# Android Tunneler Bug

**URL:** <https://openziti.discourse.group/t/android-tunneler-bug/4286>\
**Category:** Ziti Mobile Edge for Android\
**Created:** [March 31, 2025, 3:14pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286 "2025-03-31T15:14:55Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![007bond007](https://avatars.discourse-cdn.com/v4/letter/0/3be4f8/32.png) [@007bond007](https://openziti.discourse.group/u/007bond007)\
**Post date:** [March 31, 2025, 3:14pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/1 "2025-03-31T15:14:55Z")

</div>

I've noticed a bug with the Android tunneler: If the app is closed entirely (you can force stop it in Android Settings under Apps) the moment you open it and turn the service back on and try to authenticate (I'm using an IDP) you cannot reach the IDP website - but you also cannot access any internet websites, almost as if DNS is broken. My ping utility shows "Unknown host" and browser displays a DNS error.

I've experience this other times but it's the most "reproducible" method. If you then disable, and re-enable the identity in the tunneler app, you will be able to succesfully use the internet and authenticate via IDP.

I'm using a Pixel 8 Pro Android phone.

---

<div class="post-metadata">

**Author:** ![thedarkula](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thedarkula/32/1459_2.png) [@thedarkula](https://openziti.discourse.group/u/thedarkula)\
**Post date:** [March 31, 2025, 9:58pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/2 "2025-03-31T21:58:34Z")

</div>

You actually beat me to posting about this 🙂

I have noticed with two services (matrix and IMAP) that the ziti edge tunnels (android and linux respectively), fail to resolve.  
If I hard-restart the tunnel, everything resolves again. I can access services, but it seems like the tunnels have something like a stale handle.

---

<div class="post-metadata">

**Author:** ![007bond007](https://avatars.discourse-cdn.com/v4/letter/0/3be4f8/32.png) [@007bond007](https://openziti.discourse.group/u/007bond007)\
**Post date:** [April 1, 2025, 5:47pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/3 "2025-04-01T17:47:20Z")

</div>

> [@thedarkula](#):
>
> I have noticed with two services (matrix and IMAP) that the ziti edge tunnels (android and linux respectively), fail to resolve.

I feel like there are 2 separate issues here, and I've experienced both as well (I mentioned one in another thread).

1. DNS/Resolving/Internet breaking upon first Android client login (nothing resolves - and I'm not yet authenticated so apps don't work at all, as expected, but the IDP and normal browsing break), that's this issue.

2. The second is my other thread where I have a similar issue to you, where I get logged in and some apps do work, and others do not - but yet DNS resolves to OpenZiti correctly, it's just not allowing all apps to work.

Although I seem to find these bugs, I do just want to state Open Ziti is great and has so much potential! I've been growing attached as I use it and learn more about how it works.

---

<div class="post-metadata">

**Author:** ![thedarkula](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thedarkula/32/1459_2.png) [@thedarkula](https://openziti.discourse.group/u/thedarkula)\
**Post date:** [April 1, 2025, 7:03pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/4 "2025-04-01T19:03:38Z")

</div>

@qrkourier Is this/are these known issues, or would it be good to open an issue (or two) on GitHub?

---

<div class="post-metadata">

**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\
**Post date:** [April 1, 2025, 7:20pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/5 "2025-04-01T19:20:58Z")

</div>

Does "About" show v0.13.5? That's the version I'm trying to reproduce with on a Pixel 6.

I ignored the "app may misbehave" warning and force stopped ZME in Android Settings, but I didn't encounter the DNS problem. Can you trigger this DNS problem without "force stop" (which may lead to a non-graceful exit and a broken app state)? You mentioned "first Android client login" and that could mean you're encountering this DNS problem when you first turn on the tunnel in the ZME app. If so, does the DNS problem persist, or is it only manifesting "at first login?"

Thanks for clarifying that the workaround for the DNS issue is to toggle the tunnel in the ZME app.

The other issue was described as "some apps do work, and others do not." Are you saying that some Ziti services work, and others do not? Specifically, of the apps that are working, are they trying unsuccessfully to connect to a Ziti service? What about those apps that are not working?

---

<div class="post-metadata">

**Author:** ![007bond007](https://avatars.discourse-cdn.com/v4/letter/0/3be4f8/32.png) [@007bond007](https://openziti.discourse.group/u/007bond007)\
**Post date:** [April 1, 2025, 8:16pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/6 "2025-04-01T20:16:07Z")

</div>

> [@qrkourier](#):
>
> Does "About" show v0.13.5?

Yes, latest version of all software is being used.

> [@qrkourier](#):
>
> Can you trigger this DNS problem without "force stop" (which may lead to a non-graceful exit and a broken app state)? You mentioned "first Android client login" and that could mean you're encountering this DNS problem when you first turn on the tunnel in the ZME app. If so, does the DNS problem persist, or is it only manifesting "at first login?"

Just tested and confirmed it happens if I reboot the phone as well, and try to bring up the tunnel. There could be other circumstances but none come to mind right now.

> [@qrkourier](#):
>
> The other issue was described as "some apps do work, and others do not." Are you saying that some Ziti services work, and others do not? Specifically, of the apps that are working, are they trying unsuccessfully to connect to a Ziti service? What about those apps that are not working?

I have a [Windows Edge Client thread here](https://openziti.discourse.group/t/some-services-unavailable-right-away-with-windows-ziti-desktop-edge/4205), where @TheLumberjack confirmed the issue during sleep (again, may be triggered in other circumstances but this was the easiest way to reproduce it). I will let @thedarkula confirm the Android/Linux side of this. But yes, you're correct in that some ziti services work, others do not - but the ones that work, have no issues - they are intercepted and connect to the app just fine, and the ones that do not work will resolve to their standard (non ziti-tunneled) destination.

---

<div class="post-metadata">

**Author:** ![ekoby](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ekoby/32/14_2.png) [@ekoby](https://openziti.discourse.group/u/ekoby)\
**Post date:** [April 3, 2025, 5:43pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/7 "2025-04-03T17:43:16Z")

</div>

this makes little sense to me because DNS queries not covered by intercepts are proxied to the DNS server provided by your network. Also they would not depend on any identity being authenticated via IdP or otherwise.

if you encounter that condition, please submit application feedback bundle before force-quitting the app (that should never be necessary)

---

<div class="post-metadata">

**Author:** ![007bond007](https://avatars.discourse-cdn.com/v4/letter/0/3be4f8/32.png) [@007bond007](https://openziti.discourse.group/u/007bond007)\
**Post date:** [April 3, 2025, 7:02pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/8 "2025-04-03T19:02:17Z")

</div>

Just submitted one after a reboot and re-occurrence 🙂

---

<div class="post-metadata">

**Author:** ![007bond007](https://avatars.discourse-cdn.com/v4/letter/0/3be4f8/32.png) [@007bond007](https://openziti.discourse.group/u/007bond007)\
**Post date:** [April 6, 2025, 8:25pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/9 "2025-04-06T20:25:11Z")

</div>

Ok, so I tried clearing the cache in Android settings and clearing the data to start fresh, re-enrolled and right on the first connection, when it loads the IDP the internet is not working - I then disable/re-enable and i'm able to login again. It seems like it is some sort of bug maybe specific to the Pixel device and OpenZiti. Given the previous logs didn't have much in them - is there something else I should be checking?

---

<div class="post-metadata">

**Author:** ![thedarkula](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thedarkula/32/1459_2.png) [@thedarkula](https://openziti.discourse.group/u/thedarkula)\
**Post date:** [April 7, 2025, 8:18am UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/10 "2025-04-07T08:18:57Z")

</div>

> [@qrkourier](#):
>
> Does "About" show v0.13.5? That's the version I'm trying to reproduce with on a Pixel 6.

It does. The commit shows `c5e860f`.

Something else of note is that, specifically on Linux, I noticed that `ziti-edge-tunnel` has a severe memory leak.

The percent memory usage dropped from 70.2% to 31.2% following a restart of `ziti-edge-tunnel`.

The systemd logs show this just before restarting the service:

```auto
Apr 07 07:56:09 computer-name ziti-edge-tunnel[933]: (933)[207515.754] WARN ziti-sdk:channel.c:559 dispatch_message() ch[21] received message without conn_id or for unknown connection ct[ED72] conn_id[3253]
Apr 07 07:56:19 computer-name ziti-edge-tunnel[933]: (933)[207525.756] ERROR tunnel-sdk:tunnel_tcp.c:190 on_tcp_client_err() client=tcp:100.64.0.1:40962 err=-14, terminating connection
Apr 07 07:56:19 computer-name ziti-edge-tunnel[933]: (933)[207525.756] WARN ziti-sdk:channel.c:559 dispatch_message() ch[21] received message without conn_id or for unknown connection ct[ED72] conn_id[3254]
Apr 07 07:56:29 computer-name ziti-edge-tunnel[933]: (933)[207535.757] ERROR tunnel-sdk:tunnel_tcp.c:190 on_tcp_client_err() client=tcp:100.64.0.1:51958 err=-14, terminating connection
Apr 07 07:56:29 computer-name ziti-edge-tunnel[933]: (933)[207535.757] WARN ziti-sdk:channel.c:559 dispatch_message() ch[21] received message without conn_id or for unknown connection ct[ED72] conn_id[3255]
Apr 07 07:56:39 computer-name ziti-edge-tunnel[933]: (933)[207545.758] ERROR tunnel-sdk:tunnel_tcp.c:190 on_tcp_client_err() client=tcp:100.64.0.1:53044 err=-14, terminating connection
Apr 07 07:56:39 computer-name ziti-edge-tunnel[933]: (933)[207545.758] WARN ziti-sdk:channel.c:559 dispatch_message() ch[21] received message without conn_id or for unknown connection ct[ED72] conn_id[3256]
Apr 07 07:56:49 computer-name ziti-edge-tunnel[933]: (933)[207555.759] ERROR tunnel-sdk:tunnel_tcp.c:190 on_tcp_client_err() client=tcp:100.64.0.1:35700 err=-14, terminating connection
Apr 07 07:56:49 computer-name ziti-edge-tunnel[933]: (933)[207555.759] WARN ziti-sdk:channel.c:559 dispatch_message() ch[21] received message without conn_id or for unknown connection ct[ED72] conn_id[3257]
Apr 07 07:57:07 computer-name ziti-edge-tunnel[933]: (933)[207574.201] ERROR tunnel-sdk:tunnel_tcp.c:190 on_tcp_client_err() client=tcp:100.64.0.1:36368 err=-14, terminating connection
Apr 07 07:57:07 computer-name ziti-edge-tunnel[933]: (933)[207574.201] WARN ziti-sdk:connect.c:222 close_conn_internal() conn[0.3179/lNMEp26N/Closed](jellyfin) dumping 24 bytes of undelivered data
Apr 07 07:57:07 computer-name ziti-edge-tunnel[933]: (933)[207574.202] ERROR tunnel-sdk:tunnel_tcp.c:190 on_tcp_client_err() client=tcp:100.64.0.1:57346 err=-14, terminating connection
Apr 07 07:57:07 computer-name ziti-edge-tunnel[933]: (933)[207574.202] WARN ziti-sdk:channel.c:559 dispatch_message() ch[21] received message without conn_id or for unknown connection ct[ED72] conn_id[3259]
Apr 07 07:57:07 computer-name ziti-edge-tunnel[933]: (933)[207574.253] ERROR tunnel-sdk:tunnel_tcp.c:190 on_tcp_client_err() client=tcp:100.64.0.1:40264 err=-14, terminating connection
Apr 07 07:57:07 computer-name ziti-edge-tunnel[933]: (933)[207574.253] WARN ziti-sdk:connect.c:222 close_conn_internal() conn[0.3221/UNJ3fWNo/Closed](jellyfin) dumping 13026546579 bytes of undelivered data
Apr 07 08:02:04 computer-name ziti-edge-tunnel[933]: (933)[207871.216] ERROR tunnel-sdk:tunnel_tcp.c:190 on_tcp_client_err() client=tcp:100.64.0.1:43354 err=-14, terminating connection
Apr 07 08:02:04 computer-name ziti-edge-tunnel[933]: (933)[207871.216] WARN ziti-sdk:channel.c:559 dispatch_message() ch[21] received message without conn_id or for unknown connection ct[ED72] conn_id[3118]
Apr 07 08:02:04 computer-name ziti-edge-tunnel[933]: (933)[207871.216] WARN ziti-sdk:channel.c:559 dispatch_message() ch[21] received message without conn_id or for unknown connection ct[ED72] conn_id[3118]

```

Here is a relevant screenshot from the output of `glances`:  
 ![Ziti Tunnel High Memory-pre-restart](https://global.discourse-cdn.com/free1/uploads/netfoundry/optimized/2X/3/3f800440407b97360b954c2905dfcdcad619f3cb_2_690x16.png)

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 7, 2025, 3:06pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/11 "2025-04-07T15:06:28Z")

</div>

@thedarkula - can you make a separate thread for the suspected memory leak please? thanks

---

<div class="post-metadata">

**Author:** ![thedarkula](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thedarkula/32/1459_2.png) [@thedarkula](https://openziti.discourse.group/u/thedarkula)\
**Post date:** [April 7, 2025, 8:23pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/12 "2025-04-07T20:23:21Z")

</div>

[Done](https://openziti.discourse.group/t/ziti-edge-tunnel-on-linux-leaks-memory/4314) 🙂

---

<div class="post-metadata">

**Author:** ![thedarkula](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thedarkula/32/1459_2.png) [@thedarkula](https://openziti.discourse.group/u/thedarkula)\
**Post date:** [April 18, 2025, 11:15pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/13 "2025-04-18T23:15:30Z")

</div>

Have the logs that @007bond007 supplied shed any light on the situation?

This is still occuring for me with the latest Android and Linux tunnels.

---

<div class="post-metadata">

**Author:** ![007bond007](https://avatars.discourse-cdn.com/v4/letter/0/3be4f8/32.png) [@007bond007](https://openziti.discourse.group/u/007bond007)\
**Post date:** [April 22, 2025, 1:06am UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/14 "2025-04-22T01:06:35Z")

</div>

Also wondering this 🙂

---

<div class="post-metadata">

**Author:** ![ekoby](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ekoby/32/14_2.png) [@ekoby](https://openziti.discourse.group/u/ekoby)\
**Post date:** [April 22, 2025, 3:31pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/15 "2025-04-22T15:31:31Z")

</div>

[issue](https://github.com/openziti/ziti-tunnel-android/issues/305) should be resolved with next release

---

<div class="post-metadata">

**Author:** ![ekoby](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ekoby/32/14_2.png) [@ekoby](https://openziti.discourse.group/u/ekoby)\
**Post date:** [April 22, 2025, 5:22pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/16 "2025-04-22T17:22:38Z")

</div>

The fix is how available via the testing channel

---

<div class="post-metadata">

**Author:** ![007bond007](https://avatars.discourse-cdn.com/v4/letter/0/3be4f8/32.png) [@007bond007](https://openziti.discourse.group/u/007bond007)\
**Post date:** [April 24, 2025, 6:57pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/17 "2025-04-24T18:57:28Z")

</div>

Hi @ekoby , on the Github page it says " DNS bypass not working without any identities" - is this the same bug, where if you DO have identities/services the DNS breaks the first time you connect to Ziti, but then subsequent attempts, DNS is working again?

---

<div class="post-metadata">

**Author:** ![ekoby](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ekoby/32/14_2.png) [@ekoby](https://openziti.discourse.group/u/ekoby)\
**Post date:** [April 24, 2025, 7:57pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/18 "2025-04-24T19:57:29Z")

</div>

Yes, it is the same.

---

<div class="post-metadata">

**Author:** ![007bond007](https://avatars.discourse-cdn.com/v4/letter/0/3be4f8/32.png) [@007bond007](https://openziti.discourse.group/u/007bond007)\
**Post date:** [April 26, 2025, 2:04pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/19 "2025-04-26T14:04:14Z")

</div>

Thanks @ekoby this issue is now fixed! (Initial DNS not working), great work!. The 2nd issue in my other thread is still happening (Some intercepts not working, some are until restarting service/identity).

---

<div class="post-metadata">

**Author:** ![ekoby](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ekoby/32/14_2.png) [@ekoby](https://openziti.discourse.group/u/ekoby)\
**Post date:** [April 27, 2025, 4:00pm UTC](https://openziti.discourse.group/t/android-tunneler-bug/4286/20 "2025-04-27T16:00:53Z")

</div>

are you adding/editing services/intercepts and expecting them to work?

this could be just a delay in updating services to your endpoint/device. This is currently done with polling. On the phones we reduce polling rate to conserve the battery.

Bringing up ZME interface forces the refresh. Can you try you services after opening UI (without identity restart)?

[Next page](https://openziti.discourse.group/t/android-tunneler-bug/4286.md?page=2)