My solution is LineageOS as it functions on dozens if not a couple hundred phones. Rocking a One+ currently.

I am also a LineageOS user, though this feature seems like a good feature. You can block apps from being able to access your local network, which seems like a welcome restriction.

Took me about an hour of reconfiguring everything in my network and still not having my phone load the damn page to finally try it on my desktop and it worked flawlessly, rebooted my phone and it finally gave me the pop up in the picture. So stupid.

Why not just grant the permission to the apps?

Relatedly, I think this is why Google Home and casting to Chromecast have stopped working reliably on my phone. Anyone figure those out? I’ve already tried granting permissions. Or it may be something GrapheneOS is doing.

I’m in the same boat as well, for some reason my music apps can’t seem to see my Google smart speakers, but strangely they can see my Nvidia shield and cast to that.

Looked through my app permissions I honestly can’t see anything out of the ordinary or plainly obvious. Both my speakers and android TV (shield) are on separate segment VLAN.

As for granting the permission, I generally like to grant on a app by app basis, lots of apps ask for internet access as a example but don’t actually require it to function. All my game apps for example are completely offline.

IIRC you can’t grant the permission if the app doesn’t explicitly declare it in its manifest. I doubt most devs would care unless access to local network is required for app’s functionality on typical user’s setup (e.g. if it’s a companion app for some device).

You can with ADB, but yes that’s obnoxious

Ran into this issue a few days ago, exactly the same way you described.

I am on GrapheneOS and figured it was something to do with a a setting where it’s blocking network access for my specific browser app. After reading your post I see it’s a android 17 feature.

Checked all the settings in my browsers related to DNS at first and was stumped for a bit, until I flipped on the nearby device setting and everything worked.

I also looked into the DNS settings under Network & Internet > Private DNS. Make sure your phone is using your local networks DNS server. Just make sure to understand the implications of changing this (especially when you disconnect from you’re home networks DNS). Also making sure your home DNS is not defaulting to your ISP DNS.

Two websites that help me sanity check myself

• Dnscheck.tools
• dnsleaktest.com

I self-host a DoH/DoT server and my local DHCP advertises it to local clients. It’s kinda cool because android phones on my wifi will use DoT when private DNS is set to “automatic”.

Private DNS sort-of broke while I was tinkering with internal/external IP addresses for nearby devices. It wouldn’t always connect when I specified my external IP (despite being available externally). I made it IPv6-only too. It wouldn’t be the first time something couldn’t handle it.

I had this issue in firefox. And only firefox. Was pulling my hair for hours. Wish I had been warned.

Anyway I just gave firefox the permission and the issue was resolved. Native apps seem unaffected. Which makes me think maybe this is an opt in setting right now?

I think Firefox also gave me the first clue that something was up.

Native apps all have a backwards-compatible setting so it’s allowed by default. That will surely get dropped when Google bumps the minimum Android target API so newly published apps need to explicitly configure it.

I actually went through my apps list and disabled nearby devices for all the apps that don’t need it. It’s a good security measure. I just don’t like how it was rolled out.

Luckily grapheneos allows a hybrid approach so allows just the lan subnet permission without the wider nearby devices permission.

Hey can you let me know where I can find more info on this? I am running GrapheneOS as I was having this exact same issue as OP a few day back.

On my browsers I have network access, but nearby devices was disabled.

I checked my private dns settings and granted nearby devices access to my browsers, which allowed me to hit my local self-hosted services.

Just wondering if there is a better way to achieve the same.

I’m actually on GrapheneOS.

I’ve found that you can deny “Network” permissions and permit “Nearby devices”. The app becomes LAN-only this way.

Thanks for the heads up. This would have been a nasty surprise followed by unknown duration of hair pulling.

My phone is still on 14 so uuuhhh I’m fine I guess?

Time flies… We are already 3 versions behind xD ! I don’t remember why, but there was something with version 16 that made me reluctant to go any further.

Bit change for sure, and not beeing able to downgrade anymore I guess ! Also the more you upgrade your OS version, slower your older phone gets ^^".

Also their design change every year and the need to find all your advanced option hidden somewhere else… Kinda tired from this hide and seek game !

Do you have any network segmentation is all your stuff on the same lan?

You also could try IPv6 public or private addresses

I’ve been on IPv6 years before Google turned it on. My ISP gave me a /48 and I’ve got different subnets for my WAN, LAN and guest LAN. I have a 4-port NIC so I could put a different subnet on each port.

I didn’t mention it in my first post, but I only made AAAA DNS entries for my internal stuff. I just enable IPv4 for the few services that actually need it.

Ah, that makes sense

Side note: you don’t need multiple ports to have multiple subnets. (You can just use vlans)

this is how they know who is even looking at stuff on their own network. holy shit

confused me when I suddenly had to give Firefox this permission to access websites on my LAN

More ways to control what can access what is a welcome change for me

(I’m on GrapheneOS but yeah, Android 17 based now)

I had my DNS configured so my public-facing server resolved to a local IP address when on my LAN. This meant that my web, immich, xmpp, NTP, jellyfin and DoH servers all resolved to a local IP address on wifi.

I unfortunately don’t have an answer to your question since I’m not on Android 17, but I do want to ask about this part. What’s the benefit of this? Does it improve speed when streaming on Jellyfin?

Not OP but I do the same for two reasons.

A) it eleimitaes my ISP traffic. It doesn’t have to go out to my router, to come back in on the public IP. They can’t track what never hits them.

B) I also have completely internal services. So the DNS entries are internal only. Can’t map my internal network publicly.

Do your apps complain about SSL certs?

Traefik serves DNS challenge certificates

Nope. SSL certs are pinned to the hostname, not the IP address. I can change the IP address in DNS and it will still work.

Ahh, OK I see. I don’t know why I didn’t realize that before.

Would you have any recommendations to resources where I can read about setting something like this up? I’ve recently picked up a managed switch and set up a computer to act as a router, and I’ve been learning how VLANs be. I don’t have things fully working on my home network yet, though, but I’m very interested!

I’ll admit I dont have one.

I’ve been meaning to write one myself on how I use things. As how I’ve gotten it to work has really been from a decade of doing this professionally. And I have opnions.

I’ll for sure post links to this community when I have them.

I don’t know how the others set theirs up, but I use “views” in bind 9 kb.isc.org/docs/aa-00851

Essentially, the DNS I run on a router-like box much like you describe uses a different database depending on whether you query from an internal IP address or a public address. For me, the advantages are that I can let devices on my local network declare their own names to DHCP and enter them in DNS without worrying about the outside world. Mu internal network doesn’t crash if my ISP changes my address, Certbot happily requests certs for any site with a public address, and that cert works seamlessly on the corresponding internal address, no wildcards or DNS challenge required.

That’s so sick! That’s definitely above my skill level at the moment, but I will save this for when I’m more knowledgeable—thank you much!

What are you running on your router? If you use opnsense, I’m pretty sure it has a GUI for DNS stuff. Been a while since I’ve used it.

If you use pihole for DNS, you can set it up in there too, but it’s not the same process as most other systems.

I right now have an ISP router, but I’ve got an OpenWRT Pi5 and some Lenovo Tinys I can install OpnSense on when I know more things about stuff!

That’s exactly what I’m doing.

If you host your own internal dns server like a pihole, you can just add them in as local names.

Careful of something called split brain dns though.

For reference, I use AWS Route53 to host my dns domain publicly and internally I use pihole and Traefik. Traefik deals with getting certificates for my internal resources.

Thank you! I currently do run a PiHole, which I’ve been running for like six years? I really need to get that updated as well hahaha. I’ll look into doing it they way!

I’ve also got a completely different DNS config for WAN and LAN traffic. WAN devices can only resolve PTR records for my mail server. My LAN devices have DDNS so internally they a get allocated DNS entries by hostname. Even my guest network has a different config for isolation.

They definitely all need to be kept separate.

A router shouldn’t be sending that traffic outside. It should already have routes to send it right back, either regular or NAT rules.

It still has to hit the ISP router?

Depends on the IP. I have a static block, so the other IPs have to hit the public IP and come back, because the router doesn’t hold those IPs, itnjust forwards the traffic.

Routing between two interfaces on the same NIC takes nanoseconds. You wouldn’t notice a performance difference.

When I first set it up, I didn’t have a static IP address, so it would not be great when it changed. I also want my server to remain reachable locally if my internet goes down. I had different firewall/ACL rules for wifi too. For example, some of my internal websites only prompt for a login if you’re outside the network.

IPv6 has been awesome here. I have my server and clients on different /64 subnets in the same /48 block. The nearby devices on Android assumes only the same /64 is local.

Haven’t noticed it yet because my services are on a different network than my clients

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters DHCP Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network DNS Domain Name Service/System ISP Internet Service Provider NAT Network Address Translation PiHole Network-wide ad-blocker (DNS sinkhole) XMPP Extensible Messaging and Presence Protocol (‘Jabber’) for open instant messaging

[Thread #115 for this comm, first seen 27th Sep 2026, 20:10] [FAQ] [Full list] [Contact] [Source code]

I gave permission to Firefox, but honestly most of my services weren’t affected because I connect to 99% of them via Tailscale which doesn’t seem to cause the permission issue. (Yes that was an absolute nightmare to figure out why only one service was failing to connect)

Why are permissions so damn confusing? I say this as someone who knows why permissions are needed, such as location to find nearby devices. But why must we keep track of “permission X is for thing unrelated to X” in our heads? Now I haven’t tried to make a permissions system for the masses, so I guess I can’t say too much, but it doesn’t seem that difficult to just make the permission name relate to what it does and provide a short synopsis for it.

It’s because people keep finding ways around them and they evolve in nonsensical ways.

Android is run by the stupidest people you can imagine. They make these decisions like MBAs

Because it makes the process harder for app developers who don’t fall in line with Google’s “Don’t Be Evil” motto, while big corpos can ship the worst possible data harvesting/gambling/crypto scam/etc apps with nothing more than a slap on the wrist.

Also why they’re cracking down on non-play store apps.

Google tries to make permissions easy to understand for end users, instead of making them detailed for tech people. The permissions “nearby devices” covers any method for reaching out to nearby devices. Previously, you had the permission “location”, which contained some ways of local access.

An app requiring nearby devices to connect to a bluethooth or other nearby device is more clear than an application requesting your location.

Devices in the LAN are also considered devices near you. For dumb end users, silently blocking it is more secure than showing a dialog, as people are dialog fatigued today.

Oooh. I haven’t updated it yet. Good to know as I will likely run into the same issue.

Are you on a vpn?

Nope. I don’t use them. Especially not to communicate with a server in the same room.

It works but I wouldn’t call it the cleanest solution, more a workaround. As far as I know only apps targeting SDK 37 are affected, older apps still get the permission implicitly. So the proper way would be to just grant “Nearby devices” to the apps that need it e.g. Immich or Jellyfin and if an app doesn’t ask for it that’s actually a bug and worth reporting, because it should request the permission as soon as the server resolves to a local IP. I also find the “Nearby Devices” title a bit misleading for apps that only need it to reach your own server, but on the other side it gives a somehow proper hint what the permission actually allows.