What are Mobile VPN Leaks and how to Fix them?

With the rise of VPN popularity, mobile users have adapted to their use and feel safe online with a VPN enabled on their devices. Statista reported that 57% of mobile VPN users want to access premium content like TV shows and movies that are unavailable in their country.

While entertainment is the main reason behind the rise of VPN usage on mobile devices, many users say that online privacy and security are the top priorities for using a VPN. But did you know that VPNs can leak your data while enabled on your mobile device?

Social media apps are often to blame for mobile VPN leaks, but they’re not the only issue. In this article, we’ll dive into why mobile VPN leaks happen, how to check if your data is at risk, and what you can do to fix the problem and keep your information safe.

What is a Mobile VPN leak?

A mobile VPN leak happens when your VPN fails to encrypt your device traffic. This gives opportunity ISPs, government trackers, and data harvesters to collect your data, which includes your IP address, browsing history, and DNS requests, which they later use for advertising or keeping an eye on you.

The most effective way to eliminate mobile VPN leaks is to purchase a premium VPN like NordVPN or ExpressVPN. You will be surprised to know that a mobile VPN leak does not always happen because your VPN malfunctions but because of the applications running in the background before you enabled the VPN on your mobile phone.

A mobile VPN leak can have serious consequences, especially if you reside in a country where VPNs are illegal or heavily regulated. Suppose you are involved in activism or journalism against dictatorial regimes. In that case, I recommend that you pay close attention to your online privacy and test your VPN before doing anything online.

What causes a mobile VPN leak on Android and iOS?

The Android OS has a built-in feature called connectivity checks, which constantly sends and receives a data packet to check whether you are connected to the internet and send push notifications like a message on WhatsApp or if someone commented on your post on social media.

If your device is not connected to a VPN all the time, this connectivity check can reveal your IP address and device information to your ISPs or government trackers. This can be a serious threat if you send sensitive files or engage in activism.

I recommend having a different mobile phone for work and keeping your VPN enabled all the time. To add another layer of security, you can also employ the kill switch feature offered by many VPN providers.

On the other hand, iOS users can relax because it is considered the most secure mobile phone and PC operating system. However, there are limitations in this system that can blow your cover and can cause mobile VPN leaks. Here are a few points to remember when using iOS to avoid mobile VPN leaks.

• Close all the applications before enabling a VPN on your iOS device. Apps running before you enabled the VPN can still send data outside the VPN-encrypted tunnel.
• Third-party apps can still see your IP address and bypass the VPN tunnel.
• Applications like Apple Maps and Push Notification can bypass your VPN connection.

What are the dangers of Mobile VPN Leaks?

A VPN connection that is leaking your data can have serious consequences. At worst, you can be jailed for using a VPN in countries that have banned its use. Here are more dangers of a mobile VPN leak.

You are exposed to hackers

If you use public WiFi with a device that leaks data, you invite unwanted attention and put your data at risk. A mobile VPN leak is also vulnerable if you download illegal torrent files or access a banned website.

Hackers can steal sensitive data, which poses a serious security risk. Additionally, the government and ISPs can track your browsing activities, which can result in fines or jail.

Your IP and DNS are at risk

A VPN encrypts your data using modern protocols like OpenVPN or Wireguard. Therefore, if your data is leaked, it will remain encrypted and unreadable. However, information like your location, IP address, and DNS is still accessible to hackers, who might use it against you.

In the case of a DNS leak, your DNS queries bypass the VPN and are sent directly to your internet service provider (ISP), revealing your browsing activity to them instead of the VPN’s secure DNS servers.

Using Raspberry Pi, OpenWRT and Wireshark to test Mobile VPN Leaks

We will be testing the mobile VPN leaks with a Raspberry Pi, OpenWRT, and Wireshark. For those of you who have heard these names for the first time:

• Raspberry Pi is a small computer used to perform multiple tasks your PC can do with fewer limitations.
• OpenWRT is a Linux-based operating system that we will be using to operate Raspberry Pi.
• Wireshark will analyze the protocol your VPN is using and how it is encrypting your data

Raspberry Pi and OpenWRT will capture your data and Wireshark will analyze if you VPN is leaking any data or if there are any encryption problems.

1. Install Wireshark on your PC

Here are the steps to install Wireshark software on your PC:

1. Visit the Wireshark website and navigate to the download section.
2. Download the appropriate installer for your system: either the 64-bit version for Windows or the macOS package.
3. Open the installer and proceed by clicking “Next.” Agree to the user agreement by selecting “Noted.”
4. Select the components you’d like to install. It’s recommended that all components be included for a complete setup.
5. Continue through the installation menus until you reach the “Install” button. Click it and wait for the process to finish.
6. If additional installation options appear, you can leave them as default and simply click “Install” to complete the setup.

2. Install OpenWRT on Raspberry Pi

After installing Wireshark on your PC, follow these steps to download and install OpenWRT on your Raspberry Pi.

1. Find and download the correct OpenWRT installation image for your specific Raspberry Pi model.
2. Download the Raspberry Pi Imager tool, which will help you install OpenWRT onto an SD card or USB drive.
3. Launch the Raspberry Pi Imager and click on “Choose OS.”
4. Scroll down and select the “Use Custom” option.
5. Locate the OpenWRT installation image you downloaded earlier and select it.
6. Next, click “Choose Storage” and pick your SD card or USB drive.
7. Be aware that this will erase all data on the selected storage device before transferring OpenWRT.
8. Finally, click “Write” to copy OpenWRT to your storage device.

3. Set up OpenWRT on Raspberry Pi

Here are the steps to set up OpenWRT on your Raspberry Pi computer.

1. Use an Ethernet cable to connect your Raspberry Pi directly to your PC.
2. Open a web browser and enter the IP address 192.168.1.1 in the address bar.
3. When the login screen appears, update your login credentials to secure your connection.

4. Capture your mobile traffic with OpenWRT

Now it’s time to see if your VPN is leaking mobile traffic. Here are the steps to use OpenWRT to check it.

1. Navigate to the LAN interface settings on your Raspberry Pi (Interfaces > LAN).
2. Change the “Protocol” to Static address.
3. Set the local IPv4 address to match the network of your router.
4. Click Save to apply the changes.
5. Open the Bridge device: br-lan settings.
6. Set the Bridge ports to eth0. This configuration enables the Raspberry Pi to act as a bridge, converting WiFi signals to Ethernet and allowing it to connect to your WiFi network, bridging your smartphone and outgoing data traffic.
7. Click Save to confirm these changes.
8. Install tcpdump on the router to capture network traffic.
9. Connect your mobile device to the OpenWRT router and ensure cellular data is disabled.
10. Activate your VPN on your mobile device.
11. Follow OpenWRT’s instructions to use tcpdump for packet capture on the br-lan device.
12. Open Wireshark, which will start automatically and display captured traffic.
13. Use the following display filter in Wireshark to clean up the traffic, replacing the mobile device’s IP address: (ip.src== || ip.dst==) and (tls || http || dns || tcp || udp) and !wg and !openvpn and !icmp and !mdns.
14. If any packets are visible in Wireshark, it likely indicates a mobile VPN leak.

How to Fix Mobile VPN Leaks?

There are two popular methods to fix mobile VPN leaks if you have spotted any. The first method is done using adb on your Android phone, and the next is fixing mobile VPN leaks with the router. We will discuss both methods in detail with easy steps for you to follow.

Using Android debug bridge to fix Android VPN leaks

The Android Debug Bridge (ADB) is a powerful tool that allows users to make advanced modifications to the Android operating system on their mobile devices. In this guide, we’ll use ADB to disable connectivity checks across all apps, as these checks have been identified as a common source of mobile traffic leaks.

You will need to configure it on your Android phone and your PC (Windows).

How to configure adb on Android

1. Open your phone’s Settings menu.
2. Navigate to About Phone (or a similar option, depending on your device).
3. Enable Developer Mode by repeatedly tapping on the Build Number (or your operating system version) seven times. Some devices may require you to tap on a different option, such as the mobile OS name. You’ll typically see a notification confirming Developer Mode is now enabled.
4. Return to the main Settings menu. On some devices, this option may be found under Additional Settings or a similar section.
5. Locate and select Developer Options to access the advanced settings menu.
6. Enable ‘USB Debugging.‘

Setting up adb on your Windows PC

1. Go to the official Android SDK Platform Tools page and download the correct package for Windows.
2. Extract the ZIP file to an easy-to-remember location on your computer.
3. Open File Explorer and navigate to the folder where you saved the extracted platform tools.
4. In the folder, hold the Shift key and right-click with your mouse. Select Open command window here (or Open PowerShell window here if using a newer version of Windows).
5. Connect your smartphone to your PC using a USB cable. When prompted on your phone, choose File transfer (MTP mode) to establish the connection.
6. Check if your computer recognizes your phone. A prompt will appear on your device asking if you want to allow debugging access. Tap OK to grant permission.
7. Confirm the connection is established by rechecking your device in the command prompt or PowerShell window.

Setting up adb on your macOS

1. Visit the official Android SDK Platform Tools page and download the appropriate package for macOS.
2. Extract the ZIP file to a location you’ll easily remember.
3. Open the Terminal application on your Mac.
4. In the Terminal, navigate to the folder where you extracted the Android SDK Platform Tools by entering the exact path, such as: /Users/YourUsername/Documents/adb/
5. Connect your Android phone to your Mac using a USB cable. When prompted on your phone, select File transfer (MTP mode) to enable the connection.
6. In the Terminal, enter the command to check for connected devices: ./adb devices
7. Look at your phone screen for a message asking to allow USB debugging. Tap Allow to confirm.
8. Re-enter ./adb devices in Terminal to verify that your device is properly connected.

Disabling connectivity checks on Android with adb

Your Android mobile phone should be connected to your PC for the completion of this process. You can set the portal mode to three values:

• Setting 0: This setting disables connectivity checks by preventing your system from detecting captive portals. This ensures no redirection occurs, effectively turning off connectivity checks.
• Setting 1: The default option. When a captive portal is detected, it redirects you to a sign-in page, allowing you to log in and gain network access.
• Setting 2: Disconnect your device from the network entirely when a captive portal is detected. Additionally, your device will no longer attempt to reconnect to that network in the future.

Fixing mobile VPN leaks with a VPN router

This method works perfectly if you are in your home and not connected to a public WiFi. Making your router in charge of your online security is the best thing you can do.

All your data will be encrypted by the VPN installed on your router, and you don’t have to worry about turning off the connectivity checks on your mobile.

However, if you travel a lot and often get connected to public WiFi, then modifying the connectivity checks on your Android device is your best option.

Final thoughts

We have discussed how a mobile phone can leak your data when you have a VPN enabled. Even if your VPN is working perfectly, the connectivity check used in most social media apps can transfer your original IP address, DNS, device information, and location.

The good news is you can turn off the connectivity check by altering your Android OS by following the steps mentioned above. I tested all methods to change the connectivity checks mentioned above on a Samsung Galaxy S22 Ultra 5G.

For more information on VPNs and advanced features, read these articles:

• What is SoftEther VPN protocol
• What is the SSTP VPN protocol
• What is Layer 2 Tunnel Protocol (L2TP)
• Best VPN servers for privacy, security, and streaming
• What is the difference between a VPN and Antivirus