Unable to use VPN on carrier network

yvaillancourt · January 4, 2025, 4:04pm

Since updating to 2.6.3 on my Pixel 3XL phone, vpn connections (wireguard/protonvpn/unifi) are no longer functional when I am connected to my cellular provider’s network.

01-04 10:55:13.839  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:13.839  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:13.839  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:13.839  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:13.839  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:14.081  1806  1868 E AppOps  : Bad call made by uid 1000. Package "android" does not belong to uid 10241.
01-04 10:55:14.081  1806  1868 E AppOps  : Cannot noteOperation
01-04 10:55:14.081  1806  1868 E AppOps  : java.lang.SecurityException: Specified package "android" under uid 10241 but it is not
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.appop.AppOpsService.verifyAndGetBypass(AppOpsService.java:4538)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.appop.AppOpsService.verifyAndGetBypass(AppOpsService.java:4398)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.appop.AppOpsService.noteOperationUnchecked(AppOpsService.java:3024)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.appop.AppOpsService.noteOperationImpl(AppOpsService.java:3011)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.appop.AppOpsService.-$$Nest$mnoteOperationImpl(AppOpsService.java:0)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.appop.AppOpsService$CheckOpsDelegateDispatcher.$r8$lambda$9t8iLhni7XlJaYUbHyUsLY8CxCM(AppOpsService.java:0)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.appop.AppOpsService$CheckOpsDelegateDispatcher$$ExternalSyntheticLambda0.apply(R8$$SyntheticClass:0)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.policy.AppOpsPolicy.noteOperation(AppOpsPolicy.java:251)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.appop.AppOpsService$CheckOpsDelegateDispatcher.noteOperation(AppOpsService.java:7241)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.appop.AppOpsService.noteOperation(AppOpsService.java:2969)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at android.app.AppOpsManager.noteOpNoThrow(AppOpsManager.java:8988)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at android.app.AppOpsManager.noteOpNoThrow(AppOpsManager.java:8968)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.wm.ActivityTaskManagerService.hasSystemAlertWindowPermission(ActivityTaskManagerService.java:1106)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.wm.ActivityTaskManagerService$LocalService.hasSystemAlertWindowPermission(ActivityTaskManagerService.java:7242)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.am.ActiveServices.shouldAllowFgsStartForegroundNoBindingCheckLocked(ActiveServices.java:8532)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.am.ActiveServices.shouldAllowFgsStartForegroundWithBindingCheckLocked(ActiveServices.java:8417)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.am.ActiveServices.setFgsRestrictionLocked(ActiveServices.java:8060)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.am.ActiveServices.setFgsRestrictionLocked(ActiveServices.java:8015)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.am.ActiveServices.bindServiceLocked(ActiveServices.java:4121)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:13934)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:13894)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at android.app.ContextImpl.bindServiceCommon(ContextImpl.java:2128)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at android.app.ContextImpl.bindServiceAsUser(ContextImpl.java:2041)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.connectivity.Vpn.establish(Vpn.java:1759)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at com.android.server.VpnManagerService.establishVpn(VpnManagerService.java:273)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at android.net.IVpnManager$Stub.onTransact(IVpnManager.java:314)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at android.os.Binder.execTransactInternal(Binder.java:1500)
01-04 10:55:14.081  1806  1868 E AppOps  : 	at android.os.Binder.execTransact(Binder.java:1444)
01-04 10:55:14.126 13442 14178 E WireGuard/GoBackend/ProtonTunnel: UAPIOpen: mkdir /data/data/com.wireguard.android: permission denied
01-04 10:55:14.156 13442 14739 E WireGuard/GoBackend/ProtonTunnel: TCP/TLS error recv getConn: dial tcp 149.22.82.1:443: connect: network is unreachable
01-04 10:55:14.156 13442 14739 E WireGuard/GoBackend/ProtonTunnel: peer(7nj3…lEgE) - Failed to send handshake initiation: use of closed network connection
01-04 10:55:14.227  1806  1889 E GnssUtilsJni: IAGnssRil_V1_0 updateNetworkAvailability() failed.
01-04 10:55:18.997  2420  2452 E QuickAccessWalletKeyguardQuickAffordanceConfig: Wallet card retrieval error, message: "null"
01-04 10:55:18.997  2420  2452 E QuickAccessWalletKeyguardQuickAffordanceConfig: Wallet card retrieval error, message: "null"
01-04 10:55:19.001  2420  2452 E QuickAccessWalletKeyguardQuickAffordanceConfig: Wallet card retrieval error, message: "null"
01-04 10:55:19.281 13442 14741 E WireGuard/GoBackend/ProtonTunnel: TCP/TLS error send conn: use of closed network connection
01-04 10:55:19.281 13442 14741 E WireGuard/GoBackend/ProtonTunnel: peer(7nj3…lEgE) - Failed to send handshake initiation: use of closed network connection
01-04 10:55:19.283 13442 14741 E WireGuard/GoBackend/ProtonTunnel: peer(7nj3…lEgE) - Failed to send handshake initiation: use of closed network connection
01-04 10:55:21.046  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:21.046  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:21.046  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:21.046  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:21.046  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:24.327 12972 12972 E wncloud.android: Not starting debugger since process cannot load the jdwp agent.
01-04 10:55:18.424     0     0 E         : c4  14742 [RMNET:HI] rmnet_config_notify_cb(): Kernel is trying to unregister tun0
01-04 10:55:18.470     0     0 E         : c4  14742 [RMNET:HI] rmnet_config_notify_cb(): Kernel is trying to unregister tun0
01-04 10:55:24.437  1806  1889 E GnssUtilsJni: IAGnssRil_V1_0 updateNetworkAvailability() failed.
01-04 10:55:24.874 13004 13004 E externalstorage: Not starting debugger since process cannot load the jdwp agent.
01-04 10:55:26.937 13024 13024 E .e.blissweather: Not starting debugger since process cannot load the jdwp agent.
01-04 10:55:27.033  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:27.033  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:27.033  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:27.034  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:27.034  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:27.276  1806  2198 E WifiScanRequestProxy: Failed to retrieve wifiscanner
01-04 10:55:27.276  1806 10869 E WifiService: Failed to start scan
01-04 10:55:29.980  1806  2119 E LightsService: Light requested not available on this device. 2
01-04 10:55:30.715  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:30.715  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:30.715  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:30.715  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:30.715  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:34.992 13142 13142 E .accountmanager: Not starting debugger since process cannot load the jdwp agent.
01-04 10:55:35.175 13162 13162 E extcloud.client: Not starting debugger since process cannot load the jdwp agent.
01-04 10:55:35.544 13195 13195 E itfire.davdroid: Not starting debugger since process cannot load the jdwp agent.
01-04 10:55:35.626 13162 13162 E DisplayUtils: Failed to use reflection to enable proper vector scaling
01-04 10:55:37.037  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:37.038  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:37.038  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:37.038  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:37.038  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:40.721  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:40.721  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:40.721  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:40.721  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:40.721  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:53.306  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:53.306  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:53.306  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:53.306  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:53.306  1806  2094 E JobScheduler.Background: Couldn't determine stopped state for unknown package: com.google.android.as
01-04 10:55:57.888  1806  1806 E LightsService: Light requested not available on this device. 2
01-04 10:55:58.169 13442 14178 E WireGuard/GoBackend/ProtonTunnel: UAPIOpen: mkdir /data/data/com.wireguard.android: permission denied
01-04 10:55:58.175 13442 14741 E WireGuard/GoBackend/ProtonTunnel: TCP/TLS error recv getConn: dial tcp 149.88.97.110:443: connect: network is unreachable
01-04 10:55:58.176 13442 14189 E WireGuard/GoBackend/ProtonTunnel: peer(9mTD…GCFw) - Failed to send handshake initiation: use of closed network connection
01-04 10:55:58.353  1806  1889 E GnssUtilsJni: IAGnssRil_V1_0 updateNetworkAvailability() failed.
01-04 10:56:03.218  1806  2119 E LightsService: Light requested not available on this device. 2
01-04 10:56:03.449 13442 14738 E WireGuard/GoBackend/ProtonTunnel: TCP/TLS error send conn: use of closed network connection
01-04 10:56:03.449 13442 14738 E WireGuard/GoBackend/ProtonTunnel: peer(9mTD…GCFw) - Failed to send handshake initiation: use of closed network connection
01-04 10:56:03.450 13442 14189 E WireGuard/GoBackend/ProtonTunnel: peer(9mTD…GCFw) - Failed to send handshake initiation: use of closed network connection
01-04 10:56:08.776 13442 14741 E WireGuard/GoBackend/ProtonTunnel: TCP/TLS error send conn: use of closed network connection
01-04 10:56:08.776 13442 14741 E WireGuard/GoBackend/ProtonTunnel: peer(9mTD…GCFw) - Failed to send handshake initiation: use of closed network connection
01-04 10:56:09.555  1806  1806 E LightsService: Light requested not available on this device. 2
01-04 10:56:03.748     0     0 E         : c5  14741 [RMNET:HI] rmnet_config_notify_cb(): Kernel is trying to unregister tun0
01-04 10:56:03.793     0     0 E         : c5  14741 [RMNET:HI] rmnet_config_notify_cb(): Kernel is trying to unregister tun0
01-04 10:56:09.775  1806  1889 E GnssUtilsJni: IAGnssRil_V1_0 updateNetworkAvailability() failed.

Regain your privacy! Adopt /e/OS the deGoogled mobile OS and online services phone

tcecyk · January 4, 2025, 9:51pm

E WireGuard/GoBackend/ProtonTunnel: TCP/TLS error recv getConn: dial tcp 149.22.82.1:443: connect: network is unreachable

either your carrier blocks that ip (149.22.82.1) or you just can’t do ipv4?

Can you access https://1.1.1.1 (the redirect to https://one.one.one.one should fail and timeout) ?

If that hypothesis turns out to be true - Proton got better ipv6 support this winter for servers and their Linux clients, seems Androd is still lacking though. I don’t know the client if you can configure an ipv6 server endpoint by hand.

yvaillancourt · January 5, 2025, 1:21am

Thanks for you reply.

No, my carrier doesn’t block those IPs. I was always connected to proton vpn before, it’s the same problem if I make the same test with my unifi vpn (home) and with vpn at work.

I try to access https://1.1.1.1, same problem.

tcecyk · January 5, 2025, 4:54am

if on normal carrier connection (no vpn started yet) you get no ipv4, then you can’t reach any ipv4 endpoints: either protons or at home or at work - IPv6 Test, Test IPv6/4 connectivity - Port.Tools

With an update being the exact timing since it doesn’t work: APN settings have protocol settings for ipv4/6 - can you check?

trivia

usually carriers still do “CGNAT” for ipv4 or other transitional techniques (464XLAT), I’d be surprised about some already phasing out ipv4 without fallback, so I’d guess it’s only APN settings disabling ipv4, not the carrier per se

yvaillancourt · January 5, 2025, 6:15am

Thank you both,

I had already validated my apn configurations, but I still took the time to revalidate.

As you can see, the apn is configured ipv4 and ipv6. Without vpn, I have access to the internet and I can ping ipv4 addresses. I can also see that I have an ipv4 address.

I even deleted all the configurations to recover the default ones from the provider.

smu44 · January 5, 2025, 9:59am

Not sure it will help, anyway…

After creating a free ProtonVPN account, I could use How to download WireGuard configuration files | Proton VPN to generate a WireGuard config, then add it to WG Tunnel :

I can confirm it is working using Ping & Net :

(169… is the VPN endpoint public IP address, not my address on carrier network)

I could also browse the Internet, for example the very useful https://www.dnscheck.tools/ website:

I’m using /e/ OS 2.6.3-u, network carrier is Orange in France, IPv4 only:

yvaillancourt · January 5, 2025, 2:10pm

Unfortunately, it doesn’t work.

To be sure again, I went back into the system settings and reset the cellular settings and rebooted.

I also discovered other network problems. When I do a wifi test with wifiman, I got about 170mbps in both directions. Today, I get no more than 30mbps. I know that it is not my network that is the problem, because I run the test from another cell phone that is still on version 2.5 and I get about 200mbps. I am talking here about a test only wifi and without vpn.
Both phones are connected to the same wifi.

If a take a look to the network latency, on my phone is always between 100 and 300ms with Google, Facebook and X. On the other phone, it’s most like 10ms.

tcecyk · January 5, 2025, 4:41pm

@yvaillancourt: high ping, low throughput… do you have Tor in APs hide-my-ip active by any chance?

@smu44 you have ipv4 on your rmnet_data1 - the mobile connection, I don’t know how the advice could help besides showing how to sidestep the proton client to have more freedom in importing wg configs into other wg clients. You’re in different networks

@yvaillancourt clearly has only ipv6 assigned on the rmnet interface. For me it’s obvious why stuff fails if the carrier doesn’t do ipv4 transitional techniques.

You’d need to edit the wg config before/after import to only use ipv6 endpoints, then you’ll get somewhere @yvaillancourt

yvaillancourt · January 5, 2025, 6:08pm

@tcecyk, I don’t use Tor and all my tests (wifi speed and latency) was made without VPN.

I just put my sim card in the other phone with eOS v2.5 and everything works well.

tcecyk · January 5, 2025, 6:53pm

@yvaillancourt when I do insist on ipv6 settings that is only to prove a point - it’s not a solution.

I still think the APN setting must be kind of at fault, not the carrier. You could compare between what addresses rmnet_data1 are assigned between v2.5 and v2.6. Searching and comparing your mcc and mnc (for you mnc="370") in the apns-conf.xml that is distributed with each /e/OS release if they differ. What is your exact version/build string?

PopeElizabeth · January 5, 2025, 9:43pm

I have faced issues when trying to use a VPN as well. Regardless if mobile network or wifi is used. Advanced Privacy by eOS is working though.
Selecting VPN connection via control panel (slide down from top) lead to a crash of the the system and the lock screen will be displayed when a VPN has been selected.
w
When trying to connect to VPN browsing through settings the system does not crash but unfortunately it does not connect either. It just says “trying to connect” but nothing happens.
VPN configuration worked fine on 2.5-u. After the upgrade on 2.6-t no connection can be established.

yvaillancourt · January 6, 2025, 1:08am

Is it the build number that you ask me?

e-2.6.3-u-20241218455570-community-crosshatch

Ok! I understand that carrier settings don’t come from them, but from an system file. Give me some time, I will checkout the repo on my laptop and make a file compare between the two tags.

tcecyk · January 6, 2025, 1:44am

carrier can send new settings too - but seeing you updated to A14 (from A13 on 2.5->2.6.3 ?), there was this: https://review.lineageos.org/c/LineageOS/android_vendor_lineage/+/406819

Looking at what changed for Rogers/Fido… more bitmasks? (some docs on meaning)

Ofc you can replace all mnc=“370” entries with adb root if you want.

yvaillancourt · January 7, 2025, 2:46am

I took a look at both version of the file. Bit mask -16 +20. Not sure if I really understand, but it looks like MTU mask is removed and Max connection time is added?

With ADB, do you mean that I can try to put back old mask to see if it solve my problem? Maybe next thing I will try is wait for the next update, because I have many problems and use my essential phone for the next weeks.

Thank you very much @tcecyk and everyone for your help!

Thank you @smu44, I really appreciate ping and net!

tcecyk · January 7, 2025, 3:36am

I’d think you could edit the apn via the user-facing settings or are some entries inaccessible?

If you’re sure which entry does apply to you: enable dev mode (7 tap build string incantation) + usb debug + adb root, then pull, edit (at best, full line, not by char) and push

/system/product/etc/apns-conf.xml

yvaillancourt · January 11, 2025, 5:53pm

Ultimately this didn’t solve my problem. I just rolled back to 2.5 and applied 2.6.4 and everything is fine now.

Thanks for your time.

tcecyk · January 12, 2025, 8:35am

I’m really curious as to what component was responsible. Seems then more like a build failure, something else missing in the 2.6.3 build - than apn config.

Germo · January 18, 2025, 12:38pm

Same problem here.
Updated to 2.7, still not able to connect.

Filed a bug-report (via Cannot create account to report bug - #16 by N200)