Android client losing connection to all peers (including lighthouses) when device goes to sleep

[spectrumoverrule]

About a minute after the screen turns off, Nebula disconnects from all peers, including lighthouses.

Battery optimisation and background data are configured as unrestricted.

Following Android guidelines, a foreground service notification is required to keep the service running during standby.

Same behavior on different devices and Android versions.

[johnmaguire]

Hi @spectrumoverrule - can you please provide logs from the Nebula site? Additionally, if you're able to provide logcat logs around the event, that would be immensely helpful and would clearly indicate the cause. This is not something I'm running into on my Android device.

Same behavior on different devices and Android versions.

Are you able to share specifics?

[spectrumoverrule]

Hi @johnmaguire, this is the log from a lighthouse, I use three of them:

INFO[260054] Tunnel status                                 certName=android-1 localIndex=1481743087 remoteIndex=1059906531 tunnelCheck="map[method:active state:dead]" vpnAddrs="[x.x.x.6]"                                 
INFO[260060] Handshake message received                    certName=android-1 certVersion=1 fingerprint=***************************************************d83f70c0f6ac0 from="188.26.15.240:4242" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=651738319 issuer=**************************************************d82ec4be49b11d remoteIndex=0 responderIndex=0 vpnAddrs="[x.x.x.6]"                                                             
INFO[260060] Handshake message sent                        certName=android-1 certVersion=1 fingerprint=***************************************************d83f70c0f6ac0 from="188.26.15.240:4242" handshake="map[stage:2 style:ix_psk0]" initiatorIndex=651738319 issuer=**************************************************d82ec4be49b11d remoteIndex=0 responderIndex=2462323722 vpnAddrs="[x.x.x.6]"                                                    
INFO[260323] Tunnel status                                 certName=android-1 localIndex=2462323722 remoteIndex=651738319 tunnelCheck="map[method:active state:dead]" vpnAddrs="[x.x.x.6]"                                  
INFO[260331] Handshake timed out                           durationNs=6697955168 handshake="map[stage:1 style:ix_psk0]" initiatorIndex=4125982677 localIndex=4125982677 remoteIndex=0 udpAddrs="[]" vpnAddrs="[x.x.x.6]"    
INFO[260344] Handshake timed out                           durationNs=6698416632 handshake="map[stage:1 style:ix_psk0]" initiatorIndex=3766277947 localIndex=3766277947 remoteIndex=0 udpAddrs="[]" vpnAddrs="[x.x.x.6]"    
INFO[260370] Handshake timed out                           durationNs=6699496634 handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1896445350 localIndex=1896445350 remoteIndex=0 udpAddrs="[]" vpnAddrs="[x.x.x.6]"    
INFO[260422] Handshake timed out                           durationNs=6675469955 handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1541218422 localIndex=1541218422 remoteIndex=0 udpAddrs="[]" vpnAddrs="[x.x.x.6]"    
INFO[260524] Handshake timed out                           durationNs=6679371404 handshake="map[stage:1 style:ix_psk0]" initiatorIndex=3739532135 localIndex=3739532135 remoteIndex=0 udpAddrs="[]" vpnAddrs="[x.x.x.6]"    
INFO[260596] Handshake message received                    certName=android-1 certVersion=1 fingerprint=***************************************************d83f70c0f6ac0 from="y.y.y.240:1025" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=2771801833 issuer=**************************************************d82ec4be49b11d remoteIndex=0 responderIndex=0 vpnAddrs="[x.x.x.6]"                                                            
INFO[260596] Handshake message sent                        certName=android-1 certVersion=1 fingerprint=***************************************************d83f70c0f6ac0 from="y.y.y.240:1025" handshake="map[stage:2 style:ix_psk0]" initiatorIndex=2771801833 issuer=**************************************************d82ec4be49b11d remoteIndex=0 responderIndex=512619867 vpnAddrs="[x.x.x.6]"                                                    
INFO[260703] Close tunnel received, tearing down.          certName=android-1 from="y.y.y.240:1025" localIndex=512619867 remoteIndex=2771801833 vpnAddrs="[x.x.x.6]"                                                    
INFO[260713] Handshake message received                    certName=android-1 certVersion=1 fingerprint=***************************************************d83f70c0f6ac0 from="y.y.y.240:1025" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1635111344 issuer=**************************************************d82ec4be49b11d remoteIndex=0 responderIndex=0 vpnAddrs="[x.x.x.6]"                                                            
INFO[260713] Handshake message sent                        certName=android-1 certVersion=1 fingerprint=***************************************************d83f70c0f6ac0 from="y.y.y.240:1025" handshake="map[stage:2 style:ix_psk0]" initiatorIndex=1635111344 issuer=**************************************************d82ec4be49b11d remoteIndex=0 responderIndex=1585973607 vpnAddrs="[x.x.x.6]"

There are three lighthouses and they also act as relays, if it matters.

I will try to get ADB logs but I believe it has something to do with the vpn service being stopped / put to sleep by standby, if I keep the cable connected that won't happen.

It's worth mentioning that the client does recover after a few minutes of downtime. If I have a messaging app open on that phone and I send a message from a different device, the message is delayed a few minutes more often than not. Again, only when the phone goes to standby.

[johnmaguire]

@spectrumoverrule I'm interested in logs on the Android device please. It's normal for clients to disconnect from other clients after a period of inactivity. Please see this setting: https://github.com/slackhq/nebula/blob/master/examples/config.yml#L346-L356

You should be able to fetch adb logcat logs retroactively.

[spectrumoverrule]

@johnmaguire I got it working by adding a persistent notification and changing some default settings. If you wish I can share the diffs.

[johnmaguire]

Hi @spectrumoverrule - I actually had a diff to test with as well but was waiting for logs to confirm the issue. Did you happen to get logcat logs around the sleep event? If not, I will need to find some time to attempt a repro - this isn't something I observe in my use. Happy to see the diff, and I am still interested in the models of the devices you are testing with if you can provide that. Thanks!

[spectrumoverrule]

diff --git a/nebula/config.go b/nebula/config.go
index f8e2d5f..cb88731 100644
--- a/nebula/config.go
+++ b/nebula/config.go
@@ -37,7 +37,8 @@ func newConfig() *config {
                },
                Punchy: configPunchy{
                        Punch: true,
-                       Delay: "1s",
+                       Respond: true,
+                       Delay: "2s",
                },
                Relay: configRelay{
                        UseRelays: true,
@@ -66,8 +67,8 @@ func newConfig() *config {
                        WaitRotation: 5,
                },
                Tunnels: configTunnels{
-                       DropInactive:      true,
-                       InactivityTimeout: "10m",
+                       DropInactive:      false,
+                       InactivityTimeout: "30m",
                },
                Firewall: configFirewall{
                        Conntrack: configConntrack{
@@ -83,7 +84,13 @@ func newConfig() *config {
                                        Host:  "any",
                                },
                        },
-                       Inbound: []configFirewallRule{},
+                       Inbound: []configFirewallRule{
+                                {
+                                        Port:  "any",
+                                        Proto: "icmp",
+                                        Host:  "any",
+                                },
+                       },
                },
        }
 }

diff --git a/android/app/src/main/kotlin/net/defined/mobile_nebula/NebulaVpnService.kt b/android/app/src/main/kotlin/net/defined/mobile_nebula/NebulaVpnService.kt
index 1ccb7ab..98f437c 100644
--- a/android/app/src/main/kotlin/net/defined/mobile_nebula/NebulaVpnService.kt
+++ b/android/app/src/main/kotlin/net/defined/mobile_nebula/NebulaVpnService.kt
@@ -17,6 +17,13 @@ import java.net.Inet4Address
 import java.net.Inet6Address
 import java.net.InetAddress
 
+import android.app.Notification
+import android.os.IBinder
+import androidx.core.app.NotificationCompat
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+
 
 class NebulaVpnService : VpnService() {
 
@@ -36,6 +43,9 @@ class NebulaVpnService : VpnService() {
         const val MSG_SET_REMOTE_FOR_TUNNEL = 7
         const val MSG_CLOSE_TUNNEL = 8
         const val MSG_EXIT = 9
+        
+        const val NOTIFICATION_ID = 1
+        const val CHANNEL_ID = "VpnServiceChannel"
     }
 
     /**
@@ -66,6 +76,29 @@ class NebulaVpnService : VpnService() {
             return START_NOT_STICKY
         }
 
+        val notificationIntent = Intent(this, MainActivity::class.java)
+        val pendingIntent = PendingIntent.getActivity(this, 0, notificationIntent,
+            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
+            
+        val notification: Notification = NotificationCompat.Builder(this, CHANNEL_ID)
+            .setContentTitle("VPN is Active")
+            .setContentText("You are connected to the secure network.")
+            .setSmallIcon(R.drawable.launch_background)
+            .setContentIntent(pendingIntent)
+            .setOngoing(true)
+            .setPriority(NotificationCompat.PRIORITY_HIGH)
+            .build()
+            
+        startForeground(
+            NOTIFICATION_ID,
+            notification,
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                android.content.pm.ServiceInfo.FOREGROUND_SERVICE_TYPE_SYSTEM_EXEMPTED
+            } else {
+                0
+            }
+        )
+
         var autoStart = false
         var sitePath: String? = null
         try {
@@ -232,6 +265,18 @@ class NebulaVpnService : VpnService() {
         }
     }
 
+   //service notification 
+    private fun createNotificationChannel() {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            val serviceChannel = NotificationChannel(
+                CHANNEL_ID,
+                "VPN Service Channel",
+                NotificationManager.IMPORTANCE_HIGH
+            )
+            val manager = getSystemService(NotificationManager::class.java)
+            manager.createNotificationChannel(serviceChannel)
+        }
+    }
 
     // Used to detect network changes (wifi -> cell or vice versa) and rebinds the udp socket/updates LH
     private fun registerNetworkCallback() {
@@ -515,4 +560,4 @@ fun isIpv4Private(addr: ByteArray): Boolean {
     return b == 10 ||
             (b == 172 && (addr[1].toInt() and 0xFF) in 16..31) ||
             (b == 192 && (addr[1].toInt() and 0xFF) == 168)
-}
\ No newline at end of file
+}

diff --git a/android/app/src/main/kotlin/net/defined/mobile_nebula/MainActivity.kt b/android/app/src/main/kotlin/net/defined/mobile_nebula/MainActivity.kt
index 186cc26..aa571d5 100644
--- a/android/app/src/main/kotlin/net/defined/mobile_nebula/MainActivity.kt
+++ b/android/app/src/main/kotlin/net/defined/mobile_nebula/MainActivity.kt
@@ -60,6 +60,7 @@ class MainActivity: FlutterActivity() {
     override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
         super.configureFlutterEngine(flutterEngine)
         appContext = context
+
         //TODO: Initializing in the constructor leads to a context lacking info we need, figure out the right way to do this
         sites = Sites(flutterEngine)
         
@@ -281,7 +282,8 @@ class MainActivity: FlutterActivity() {
             putExtra("path", siteContainer.site.path)
             putExtra("id", siteContainer.site.id)
         }
-        startService(intent)
+        //startService(intent)
+        startForegroundService(intent)
         if (outMessenger == null) {
             bindService(intent, connection, 0)
         }
@@ -313,7 +315,8 @@ class MainActivity: FlutterActivity() {
 
         // We can't stopService because we have to close the fd first. The service will call stopSelf when ready.
         // See the official example: https://android.googlesource.com/platform/development/+/master/samples/ToyVpn/src/com/example/android/toyvpn/ToyVpnClient.java#116
-        startService(intent)
+        //startService(intent)
+        startForegroundService(intent)
     }
 
     private fun activeListHostmap(call: MethodCall, result: MethodChannel.Result) {
@@ -482,7 +485,8 @@ class MainActivity: FlutterActivity() {
                 putExtra("path", siteContainer.site.path)
                 putExtra("id", siteContainer.site.id)
             }
-            startService(intent)
+            //startService(intent)
+            startForegroundService(intent)
             if (outMessenger == null) {
                 bindService(intent, connection, 0)
             }

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index b0187f3..683dc0c 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -7,6 +7,15 @@
          FlutterApplication and put your custom class here. -->
     <uses-permission android:name="android.permission.INTERNET"/>
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+
+    <uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_VPN" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SYSTEM_EXEMPTED" />
+    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
+    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
+    
     <uses-feature android:name="android.hardware.camera" android:required="false"
         tools:replace="required" />
     <queries>
@@ -22,6 +31,7 @@
         <service android:name=".NebulaVpnService"
             android:permission="android.permission.BIND_VPN_SERVICE"
             android:exported="false"
+            android:foregroundServiceType="systemExempted"
             android:process=":nebulaVpnBg">
             <intent-filter>
                 <action android:name="android.net.VpnService"/>

Main focus is on Pixel devices running GrapheneOS. Everything is working as intended with no noticeable battery drain.
The only issue keeping me from switching to Nebula is #371