, sizeof(chain_str), LOCAL_MANGLE_IFACE_FORMAT, iface);
                snprintf(dest_str, sizeof(dest_str), "%s/%d", dest, prefix);
->>     return execIptables(getIptablesTarget(dest),    // NetdConstants.execIptables
                                "-t",
                                "mangle",
                                add ? "-A" : "-D",
                                chain_str,
                                "-d",
                                dest_str,
                                "-j",
                                "MARK",
                                "--set-mark",
                                mark_str,
                                NULL);
        }

NetdConstants.cpp      
https://android.googlesource.com/platform/system/netd/+/refs/heads/kitkat-release/NetdConstants.cpp
       

I just updates to 4.4.1 and it appears to be fixed. Woohoo!!!

I am also facing the same issue after upgrade to 4.4 in my nexus 7.blue VPN is not working.notify me when resolved

So is this fixed in the latest update?

On my nexus 7 (2013) rooted with 4.4.1, it doesn't work.

I'm not confident that the upgrade 4.4.1 will fix the VPN issue, probably we need to wait the new minor updates ( 4.4.2 or 4.4.3 )

I received the OTA update to 4.4.2 tonight. Sadly the VPN problems still persist on my Nexus 7 (2012, 32 GB, WLAN only, unrooted). Guess I'll have to wait for 4.4.3+x then.

[Comment deleted]

I also received 4.4.2 to Nexus10 and no improvement :(

I just upgraded to 4.4.2 (nexus 7 2012) and sadly blue VPN app is still not working properly.  This is a very good app hopefully Google or the app developer will be able to correct this problem soon.

4.4.2 update doesn't provide the fix on BlueVPN issue still!

[Comment deleted]

I've updated my Nexus 7 to version 4.4.2 and I can confirm that the issue is still present.

I received the OTA update to 4.4.2(build KOT49H) tonight.
The VPN problem still persist on my Nexus 7(2012, 16 GB, WLAN only, unrooted).

Fix it faster please.

I also received the OTA 4.4.2 and still have the VPN problem on my 2012 Nexus 7 16GB WLAN only.

Please get off the pot and address this, unless it is by design.

Same comment for me of course.
Why the problem is still present after two new versions???
Is Google listening?

I'm terribly unhappy!!! this is terrible!! Quickly correct errors!!

I thought having a Google tablet was an advantage, but with this problème of vpn, it's really a disadvantage!

Same problem here. VPN is the only way for me to use this phone while at work and it's broken in 4.4.2.  Was working fine before KitKat. WTF Google ?

One more unhappy user :(

Last night i upgraded to 4.4.2 , still the vpn issue persists.
Any plan of fixing it ??
Atleast provide us the work around

For me connecting to openVPN server both IPv4 and IPv6 go through the tunnel on Android 4.3 using OpenVPN for Android.

But on KitKat (4.4 and 4.4.2, exact same app+settings) IPv6 does not work anymore, looking with Wireshark shows: no IPv6 in the tunnel...

Is this the same bug mentioned here?

#56 Guido1, your description sounds very similar to bug 36949180 (VPNService can only provide connectivity for routes that are reachable without VPN), unless you have IPv6 access without the VPN.

I have a nexus 7 2013 version upgraded to kit kat 4.4.2 and i have teh same problems with VPN, when google will fix it?

Google is so incapable of solving this issue!

#59, if you believe that, perhaps you would like to offer your solution? It is an Open Source project after all.

It worked with 4.3!...
It's hard to believe it's so hard to know why it doen't work anymore.
And why the priority is qualified as "small"?
The Nexus 7 is a Google tablet, so, OK Android is an open source project, but the Nexus 7 costs something for buyers. And I bought it to use it. Not only at home.
I hope the people at Google don't try to prevent bluetooth tethering in order to sell more 3G models.
Sorry to have such thoughts...

#60, yes Android is an open source project and infact I gave to the Google team all suggestions for addressing the solution for this issue.   They are taking too much time!  We need the official firmware 4.4.x (not a custom ROM) able to work like the previous 4.3

Hurry up Google I want VPN back...

This is the only workaround I've found for this issue (which I'll admit upfront will be of no use to anyone without access to a WiFi network):

I've found that if you are able to connect to a WiFi network (even if that WiFi network doesn't have an outward internet connection) then connect to your phone using BlueVPN, you will be able to use your phone as the internet connection. I use my Nexus 7 (2012) at home, and my Nokia E71 phone is my only internet connection. To connect to the internet, I first connect to a WiFi network I've setup using an old WiFi router I had lying around (the WiFi router does not have an internet connection), then I use BlueVPN to connect to my phone. This essentially tricks my Nexus 7 into thinking that it is connected to the internet through the WiFi connection even though it's routing the data through the VPN (I'm sure there is a better technical explanation for this).

I hope this helps some of you!

#64, I tried your workaround, it works, thanx!

So, if you have an inverter in your car, to powerer a wireless router, connect the tablet to the router, then tether the tablet to your phone via BlueVPN it works?

Also, do you have to maintain the Wifi connection the whole time?

[Comment deleted]

#66 Yes, you need to maintain the wireless connection otherwise Android thinks you've disconnected.

You can either use an inverter or a really long extension cable from your house to power that router;)

#64  if you have the wifi enabled and CONNECTED you will be able to use all applications with BlueVPN overcoming the limitations of Android NetworkInfo class:

https://code.google.com/p/android/issues/detail?id=33666

But if you are connected to a WiFi network you don't need BlueVPN!! So it is not a workaround  

#70, it is a workaround in the sense that you just need to connect to a wifi, even to a fake wifi

I just tried this and it does not seem to work for me.  I turned on my wireless router, connected to it with my Nexus 10, then connected to my LG Dare dumb phone with BlueVPN.  I then tried to access a couple of web sites with chrome, and the google mail app, niether of which worked.  

Correction, it does work.  I just did a factory reset on the old wireless modem, which seemed to correct the problem.  It had been sitting on the shelf for about 3 years and I don't remember why I replaced it, but apparently I had something configured incorrectly.  So now google chrome and gmail worked over VPN as long as the wifi is connected, even though there is no path to the internet over the wifi.  Cool!  Watch for this spoof to be corrected in then next Android update rollout.

I'm going back to 4.3 this totally sucks. I knew I should not have updated to 4.4. I use BT VPN all the time.

I think I'll do the same thing soon.

Merry Christmas everybody! I put Android 4.4.3 on my list for Santa Claus. With the VPN issues solved. I hope to have it... :-)

No new Kitkat for Christmas. I love Snickers bar so much... ;-)

Please fix this! A lot of people had this bug

I can use my Nexus 7 2013 at work using WiFi thanks to Foxfi installed on my new Motorola Moto G. So now, I can wait quietly for the fixing in order to use BlueVPN again.

Same problem, tried 3 VPN Android Apps (different Providers) using OpenVPN protocol; the connection is established, seems like IP is also assigned after handshake, but no in/out packets, i.e. no traffic at all.

Running HTC One Android 4.4 KitKat, kernel 3.4.x Temporarily I am using L2TP/IPSec PSK but then if it disconnects (during call, etc) there is no Kill-Switch, and Android's Always ON option for PPTP/L2TP required Static IP.

Really do not want to revert back to 4.3 ........... please solve this issue by issuing a patch! This is simply ridiculous Google.

Have you tried to use Foxfi with wifi connection?
It works.

#81  This issue is not related to the WiFi tethering but to the VPN connections.  

Sorry. I forgot it.
But as I used BlueVPN just to connect the Nexus 7 to the Internet, I thought some of the people here could be interested.

Recently bought a Nexus 10, "what a mistaka du maka" after update, No Vpn, no delete on quickoffice, no sync for my Outlook notebook. having been a Windows devotee all my computing life, don't like the layout of email or skype. Unless I see a working update soon, it's headed for the skip, it does not do what I bought it for, despite the sales blurb, so it will be no loss. Perhaps I should have bought the windows tablet!

if it ain't broke, don't mess with it. looking forward to use my bluevpn soon, hurry up google please..

Just got back from a road trip.  I had to drag along my spare wireless router to enable my VPN connection.  Kind of a PITA.  I do enjoy that all the apps work, like maps, and email, instead of only being able to use chrome when using blueVPN w/o a WiFi connected.  So Google was rolling out updates every other day before Christmas.  Are they back at work yet?

This is bad! Open Garden is affected too. The VPN in KitKat doesn't get packets if there is no other interface up.

The multiuser VPN feature isn't worth breaking all these users of existing apps!

#87, I would argue this is a different bug that deserves it's own report. It is another manifestation of the underlying design decisions, but it appears the design change had some rather severe unintended consequences.

In the new design, local sockets are being bound to the active interface and then the code is using the iptables MASQUERADE target to remap the source address to the VPN's IP address. If there's no active interface then there will be nothing to which to bind.

Filed #64609

#88 / #89

This is already discussed in #63660  

The new behaviour introduces issues because if the phone is connected to the 3G mobile interface with VPN and it switches to the wifi network, the VPN connection will be lost!!

Is this problem fixed now?

No the problem is not fixed. I am having the same issues using 4.4.2 and EasyTether Tablet 0.9.3. The workaround is the same as mentioned above for BlueVPN by connecting to a wifi network without Internet connectivity. I can manage to generate one on my phone that won't share my Internet connection but then it kills my battery even faster.

BlueVPN very good programm and it didnt work on 4.4.2 (((

Okay Google, fix this problem so my Bluevpn app will work again.

Google really have got it wrong with this latest update, I don't think there are any users which aren't affected negatively in some way!

We are waiting for you.... Please accelerate....

Downgraded to 4.3 in the meantime, still not perfect, some individual apps seem to have followed Google's lead: Of those that I tried, Facebook, Twitter, and WUnderground all seem to now not accept a network connection via bluetooth, annoyingly. Please fix this and suggest to app developers to continue allowing internet connections via BT.

HTC fixed this issue on android 4.4.2 in official sense build on my HTC ONE :)

Google developers seem not care about this problem.
I hope HTC, Samsung, Asus and other tablet manufacturers will take into consideration these VPN issues in their new customized KitKat versions so that users can choose alternative devices to purchase in place of the official  Nexus devices

#98 in 4.3 version you can use alternative apps (like Aqua mail instead of GMail) or access via web pages; while in 4.4.x versions there is no chance to access the internet

#99 -- Samsung have not fixed this issue in Kitkat 4.4 for Samsung Note 3

[Comment deleted]

#101 -- If you are on 4.4.2, please try to shut down your Note 3, take out your battery for a minute, set it back and turn your device on. It works for both my VPN services I'm using, a manually configured L2TP/IPsec VPN setting and an app based VPN (tunnelbear).

Yes, rebooting the phone does allow VPN to work .... once.

If I change connection (wifi -> mobile) it will stop working again.

The VPN connection is strictly related to the network type (since the last updates Android 4.4.* );  if the phones switches from wifi to mobile or the contrary, the connection will be dropped.  

See the issue:  VPN TCP connections do not survive interface roams on KitKat:

https://code.google.com/p/android/issues/detail?id=63660 

This is an important issue, but Google seems not care about it!

Is that by design now?

It reconnects okay, but it no longer adds the routes required for connectivity over the VPN.

Same problem here stock Samsung note 3 KitKat

Well it's sad I'm having the same problem and can't get the fix..
We all need help..
I live in China since need my vpn..
Old get a fix soon

fix it please. !!
Note 3 4.4.2 kitkat

Same problem on Nexus 7 2013
Please, fix it! =(

Hi all,
there are three route items for ppp0 when the VPN of phone works well as following,
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         0.0.0.0         128.0.0.0       U     0      0        0 ppp0
0.0.0.0         10.40.208.38    0.0.0.0         UG    0      0        0 rmnet_usb0
10.40.208.36    0.0.0.0         255.255.255.252 U     0      0        0 rmnet_usb0
10.40.208.38    0.0.0.0         255.255.255.255 UH    0      0        0 rmnet_usb0
128.0.0.0       0.0.0.0         128.0.0.0       U     0      0        0 ppp0
172.16.38.1     0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
210.22.70.3     10.40.208.38    255.255.255.255 UGH   0      0        0 rmnet_usb0
210.22.84.3     10.40.208.38    255.255.255.255 UGH   0      0        0 rmnet_usb0

but there are less two for the phone with problem,
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 wlan0
172.16.38.1     0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 wlan0
192.168.1.0     0.0.0.0         255.255.255.0   U     322    0        0 wlan0
192.168.1.1     0.0.0.0         255.255.255.255 UH    0      0        0 wlan0

Anyone know why there are less two for ppp0?

In #111 you are comparing JB phone with K phone.  If you look at ip rules you can see that packets with a certain mark are sent to a different routing table (often 60 or 61) which contains the default route for the ppp0 interface.  This part is working as intended.

The mark for a specific interface is correct when you have a single network type;  but what happen if the device automatically switches from the wifi network to the 3G/4G or the contrary?  
The VPN packets (tun0 interface) are not more routed to the proper channel.
If this part is working as intended then this behaviour is NOT FLEXIBLE and it is a regression respect to the previous versions.  

When you introduce a main change in the system operator you should keep the compatibility for the high level applications or give a workaround to allow them to work in the new environment.   This is a basic principle!   The development of a complex application requires lot of time, money and resources. With the new VPN module you stop the functionalities of many applications and it is very unfair respect to the work of developers.

The advantage of Android compared to the iOS or Window 8 systems was the high implementation flexibility but, version after version, you are reducing these freedom margins for the developers.  This policy will encourage the developers to reconsider their choices and to move toward other open source system operators.
 

In com.android.server.connectivity.Vpn.java you have replaced inside the method

public synchronized ParcelFileDescriptor establish(VpnConfig config)

the native call

4.3:
      jniSetRoutes(interfaze, config.routes);

with
   
4.4:
      mCallback.setRoutes(interfaze, config.routes);
[ com.android.server.ConnectivityService.VpnCallback mCallback ]


This is method "setRoutes" of ConnectivityService.VpnCallback class

public void setRoutes(String interfaze, List<RouteInfo> routes) {
   for (RouteInfo route : routes) {
      try {
        // android.os.INetworkManagementService  mNetd
        mNetd.setMarkedForwardingRoute(interfaze, route);
      } catch (RemoteException e) {
  }
 }
}

This is WRONG!!   It should call  

    mNetd.addRoute(interfaze, route);

in place of

    mNetd.setMarkedForwardingRoute(interfaze, route);

HOW MANY TIME DO YOU TAKE TO MAKE THIS SIMPLE CHANGE??

#114 .. Mirko you are barking up the wrong tree.

KitKit 4.4 no longer adds routes to the main table. Instead they get added to a seperate table, packets get marked, and a rule is placed to send marked packets to the new table. That is why the function is different, but doesn't explain why it isn't working.

#115:  Why it is not possible to give the developers the freedom of choosing if use the main routing table or separate tables for VPN packets?    How can we keep the compatibility with previous versions (JB, ICS)?

#115
I think using policy routing based on marks may cause problems, unless the Linux kernel has been modified. Because in a vanilla kernel the routing decisions for locally generated traffic are made before it is possible to mark the packets in iptables, AFAIK. As a consequence the routing decisions will be based on the main routing table, which will cause problems in some scenarios, for example when there is no default route in the main table. (Think ipv6 tunneled in ipv4.)

#117
The mangle table has an OUTGOING chain for locally generated traffic. Packets marked here will be matched with "ip rule" the same an vanilla linux (or at least Debian in my experience). The source address however would of already been determined and an extra SNAT/MASQUERADE rule would be required to complete the setup.

Unfortunately the only phone I have with KitKat is a Note 3 and with the KNOX-WARRANTY-VOID flag being triggered by rooting I am unable to check the particulars of how KitKat sets up iptables.

#118

Yes, MASQUERADE is used in the way you describe in the POSTROUTING chain in the IPv4 nat table. But it doesn't work for all scenarios. For example it doesn't allow the VPN app to tunnel IPv6 over an IPv4 network, unless the device already have IPv6 access. (It works on android 4.3 without local IPv6 access.) Without IPv6 access the main routing table won't contain any usable route, it only contains a host route to the device itself. And without a usable route it obviously can't select a source address:

# ping6 www.kame.net                                         
connect: Network is unreachable

After adding a default route, things improve:

# ip -6 r a ::/0 dev tun0
# ping6 www.kame.net                                         
PING www.kame.net(2001:200:dff:fff1:216:3eff:feb1:44d7) 56 data bytes
From 2001::XXXX icmp_seq=1 Destination unreachable: Port unreachable

But there still is a blocking filter in st_filter_OUTPUT:

# ip6tables -L st_filter_OUTPUT
Chain st_filter_OUTPUT (1 references)
target     prot opt source               destination        
REJECT     all      anywhere             anywhere             mark match 0x3d reject-with icmp6-port-unreachable

After flushing the st_filter_OUTPUT chain, I am start seeing packets at the remote side of the VPN tunnel. Unfortunately the packets are truncated:

IP6 truncated-ip6 - 40 bytes missing!2001::XXXX > 2001:200:dff:fff1:216:3eff:feb1:44d7: ICMP6, echo request, seq 2, length 64

Tested with Strongswan version 1.3.3 from Google Play Store. Remote end uses Strongswan version 5.0.4 with Linux kernel 3.8.12.

google, fix it!

Add me to the list of those for whom this still doesn't work after the 4.4.2 upgrade (on my Verizon Moto X).  That's a shame; I'd really been hoping this functionality would come back, as I use it all the time.  That is, I *used* to.  :-(

I hope this gets fixed, and rolled out, soon.

I've had to swap my Note 3 for my wifes iPhone in order to get mobile access to the work VPN. This is stupid. 3 months later and Google continue to ignore such an important issue. My patience has been depleted, I no longer trust Google as a brand simply because of this issue.

Any fix for this issue yet?
Still not working even with the latest firmware update on Note 3.

hi all,
My bug is fixed.

Only vendor code is changed for fixing this issue. Google change the policy of the AP code, so vender code need change correspondingly.

#124

How do we change the vender code ?

I too have this issue in my nexus 4, I can't connect by vpn :(

is google even listening to this? It has been a long time for such a critical feature.

Come on Google, do something!

Google! No ad hoc wifi, no BT tethering...
Company that dosnt listem to customers is going down!
My Nexus 7 2013 is not mobile at all!
IF you are not going to solve those problems,my next tablet will have iOS onboard!

it's fucking shit! reduced my galaxy note 3 investment to a pile of wank. now i have to figure out how to downgrade. living in china my door to the outside world is now shut. thanks a bunnch google.

back to the old version. i thought 4.4 was very cool - much faster. now i know why. basically its because it does fuck all. the network functionality and connectivity is non-existent - that's a battery saver for sure. might try a future upgrade but for now my hardware functionality is worth far more than your shitty update.

At first I had no idee that the last system_update issues my VPN connection. Normally I acces my VPN through 3G or WIFI. At the moment I found out that KitKAt upgrade causes out of control MTU. So my packetloss are allmost 100%
Now I can`t acces through 3G or WIFI my VPN connection.
SO GOOGLE -> FIX this!

This thread reminds me, one of the Michael Jackson's song "they don't care about us"

I've removed my application BlueVPN from the Google Play Store to avoid negative comments from users.

THANK YOU SO MUCH GOOGLE!!

mirko,

where can we track any of your updates from now on ?

mirko, why not just restrict the app to 4.3 or below?

#136  I had explicitely indicated the limitations of the BlueVPN app with Android 4.4 on the Google Play store and I had asked users to avoid negative comments about this fact.   Despite this alert, the evaluation of the app was continuosly decreasing due to unfair and spam comments.  If Google will solve the issue with Android 4.4 I'll be happy to republish BlueVPN on the market, including the updates.

Another bump to motivate Google to fix this issue.

Google... "is there anybody even in there?...

A number of bugs introduced in K are fixed and should be available in the next release.

Mirko is obviously not doing anything wrong and I'm sorry for the unfair comments he's received.  Unfortunately this issue was reported too late to get fixed in 4.4.2 (release Dec 9th) and the next release hasn't come yet.  We're trying to fix the whole in our VPN testing so this doesn't happen again.

Thank you Robert for the update:   we are looking forward for the new Kit Kat version and we hope it will fix the VPN issue so that the app BlueVPN can be available again for the many users who need it for internet connection through the bluetooth tethering

and another month goes by

Some delays in the new Kitkat 4.4.3? I have been waiting for several months now. Where is it?

[Comment deleted]

This issue is painful for those of us that frequently use VPN on Android.  Please fix!  Galaxy Note 3 on Tmobile no longer works with VPN.

Google please FIX IT !

Note Pro SM-P905 KitKat 4.4.2 none VPN apps wokrs - please FIX IT.

Is it possible to test the 4.4.3 version before it is released officially?   I'm afraid that if the VPN issue hasn't been fixed we need to wait long time for the next release.

I'm also having this issue with VpnService. I have an app that uses it and works fine in devices < 4.4. Another thing I noticed was that the VpnService works fine in WIFI and my app sees traffic, but on cellular, my app sees nothing. Routing table doesn't show the tun in >=4.4 devices, but it does in < 4.4.

I'm facing the same issue with my Note 3 N9005. I hope that Google can fix it

Would love to have this fixed so I can run a Kit Kat Rom

I'm having the same issue on my AT&T note 3 on kit kat 4.2.2. When is the next release coming out?

Oops I meant 4.4.2

Does 4.4.3 address the issue? Anybody with 4.4.3 installed around?

4.4.3 is here now!

For Nexus 7:

For those who not want to wait for OTA.  

http://android.clients.google.com/pa...H.df43279b.zip

How to install it:

http://www.androidpolice.com/2012/11...ink-available/

[Comment deleted]

dont work on 4.4.3

The problem persists, it wasn't fixed on 4.4.3...Long time for nothing, we need the fix, when I'm connect to vpn, My nexus 4 lose Data connection.

4.4.3 on my Nexus 10, and I've confirmed this is still broken. Who is running the QA department at Google? I'd like to hear directly from they why they think it is a good idea to have a security feature that worked perfectly in 4.3 be 100% broken in 4.4.0, 4.4.1, 4.4.2, and 4.4.3. I'm extremely unimpressed, and IMHO, this is inexcusable. 4.4.0 == Fail. 4.4.1 == Fail. 4.4.2 == Fail. 4.4.3 == Fail. KitKat == Fail. Can we realistically expect this to be fixed in the future? Give us something tangible: release versions and release dates.

I want a fix soon because it's important for some people use VPN networks, You promised that in 4.4.3 it will fix and now 4.4.3 is release and it's is still broken... What happen google?

[Comment deleted]

 

Mirko, the creator of the app BlueVNP: What do you say, do you have to update the app before it can run 4.4.3?

4.4.3 hasn't fixed OpenVPN + Wifi tethering for me, either. I made sure to reset my iptables to defaults.

Using Astrill VPN app, Omnirom 4.4, and a Nexus 5

The VPN behaviour with Android 4.4.3 seems the same of previous Kit Kat versions.  
I'll take a look to the new Android source code to understand if Google developers have performed any change on the VPN module or simply they changed the version number!