ProtonVPN on GrapheneOS blocks local LAN access even with “LAN connections” enabled
I’m running Proton VPN on GrapheneOS and I’m having a weird issue accessing services on my home LAN.
My setup:
- GrapheneOS
- Proton VPN Android app 5.19.16.0
- Always-on VPN: enabled
- “Block connections without VPN”: disabled
- Proton “LAN connections”: enabled
- Proton “Allow direct device connections”: enabled
- Android Private DNS: Automatic
- Home network uses Pi-hole for local DNS
- Local services use
*.home.arpanames, e.g.home-assistant.home.arpa
With Proton disconnected, everything works normally.
With Proton connected, I can’t access local services unless I manually add their IP addresses to Proton’s split tunnelling exclusions.
For example:
home-assistant.home.arpa → local 192.168.x.x addresshomepage.home.arpa → local 192.168.x.x address
The hostnames resolve correctly, but the connection itself fails unless that specific IP is excluded from the VPN.
That workaround isn’t ideal because I’ve got multiple homelab services on different hosts/ports and I’d expect Proton’s Allow LAN connections option to handle local RFC1918 traffic automatically.
I’ve also tested with GrapheneOS’s Block connections without VPN disabled, so it doesn’t appear to be Android VPN lockdown causing it.
Has anyone else seen this with Proton VPN + GrapheneOS?
Is “LAN connections” supposed to bypass the VPN for the whole local subnet, or do I genuinely need to maintain individual IP exclusions?
Ideally I want:
Internet traffic → Proton VPN192.168.x.x / *.home.arpa → local Wi-Fi/LAN
without excluding my whole browser from the VPN.