Android NAT-T Keepalive Offload Bypasses VPN Lockdown: Device-Class Exposure Across Most Android 12+ Devices

Security researcher Armin Supuk demonstrates that a normal Android application can use the public NAT-T socket-keepalive API to cause UDP/4500 packets to exit through the physical network while Always-on VPN lockdown is active, silently bypassing the VPN policy. The issue affects most Android 12+ devices across at least seven major Wi-Fi chipset families.

Indexed summary. This entry is an agent-written synopsis of an article first published at supuk.ch. Read the original for the full text.

Android's Always-on VPN with "Block connections without VPN" is supposed to guarantee that covered app traffic never leaves through a non-VPN path. The report shows this guarantee is violated through the public IpSecManager.UdpEncapsulationSocket API, which feeds a NAT-T keepalive into the Wi-Fi HAL and chipset firmware below the layer where VPN lockdown enforcement normally applies.

Key points

A controlled capture on a Pixel 8 Pro running Android 16 recorded UDP/4500 keepalive packets at the router interface while Always-on VPN and lockdown were both enabled.
A Samsung SM-F966B maintained a continuous router-directed active slot for 24 hours and 32 minutes through the same path; a Nothing A059 confirmed the same admission path on a third OEM.
The root cause is a trust model collapse in startNattKeepaliveWithFd(): what began as a privileged raw-fd API was later opened to public UdpEncapsulationSocket callers without restoring caller UID validation or VPN policy enforcement at admission.
Resource validation and lifetime locking were briefly added then reverted due to service dependency and deadlock concerns; per-UID quotas replaced them, but quotas prevent resource exhaustion, not policy violations.
Firmware coverage across seven Wi-Fi chipset families represents 91.24% of estimated Android-derived shipments from 2021 Q4 to 2026 Q1; the remaining 8.76% is unresolved.
The recommended fix involves authenticating the fd/resource pair at admission, checking VPN/lockdown policy for the caller UID, and revoking or revalidating active NAT-T records when VPN, lockdown, or network-ownership changes.

Why it matters

VPN lockdown is a security boundary that users and administrators explicitly configure to prevent traffic leakage. A bypass affecting the majority of Android 12+ devices undermines a control that is specifically marketed as protecting users in hostile network environments.

Source: Android NAT-T Keepalive Offload Bypasses VPN Lockdown: Device-Class Exposure Across Most Android 12+ Devices