# Networking: Sotto alongside a commercial VPN

This page is for self-hosters who run a commercial VPN on their phone and want
to be sure it does not break the direct Sotto link. It explains what Sotto
needs from the network (very little), how to keep the phone-to-Mac path direct
when a VPN is active, and why Sotto deliberately does not bundle or depend on
any VPN of its own.

The short version: Sotto's link is iroh, an app-level peer-to-peer QUIC
connection dialed by the Mac's public key. It lives inside the app, not in the
operating system, so it never occupies Android's single system-VPN slot and it
is indifferent to whatever else you run for general traffic.

## Do I need a VPN?

No. To put it plainly: no VPN is required to use Sotto, none is bundled with
it, and none is assumed by the transport. The link's confidentiality, integrity, and
authenticity come entirely from iroh's QUIC/TLS session plus the NodeId
allowlist: every connection is end-to-end encrypted with TLS 1.3, authenticated
to a specific ed25519 public key, and admitted only if that key is on the Mac's
allowlist. Reaching your own home over that link does not require anonymizing
who you are to your own devices, so a VPN adds nothing to Sotto's security
posture.

An anonymizing VPN is still a perfectly reasonable thing to want for the rest of
your browsing. That is a separate, out-of-band user choice about your general
internet traffic, not about the Sotto link. If you run one, the rest of this
page keeps it from getting in Sotto's way. If you do not, there is nothing to
configure and you can stop reading here.

## Running a commercial VPN alongside Sotto

You can run any commercial VPN you like (or none) for general traffic and keep
the Sotto link working. There are two ways the two coexist:

- **Best path: exclude Sotto from the VPN.** Split-tunnel the Sotto app so its
  iroh traffic bypasses the VPN tunnel. iroh can then hole-punch a direct
  peer-to-peer path (or use your LAN), which is the lowest-latency route to the
  Mac. This is the recommended setup and is described in the next section.
- **Also fine: let Sotto ride the tunnel.** If you route Sotto through the VPN
  along with everything else, the link still works and is still fully
  encrypted. It just cannot hole-punch a direct path through the VPN's egress,
  so it falls back to the iroh relay, which forwards ciphertext only. You keep
  privacy and correctness; you give up some latency.

Nothing you choose here weakens the link. The relay never sees plaintext, and
the Mac still enforces its public-key allowlist on every connection, direct or
relayed. The only thing at stake is whether you get the fast direct path or the
slower relayed one.

## Split-tunnel the Sotto app on Android

Android's VPN support includes per-app split tunneling, which lets you list apps
that either use or bypass the active VPN. Excluding Sotto gives iroh a clear
shot at a direct path.

1. Open **Settings** and go to **Network and internet -> VPN** (the exact path
   varies by Android build and by your VPN provider's own app).
2. Open the **advanced settings** for your VPN connection or profile.
3. Find **Split tunneling** (some providers label it **Apps that use the VPN**
   or **Bypass VPN for selected apps**).
4. **Exclude Sotto** so its traffic bypasses the tunnel. Depending on the
   provider's wording you either remove Sotto from the "apps that use the VPN"
   list or add it to the "apps that bypass the VPN" list. The result is the
   same: Sotto's iroh connection goes direct.

Some VPN clients expose this under their own in-app settings rather than the
system VPN screen; check both if you do not see it.

### Watch out for Always-on VPN

An **Always-on VPN** with no per-app exclusion forces every app, Sotto
included, through the tunnel. When Sotto's traffic is pushed through the VPN
egress it cannot establish a direct hole-punched path to the Mac, so the link
falls back to the relay path instead of a direct one. It keeps working and
stays encrypted, but you lose the low-latency direct route. If you use
Always-on VPN, add a per-app exclusion for Sotto so the direct path is available
again. On builds that also offer **Block connections without VPN**, make sure
your Sotto exclusion still applies, or that setting can defeat the split tunnel.

<!-- historical-note:start -->
## Why Sotto dropped its old anonymizing-exit coupling

An earlier Sotto design treated a mandatory anonymizing exit (a Mullvad or
Tailscale style always-on tunnel) as part of reaching the Mac. That coupling
was removed for three reasons, recorded here so it is not reintroduced:

1. **It is not needed for the link's privacy.** The iroh connection is already
   end-to-end encrypted and authenticated to a specific public key, and the
   relay only ever forwards ciphertext. Anonymizing yourself to your own home
   devices buys nothing.
2. **It fought the app-level transport.** iroh runs inside the app over QUIC and
   uses no system-VPN slot. A mandatory, system-wide anonymizing VPN would
   collide with Android's single-VPN-slot model and add a hard dependency the
   self-host story should not carry. That is why Sotto no longer treats a
   required VPN as a transport dependency.
3. **It is orthogonal.** Anonymizing your general internet traffic is a
   legitimate preference about the rest of your browsing, not about the Sotto
   link. Users who want it run whatever VPN they like and exclude the Sotto app
   via split tunneling; users who do not lose nothing.

So any anonymizing exit is a user-side, optional decision, never a default,
dependency, or assumption in the transport. See `docs/specs/transport.md`
section 7 for the authoritative statement.
<!-- historical-note:end -->