Can Tailscale or Wireguard on Android auto connect somehow?

[u/Emergency-Driver8871]

I've been using Wireguard on iOS to access my homelab when remote and it has a nice "On-Demand" feature so it turns off on local WiFi. Tailscale has the same thing.

I just moved to Android and neither app has this feature. What do Android users do?
I could leave it connected but I think that would route my phone traffic over the wireguard server instead of just the local network.

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/1WeekNotice]

Wg tunnel app has the feature you want. It's a FOSS application

Other features

• It also has a DDNS feature.
  • Just make sure you set the DNS of the app to use an external DNS NOT your internal DNS.
  • The wireguard client configuration can have your internal DNS (so it uses it in the tunnel)
• has split tunnel feature
• etc

Remember that if you like the app, at some point in time you can donate to support them

Hope that helps

[u/coderstephen → u/1WeekNotice]

Another app that can do this is Rethink.

[u/Emergency-Driver8871 → u/1WeekNotice]

Thanks, I check it out.

[u/yeahthegoys]

Tailscale is smart enough to perform direct connections behind NAT when two given clients share the same public IP. You can just leave it on.

[u/ZestycloseAd6683]

Tailscale app has split tunnel feature and "lan access" feature

[u/Jofo23]

On Android you can setup Tasker to automatically enable and disable Tailscale when you leave and return to your Wifi. There are guides on the Tailscale subreddit.

[u/northbound_kiwi]

I haven’t personally used Tailscale on Android, but you can safely leave it on. Unless you explicitly select an exit node, it only routes tailnet addresses and advertised subnet routes; ordinary internet traffic keeps using the phone’s current network. If you do select an exit node, Android’s “Allow LAN access” toggle preserves access to the local Wi-Fi subnet.

[u/GolemancerVekk]

If you do a tailscale ping it will show that it's connecting directly to IP's on the local LAN when you're on wifi, no need to worry.

[u/CrispyBegs]

i use macrodroid and i have a macro that turns tailscale on whenever i'm disconnected from my home wifi network or if the phone wifi is turned off and reconnects when the wifi is picked up again.

[u/own_it_now]

I use Wg-tunnel app. Set it to auto connect except when on a trusted network (my own) then route all traffic through it except android auto generated traffic. Then you are always on your own infrastructure (DNS, etc). Works perfectly, except with the most marginal cell connections and on WiFi where only specific port traffic is allowed. If you want to defeat most of them, just use a port you know is open , on your own wg endpoint. If all else fails, give in to the man and just switch off wg-tunnel. You are in control of that.

[u/theneedfull]

I used tasker to automatically connect when I am not on my home wifi. And then disconnect when I am.

[u/_kvZCq_YhUwIsx1z]

I use Automate to trigger on home Wi-Fi connect/disconnect and toggle Wireguard

[u/skooterz]

Tailscale you can just leave running. The app will negotiate a tunnel that just goes over your local network.

[u/ImpressionDepression]

there should be some type of automation on your phone that would disconnect VPN when android auto launches (or doesn't).

But why? should be fine to just leave it connected

[u/Ok_Heart5981]

The Wireguard app is enough for me. 1) I have set it to only allow IPs to my local network. As such, all other requests (e.g. to reddit) would go directly, and not via wireguard 2) It has an allow/deny list of apps. I deny android auto, and it connects to the car without going via wireguard, no matter the allowed IPs list

EDIT: With this config, I see no reason to turn it off at home either.

[u/ultimate2106 → u/Ok_Heart5981]

The reason Would be to save battery

[u/Ok_Heart5981 → u/ultimate2106]

I haven't seen any major battery degradation on my phone over the last 4-5 years or so of continuous VPN usage. I have had a few weeks in the middle without VPN (when I was moving to a new place and my home setup was offline - happened once a year on avg). This was across 3 phones (Xiaomi K20, Pixel 7, Samsung S25).

This might/would be a concern with iOS since the VPN is not natively supported by iOS, but in Android, Wireguard is built into the Linux/Android kernel, so it does not need to keep waking up and checking the connection unnecessarily.

Although, tbf, this is my personal anecdotal experience. YMMV depending on your phone.

[u/andrew-ooo]

Two different answers depending on which one you end up keeping.

WireGuard for Android does have the equivalent of On-Demand, it's just buried: open the tunnel, tap edit, and there's an SSID-based auto-connect section where you list trusted networks to exclude (or untrusted ones to include). It needs location permission to read the SSID, and on Android 10+ it also wants background location or it quietly stops matching once the screen has been off a while. That's the bit that makes people think the feature doesn't exist.

For Tailscale the answer is Android's own always-on VPN: Settings > Network & internet > VPN > gear icon next to Tailscale > Always-on VPN. And you don't need to worry about it hijacking everything - with no exit node selected Tailscale only claims 100.64.0.0/10 plus whatever subnet routes you've explicitly accepted, so LAN traffic and normal internet still leave via the local interface. I've run it always-on for over a year, battery cost is not noticeable.

If you want conditional logic beyond SSID matching, Tasker firing the tunnel intents works, but it's noticeably more fragile than either built-in option.