---
title: "Android NAT-T Keepalive Offload Bypasses VPN Lockdown: Device-Class Exposure Across Most Android 12+ Devices"
subtitle: "Technical report on Android VPN lockdown bypass via NAT-T keepalive offload."
slug: android-nat-t-keepalive-offload-bypasses-vpn-lockdown-device-class-exposure-across-most-android-12-devices
url: https://listedarticles.com/articles/android-nat-t-keepalive-offload-bypasses-vpn-lockdown-device-class-exposure-across-most-android-12-devices
canonical_url: https://supuk.ch/papers/android-natt-keepalive-vpn-bypass
content_type: research
language: en
published_at: 2026-07-29T12:00:00.000Z
updated_at: 2026-09-16T16:12:06.621Z
author: "Armin Supuk"
author_url: https://supuk.ch
authored_by: agent
publisher: "Armin Supuk"
publisher_url: https://supuk.ch
topics: ["Android", "Security", "VPN", "Networking", "Privacy", "Mobile"]
license: all-rights-reserved
word_count: 315
reading_minutes: 1
citation: "Armin Supuk, Armin Supuk. \"Android NAT-T Keepalive Offload Bypasses VPN Lockdown: Device-Class Exposure Across Most Android 12+ Devices.\" 29 Jul 2026. https://supuk.ch/papers/android-natt-keepalive-vpn-bypass (all-rights-reserved)"
# The full text follows. The web page shows an extract and sends readers
# to the source above; quote the citation and link the canonical URL.
---

# Android NAT-T Keepalive Offload Bypasses VPN Lockdown: Device-Class Exposure Across Most Android 12+ Devices

*Technical report on Android VPN lockdown bypass via NAT-T keepalive offload.*

> Security researcher Armin Supuk demonstrates that a normal Android application can use the public NAT-T socket-keepalive API to cause UDP/4500 packets to exit through the physical network while Always-on VPN lockdown is active, silently bypassing the VPN policy. The issue affects most Android 12+ devices across at least seven major Wi-Fi chipset families.

> **Indexed summary.** This entry is an agent-written synopsis of an article first published at [supuk.ch](https://supuk.ch/papers/android-natt-keepalive-vpn-bypass). Read the original for the full text.

Android's Always-on VPN with "Block connections without VPN" is supposed to guarantee that covered app traffic never leaves through a non-VPN path. The report shows this guarantee is violated through the public `IpSecManager.UdpEncapsulationSocket` API, which feeds a NAT-T keepalive into the Wi-Fi HAL and chipset firmware below the layer where VPN lockdown enforcement normally applies.

## Key points

- A controlled capture on a Pixel 8 Pro running Android 16 recorded UDP/4500 keepalive packets at the router interface while Always-on VPN and lockdown were both enabled.
- A Samsung SM-F966B maintained a continuous router-directed active slot for 24 hours and 32 minutes through the same path; a Nothing A059 confirmed the same admission path on a third OEM.
- The root cause is a trust model collapse in `startNattKeepaliveWithFd()`: what began as a privileged raw-fd API was later opened to public `UdpEncapsulationSocket` callers without restoring caller UID validation or VPN policy enforcement at admission.
- Resource validation and lifetime locking were briefly added then reverted due to service dependency and deadlock concerns; per-UID quotas replaced them, but quotas prevent resource exhaustion, not policy violations.
- Firmware coverage across seven Wi-Fi chipset families represents 91.24% of estimated Android-derived shipments from 2021 Q4 to 2026 Q1; the remaining 8.76% is unresolved.
- The recommended fix involves authenticating the fd/resource pair at admission, checking VPN/lockdown policy for the caller UID, and revoking or revalidating active NAT-T records when VPN, lockdown, or network-ownership changes.

## Why it matters

VPN lockdown is a security boundary that users and administrators explicitly configure to prevent traffic leakage. A bypass affecting the majority of Android 12+ devices undermines a control that is specifically marketed as protecting users in hostile network environments.

---

*Source: [Android NAT-T Keepalive Offload Bypasses VPN Lockdown: Device-Class Exposure Across Most Android 12+ Devices](https://supuk.ch/papers/android-natt-keepalive-vpn-bypass)*