How to Inspect Active VPN Profiles and Lockdown Policies on Android Using ADB dumpsys vpn_management

Enterprise mobile management (EMM), privacy tooling, and secure communication apps on Android frequently utilize Virtual Private Networks (VPNs) to encrypt network egress and enforce compliance policies. Starting in Android 11, the Android framework separated legacy legacy VPN services from modern programmatic VPN management through the VpnManager system service. This subsystem administers platform-managed IKEv2/IPsec profiles, enforces always-on VPN lockdown rules, and manages per-app split-tunneling configurations. To inspect active VPN connections, review cryptographic tunnel parameters, and verify lockdown bypass restrictions without specialized administrative software, Android provides the dumpsys vpn_management diagnostic service via ADB.

Understanding Android VpnManagementService Architecture

The Android VPN infrastructure operates across multiple interconnected system layers:

• VpnManagementService: The core framework service coordinating modern programmatic VPN profiles provisioned by applications using the VpnManager API. It validates app permissions and enforces system-wide always-on policies.
• Platform VPN vs Legacy VpnService: Platform VPNs delegate IKEv2/IPsec cryptographic handshakes and packet encapsulation directly to the operating system’s native IPsec stack, improving battery efficiency and throughput compared to user-space TUN interface handling in legacy VpnService.
• Lockdown Mode (Block Connections Without VPN): An operating system security state that blocks all non-VPN network traffic via kernel firewall rules (eBPF and iptables), preventing cleartext data leakage during tunnel reconnections.
• Bypass Allow-Lists: System apps (such as IMS telephony, carrier MMS, or emergency services) and explicitly designated applications can be configured to bypass the VPN tunnel even when lockdown mode is engaged.

Querying VPN Management Diagnostics via ADB

To inspect the current status of platform VPN profiles and management policies, connect your Android device with USB debugging enabled and execute:

adb shell dumpsys vpn_management

The command outputs active VPN management telemetry. A representative output appears as follows:

VpnManagementService:
  Current User: 0
  Provisioned Profiles:
    Package: com.wireguard.android
    Profile Type: IKEv2/IPsec PSK
    Server Address: vpn.corp.contoso.com
    User Identity: client_mobile_user
  Always-On Configuration:
    Package: com.wireguard.android
    Lockdown: true
    Lockdown Whitelist:
      - com.android.emergency
      - com.google.android.carrier
  Active Session:
    State: CONNECTED
    Interface: tun0
    Assigned Addresses:
      - 10.200.4.15/24
      - fd00:cafe::15/64
    DNS Servers:
      - 10.200.4.1
      - 10.200.4.2

Key architectural properties include:

• Profile Type: Indicates the cryptographic profile (e.g., IKEv2/IPsec with Pre-Shared Key, RSA Digital Signature, or EAP-MSCHAPv2).
• Lockdown: A boolean flag indicating whether the device drops all non-VPN traffic when the VPN is disconnected.
• Lockdown Whitelist: UIDs or package names permitted to communicate outside the VPN tunnel during lockdown conditions.
• Assigned Addresses and DNS: IP routing parameters injected by the VPN gateway into the local routing table.

Inspecting Legacy and Framework VPN State via dumpsys connectivity

While dumpsys vpn_management focuses specifically on modern platform profiles, the broader ConnectivityService dump tracks underlying TUN interface network agents and socket bindings:

adb shell dumpsys connectivity | grep -A 20 "VPN"

This command reveals network capabilities (e.g., TRANSPORT_VPN, NET_CAPABILITY_NOT_VPN), routing table IDs, and underlying physical transport networks (such as Wi-Fi or cellular) over which the tunnel is routed.

Verifying Always-On and Lockdown Policies via Settings

Administrators can query and audit always-on VPN settings programmatically using Android’s global settings provider:

Auditing Always-On Package Name

To check which package is designated as the system always-on VPN client:

adb shell settings get secure always_on_vpn_app

If an always-on VPN is active, the command returns the package identifier (e.g., com.wireguard.android). If none is configured, it returns null.

Auditing Lockdown State

To verify whether the operating system is instructed to block all non-VPN connections:

adb shell settings get secure always_on_vpn_lockdown

A return value of 1 indicates strict lockdown enforcement, while 0 indicates that standard egress fallback is permitted.

Auditing Lockdown Bypass Allow-List

To inspect packages permitted to bypass lockdown rules:

adb shell settings get secure always_on_vpn_lockdown_whitelist

Simulating VPN Disconnection and Testing Data Leaks

Security engineers and mobile application testers can simulate VPN dropouts to verify whether an application leaks unencrypted packets when the tunnel collapses:

# Check active interfaces
adb shell ip addr show tun0

# Trigger airplane mode or network disruption to test reconnect behavior
adb shell cmd connectivity airplane-mode enable
sleep 3
adb shell cmd connectivity airplane-mode disable

# Inspect vpn_management to monitor re-establishment logs
adb shell dumpsys vpn_management

Tracing VPN Runtime Handshakes in Logcat

To monitor dynamic IPsec security association (SA) negotiations, keepalive packets, and certificate validation errors during tunnel setup, filter logcat for Vpn and IpSecService tags:

adb logcat -s Vpn:V VpnManager:V IpSecService:V

By using dumpsys vpn_management alongside ADB settings commands, network administrators and security auditors can thoroughly inspect platform VPN profiles, validate lockdown enforcement, and guarantee secure communications across enterprise mobile deployments.