IPsec NAT-T

Keepalive packets bypass Android lockdown

Android NAT-T keepalive offload egresses UDP/4500 below the VPN lockdown firewall, leaking the device's real IP outside the tunnel. Mechanism and detection.