How is everyone dealing with Android 17's "Nearby Devices" change?

Submitted ⁨⁨10⁩ ⁨hours⁩ ago⁩ by ⁨pHr34kY@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

https://lemmy.world/pictrs/image/526f113d-6ee0-49a3-bc9c-4542b8e199cd.jpeg

It took me a while to figure out why many of my self-hosted services were intermittently failing to connect on my phone after updating to Android 17. I eventually figured out there’s a new ACCESS_LOCAL_NETWORK permission which means the “Nearby devices” permission is now required to access devices on the same network subnet. For an avid self-hoster, this can be quite a bit.

I had my DNS configured so my public-facing server resolved to a local IP address when on my LAN. This meant that my web, immich, xmpp, NTP, jellyfin and DoH servers all resolved to a local IP address on wifi. On Android 17, it all broke without warning. No error messages. No asking for extra permissions. Just silent packet dropping.

I’ve solved it by configuring my public-facing services to resolve to my external (static) IP address, even when inside the network. I couldn’t make any internal services resolve to the external address (SMB, CUPS etc) because they are (obviously) not bound to my WAN interface.

I get why the change was made. A lot of apps were snooping around people’s networks to gather intel. A potentially massive privacy violation.

Has anyone else had this issue? Is this the cleanest solution?

original

Comments

Sort:hotnew top

giant_smeeg@feddit.uk ⁨8⁩ ⁨hours⁩ ago
Luckily grapheneos allows a hybrid approach so allows just the lan subnet permission without the wider nearby devices permission.

original
- pHr34kY@lemmy.world ⁨1⁩ ⁨hour⁩ ago
  I’m actually on GrapheneOS.
  
  I’ve found that you can deny “Network” permissions and permit “Nearby devices”. The app becomes LAN-only this way.
  
  original
  - curbstickle@anarchist.nexus ⁨4⁩ ⁨minutes⁩ ago
    You’re also handling bluetooth and wifi functionality with that permission, fyi.
    
    original
- NarrativeBear@lemmy.world ⁨7⁩ ⁨hours⁩ ago
  Hey can you let me know where I can find more info on this? I am running GrapheneOS as I was having this exact same issue as OP a few day back.
  
  On my browsers I have network access, but nearby devices was disabled.
  
  I checked my private dns settings and granted nearby devices access to my browsers, which allowed me to hit my local self-hosted services.
  
  Just wondering if there is a better way to achieve the same.
  
  original
curbstickle@anarchist.nexus ⁨10⁩ ⁨hours⁩ ago
Haven’t been brought to 17 yet thankfully.

My long term solution is to not use android. My short term solution will likely be to use android even less, and be even more pissed at Google.

original
- femtek@lemmy.blahaj.zone ⁨7⁩ ⁨hours⁩ ago
  Solution is to just enable the permission on apps that need it.
  
  original
  - curbstickle@anarchist.nexus ⁨7⁩ ⁨hours⁩ ago
    The solution is to avoid google going forward, for many reasons.
    
    original
    -> View More Comments
  - pHr34kY@lemmy.world ⁨1⁩ ⁨hour⁩ ago
    It would be annoying to do that for everyone who uses my wifi.
    
    I found that “Conversations” (XMPP) was blocking a connections even when the permission was enabled. I suspect Android no longer allows connections on port 5xxx on a local network. It works fine when the IP is external.
    
    original
- superglue@lemmy.dbzer0.com ⁨5⁩ ⁨hours⁩ ago
  How is this added permission not a good thing? Surely adding a local network only permission is a positive, you can allow apps internet permission and decline them access to your local services.
  
  original
  - curbstickle@anarchist.nexus ⁨5⁩ ⁨hours⁩ ago
    The permission structure sucks.
    
    Its a silent drop (no errors are returned), webview breaks connected to WiFi even without a local resource being requested, it lives inside nearby_devices so giving permission there includes this (and gives a broader spectrum of access such as Bluetooth and WiFi).
    
    Its just shuffling the problem around.
    
    Also, fuck Google.
    
    original
- JetpackJackson@feddit.org ⁨10⁩ ⁨hours⁩ ago
  Linux phone?
  
  original
  - Colloidal@programming.dev ⁨10⁩ ⁨hours⁩ ago
    Flip phone
    
    original
    -> View More Comments
frongt@lemmy.zip ⁨9⁩ ⁨hours⁩ ago
Why not just grant the permission to the apps?

original
- NarrativeBear@lemmy.world ⁨5⁩ ⁨hours⁩ ago
  I’m in the same boat as well, for some reason my music apps can’t seem to see my Google smart speakers, but strangely they can see my Nvidia shield and cast to that.
  
  Looked through my app permissions I honestly can’t see anything out of the ordinary or plainly obvious. Both my speakers and android TV (shield) are on separate segment VLAN.
  
  As for granting the permission, I generally like to grant on a app by app basis, lots of apps ask for internet access as a example but don’t actually require it to function. All my game apps for example are completely offline.
  
  original
noxypaws@pawb.social ⁨6⁩ ⁨hours⁩ ago
confused me when I suddenly had to give Firefox this permission to access websites on my LAN

More ways to control what can access what is a welcome change for me

(I’m on GrapheneOS but yeah, Android 17 based now)

original
Decronym@lemmy.decronym.xyz ⁨3⁩ ⁨hours⁩ ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters

DHCP Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network

DNS Domain Name Service/System

ISP Internet Service Provider

[Thread #115 for this comm, first seen 27th Sep 2026, 20:10] [FAQ] [Full list] [Contact] [Source code]

original
NarrativeBear@lemmy.world ⁨9⁩ ⁨hours⁩ ago
Ran into this issue a few days ago, exactly the same way you described.

I am on GrapheneOS and figured it was something to do with a a setting where it’s blocking network access for my specific browser app. After reading your post I see it’s a android 17 feature.

Checked all the settings in my browsers related to DNS at first and was stumped for a bit, until I flipped on the nearby device setting and everything worked.

I also looked into the DNS settings under Network & Internet > Private DNS. Make sure your phone is using your local networks DNS server. Just make sure to understand the implications of changing this (especially when you disconnect from you’re home networks DNS). Also making sure your home DNS is not defaulting to your ISP DNS.

original
- pHr34kY@lemmy.world ⁨1⁩ ⁨hour⁩ ago
  I self-host a DoH/DoT server and my local DHCP advertises it to local clients. It’s kinda cool because android phones on my wifi will use DoT when private DNS is set to “automatic”.
  
  Private DNS sort-of broke while I was tinkering with internal/external IP addresses for nearby devices. It wouldn’t always connect when I specified my external IP (despite being available externally). I made it IPv6-only too. It wouldn’t be the first time something couldn’t handle it.
  
  original
oha@lemmy.pobierz.net ⁨5⁩ ⁨hours⁩ ago
Haven’t noticed it yet because my services are on a different network than my clients

original
RickyRigatoni@piefed.zip ⁨7⁩ ⁨hours⁩ ago
My phone is still on 14 so uuuhhh I’m fine I guess?

original
avidamoeba@lemmy.ca ⁨7⁩ ⁨hours⁩ ago
Thanks for the heads up. This would have been a nasty surprise followed by unknown duration of hair pulling.

original
fleem@piefed.zeromedia.vip ⁨7⁩ ⁨hours⁩ ago
this is how they know who is even looking at stuff on their own network. holy shit

original
SkyNTP@lemmy.ml ⁨8⁩ ⁨hours⁩ ago
I had this issue in firefox. And only firefox. Was pulling my hair for hours. Wish I had been warned.

Anyway I just gave firefox the permission and the issue was resolved. Native apps seem unaffected. Which makes me think maybe this is an opt in setting right now?

original
- pHr34kY@lemmy.world ⁨1⁩ ⁨hour⁩ ago
  Native apps all have a backwards-compatible setting so it’s allowed by default. That will surely get dropped when Google bumps the minimum Android target API so newly published apps need to explicitly configure it.
  
  I actually went through my apps list and disabled nearby devices for all the apps that don’t need it. It’s a good security measure. I just don’t like how it was rolled out.
  
  original
possiblylinux127@lemmy.zip ⁨7⁩ ⁨hours⁩ ago
Do you have any network segmentation is all your stuff on the same lan?

You also could try IPv6 public or private addresses

original
- pHr34kY@lemmy.world ⁨16⁩ ⁨minutes⁩ ago
  I’ve been on IPv6 years before Google turned it on. My ISP gave me a /48 and I’ve got different subnets for my WAN, LAN and guest LAN. I have a 4-port NIC so I could put a different subnet on each port.
  
  I didn’t mention it in my first post, but I only made AAAA DNS entries for my internal stuff. I just enable IPv4 for the few services that actually need it.
  
  original
ReignOfTerror@lemmy.world ⁨9⁩ ⁨hours⁩ ago
Took me about an hour of reconfiguring everything in my network and still not having my phone load the damn page to finally try it on my desktop and it worked flawlessly, rebooted my phone and it finally gave me the pop up in the picture. So stupid.

original
Lenna@piefed.ca ⁨6⁩ ⁨hours⁩ ago

I had my DNS configured so my public-facing server resolved to a local IP address when on my LAN. This meant that my web, immich, xmpp, NTP, jellyfin and DoH servers all resolved to a local IP address on wifi.

I unfortunately don’t have an answer to your question since I’m not on Android 17, but I do want to ask about this part. What’s the benefit of this? Does it improve speed when streaming on Jellyfin?

original
- pHr34kY@lemmy.world ⁨1⁩ ⁨hour⁩ ago
  Routing between two interfaces on the same NIC takes nanoseconds. You wouldn’t notice a performance difference.
  
  When I first set it up, I didn’t have a static IP address, so it would not be great when it changed. I also want my server to remain reachable locally if my internet goes down. I had different firewall/ACL rules for wifi too. For example, some of my internal websites only prompt for a login if you’re outside the network.
  
  IPv6 has been awesome here. I have my server and clients on different /64 subnets in the same /48 block. The nearby devices on Android assumes only the same /64 is local.
  
  original
- wholookshere@lemmy.blahaj.zone ⁨5⁩ ⁨hours⁩ ago
  Not OP but I do the same for two reasons.
  
  A) it eleimitaes my ISP traffic. It doesn’t have to go out to my router, to come back in on the public IP. They can’t track what never hits them.
  
  B) I also have completely internal services. So the DNS entries are internal only. Can’t map my internal network publicly.
  
  original
  - frongt@lemmy.zip ⁨32⁩ ⁨minutes⁩ ago
    A router shouldn’t be sending that traffic outside. It should already have routes to send it right back, either regular or NAT rules.
    
    original
  - pHr34kY@lemmy.world ⁨57⁩ ⁨minutes⁩ ago
    I’ve also got a completely different DNS config for WAN and LAN traffic. WAN devices can only resolve PTR records for my mail server. My LAN devices have DDNS so internally they a get allocated DNS entries by hostname. Even my guest network has a different config for isolation.
    
    They definitely all need to be kept separate.
    
    original
  - Rai@lemmy.dbzer0.com ⁨4⁩ ⁨hours⁩ ago
    Would you have any recommendations to resources where I can read about setting something like this up? I’ve recently picked up a managed switch and set up a computer to act as a router, and I’ve been learning how VLANs be. I don’t have things fully working on my home network yet, though, but I’m very interested!
    
    original
    -> View More Comments
  - electric_nan@lemmy.ml ⁨4⁩ ⁨hours⁩ ago
    Do your apps complain about SSL certs?
    
    original
    -> View More Comments
unitedwithme@lemmy.today ⁨9⁩ ⁨hours⁩ ago
My solution is LineageOS as it functions on dozens if not a couple hundred phones. Rocking a One+ currently.

original
- Bazoogle@lemmy.world ⁨4⁩ ⁨hours⁩ ago
  I am also a LineageOS user, though this feature seems like a good feature. You can block apps from being able to access your local network, which seems like a welcome restriction.
  
  original

Fewer Letters	More Letters
DHCP	Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network
DNS	Domain Name Service/System
ISP	Internet Service Provider