17

Say you only want to route the traffic of a single application through a VPN.

(Because the application lacks proper encryption support or the remote service is only available on a cooperate network.)

Other stuff like web-browsing should go through the normal data connection.

How to configure this on a recent Android device (>= Android 4.0)?

Concrete motivation: Unfortunately, quite a few VoIP gateway providers do not provide encryption of data (voice and signaling) - thus using a VPN is necessary (at least when connected via WLAN). One provider (sipgate.de) even provides its own VPN (and no other SIP/RTP encryption methods).

Improve this question
2
  • More information about which apps you are specifically trying to tunnel may help. Do they support SOCK5 Proxy? SSH Tunnel may be a good start.
    – earthmeLon
    Aug 9 '12 at 18:49
  • 1
    @earthmeLon, VoIP apps, VoIP apps which support SIP - cf. the last paragraph of the question - e.g. CSimple.
    – maxschlepzig
    Aug 13 '12 at 21:09
8

The free and open-source OpenVPN for Android app supports this.

In the profile configuration dialog, there is an 'allowed apps' tab that allows you to select a list of apps that is either excluded or excluded from using the established VPN:

  • 'VPN is used for all apps but exclude selected'
  • 'VPN is used for only for selected apps' (sic)

The list then contains all available apps that can be selected/deselected.

This doesn't require a rooted device. For example, it works fine on a Nexus 5x device with stock Android 8.1.

A simple test is to install another broswer like Firefox, include just one of Chrome and Firefox in the list and then switch around browsers and visit https://wtfismyip.com in both.

One pitfall is when you are on a dual-stack IPv4+IPv6 network but the VPN is IPv4 only. In that case, the 'Bypass VPN for local networks' in the 'Routing' tab needs to be disabled. Otherwise, IPv6 traffic travels unencrypted besides the VPN.

Improve this answer
0

Every app on android runs on a different user, so iptables should be able to recognize the given app using -m owner --uid-owner, BUT. Like many things in Android, there may be no user frontend to do this easily. (like there is no option to this day to use ext4 as a format for external sd card). If you have some knowledge about routing tables and iptables, You may try going this way.

Another way is to setup VPN to route through it only the ip address of your sip provider (not default route). There is though another unrelated problem - SIP doesn't like NAT, so You may need to setup some traffic forwarding on you VPN server.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.