Networking – VPN Issue – successful connection through mobile (iPhone Hotspot) but unsuccessful through home WIFI

AnyConnect has an option (default) to run in full-tunnel mode, which routes all traffic (including local networks) over the VPN tunnel. This effectively disconnects you from the LAN (and other LAN clients) when the VPN client is active.

The Windows Network Location Awareness (NLA) service uses quite a few characteristics of the network an interface is connected to in order to determine if it's been connected to that network before. The fact Windows is not remembering your choice of firewall profile indicates that there are key differences between each "iteration" of your phone's Wi-Fi hotspot. (Your work's Wi-Fi on the other hand isn't changing between connections in regard to these characteristics which is why you only needed to put it into the "Work" firewall profile the first time.)

There are options through Group Policy to control how NLA categorizes unidentified networks, however you're running the Home edition of Windows which doesn't have Group Policy (and to my knowledge the necessary settings can't be configured directly through the Registry).

Therefore I can offer you two alternative solutions:

Option 1: Don't fight it. Create the firewall rules you need in the Public firewall profile. Because your phone's hotspot will be assigned the public firewall profile by default, the connection to your WAMP services will work without any additional config changes each time you connect to it.

Option 2: Identify which characteristic(s) of your phone's Wi-Fi is making each connection "unique" and prevent it from changing...if you can. Based on the fact your phone uses a new SSID each time you connect I'm doubtful this option will work since I assume you can't control that. But if you want to try, here are the characteristics NLA uses to identify a network according to this Microsoft TechNet blog post:

• Presence of a Domain Controller
• Bandwidth
• Internet Connectivity
• Primary DNS Suffix
• DC Authenticated (i.e. machine is authenticated to a DC via the network interface)
• Host IP address
• Subnet Mask
• Subnet IP address
• Default Gateway IP address
• WINS server
• SSID
• Default Gateway MAC address
• 802.1x Authentication status

Documentation is a bit scant on exactly how and in what combination NLA uses these characteristics to decide a network is unique (e.g. the fact your host gets a different IP address isn't sufficient to make NLA consider the network "new"), so you may have to do some experimenting.