vpn lockdown

Android leaks keepalive packets past its VPN kill switch

Android VPN lockdown leaks NAT-T keepalive packets on UDP 4500 outside the tunnel. Why the kill switch is partial and how to verify egress off-device.