# VPN + Firewall on Android **URL:** https://discuss.privacyguides.net/t/vpn-firewall-on-android/17097 **Category:** Questions **Created:** 2024-02-27T10:52:54Z **Posts:** 15 ## Post 1 by @0x1 — 2024-02-27T10:52:54Z Is there some application beside RethinkDNS with a functionality of VPN + Firewall for non-rooted Android? Reason I’m asking is I tried RethinkDNS, Mullvad’s wireguard config works fine, but a bunch of apps now acting strange. One has to be refreshed twice in order to load content, it shows an error on the first try. Another one taking ages to load, and one chat app randomly doesn’t show an online presence of contact, but sends messages normally. I’m aware all of these issues are network related, yet Rethink’s firewall doesn’t have any rules active, logs showing network connections were established. So before deep diving into debugging and trying to solve all of these issues, I would like to know is there any other solution which offers VPN connection and firewall in the same application? --- ## Post 2 by @Irrigate0583 — 2024-02-27T13:02:33Z To better understand your situation, what do you want to achieve by installing a firewall app on your android phone? Are you trying to prevent inbound or outbound traffic? The normal consensus afaik is that Android and iPhone don’t need a firewall to protect against inbound threads as the build-in firewall is already set to block all inbound connections. For outbound connections GrapheneOS has a per app network toggle preventing all network traffic for that app. I’t only available for Pixel phones though. --- ## Post 3 by @0x1 — 2024-02-27T13:46:17Z > To better understand your situation, what do you want to achieve by installing a firewall app on your android phone? I need to install some proprietary apps that connect to the network, but I tested them without the internet, and they worked fine, so I want to block their access completely. GrapheneOS and Pixel will be considered, the next time I change the phone, but for now, I’m looking a solution for the current device which is not Pixel. I’m using Mullvad 24/7, so I asked authors if they ever plan to implement firewall in their app, but got a negative answer. --- ## Post 4 by @ignoramous — 2024-02-27T18:40:09Z _rdns dev here_ > [@Irrigate0583](#): > > the build-in firewall is already set to block all inbound connections. There isn’t an in-bound firewall in the “traditional firewall” sense. For the simple reason that _NAT traversal_ ([ref](https://twitter.com/ekr ____ /status/1649074377550622721)) works on Android, you know in-bound firewall can be hole-punched (not a good thing or a bad thing, but it is _a_ thing you have no control over). Using a VPN-based firewall like Rethink does block some hole-punching techniques (again, some consider this a feature, others a bug). And for when the hole-punching goes through, Rethink registers it in the _Network Log_. > [@Irrigate0583](#): > > For outbound connections GrapheneOS has a per app network toggle Can’t block IPs and domains, or view outgoing connections. Sadly, this feature, which is actually a _better_ way than using a VPN like Rethink to block _outgoing_ Internet connections, isn’t a substitute for a network monitor / firewall. See this discussion on GrapheneOS forums: [RethinkDNS needed on GrapheneOS? - GrapheneOS Discussion Forum](https://discuss.grapheneos.org/d/7930-rethinkdns-needed-on-grapheneos/8) --- ## Post 5 by @ignoramous — 2024-02-27T18:41:50Z > [@0x1](#): > > Reason I’m asking is I tried RethinkDNS, Mullvad’s wireguard config works fine, but a bunch of apps now acting strange. Does `STOP` / `START`ing the app back up again make it work? We’ve fixed a tonne of issues ([ex](https://github.com/celzero/rethink-app/issues/1097)) wrt WireGuard in the upcoming version, `v055b`, which is almost ready for a release. --- ## Post 6 by @LoSee21 — 2024-02-28T14:40:09Z The things you want are All in Invizible Pro/Lite see [https://invizible.net](https://invizible.net) , hope this helps. --- ## Post 7 by @Irrigate0583 — 2024-02-28T17:28:14Z > [@ignoramous](#): > > Can’t block IPs and domains, or view outgoing connections. Sadly, this feature, which is actually a _better_ way than using a VPN like Rethink to block I’m not suggesting the GOS network toggle as an alternative for network monitoring. OP is asking for an efficient way to prevent network traffic for an app and the GOS network toggle is the most efficient way at that. Traditional sense or not, android has a build in firewall [Frequently Asked Questions | GrapheneOS](https://grapheneos.org/faq#firewall) --- ## Post 8 by @0x1 — 2024-02-28T22:14:53Z @ignoramous You made a really nice and useful app, looking forward to the new update. Keep up the good work! I noticed a significant improvement when I switched from “System DNS” to “Other DNS” and added Mullvad’s DoH DNS (suggestion to add it beside those currently offered). I’m trying to understand what DNS device uses when “System DNS” is selected? The device is connected to Wi-Fi, which has a local DNS in a form of AdGuard Home. Wireguard is connected, but I assume the device still uses a local DNS, considering it started working when DNS was switched? Also, as I’m trying to replace Mullvad’s app with this one by importing 20+ wireguard configs, is there any “central” place where I could exclude an app from going over a VPN connection, or I would have to go into every config, add all applications and then remove desired? As importing these configs will take some time, does a backup/restore functionality includes them, so I don’t have to import them again for example if I delete the app temporary? @LoSee21 thanks! I’m going to check it out. --- ## Post 9 by @ignoramous — 2024-02-29T22:55:56Z > [@0x1](#): > > what DNS device uses when “System DNS” is selected In Rethink, _System DNS_ is Network (wifi/mobile) provided DNS. > [@0x1](#): > > Wireguard is connected, but I assume the device still uses a local DNS Yes, Rethink continues to use user-selected DNS even when proxies are active. In the upcoming version, `v055b`, Rethink will proxy DNS over WireGuard and other active proxies where possible. There’s also provision in `v055b` to use WireGuard configured DNS itself. > [@0x1](#): > > I would have to go into every config, add all applications and then remove desired? In Rethink, you cannot add the same app to different WireGuard configurations. You’ll have to re-add them every time. I know this is annoying, and we hope to fix this entire UX around WireGuard someday. > [@0x1](#): > > backup/restore functionality includes them Rethink encrypts all WireGuard configurations with device-specific, unexportable encryption key. This unfortunately also means, they cannot be meaningfully backed up. --- ## Post 10 by @0x1 — 2024-03-02T18:11:57Z I’ve tested the app for a couple of days, and it’s really nice. Main annoyances for me are around VPN/wireguard, so hopefully some of these will be fixed in the upcoming releases. > [@ignoramous](#): > > In Rethink, you cannot add the same app to different WireGuard configurations. You’ll have to re-add them every time. I know this is annoying, and we hope to fix this entire UX around WireGuard someday. This is probably the biggest deal breaker currently. Switching VPN locations/profiles is not smooth like the other parts of the app. I have no technical knowledge on the topic, so I will just write my personal opinion. It would be way better to have an option which a standard VPN app has, once connected, all the apps going through Wireguard connection except those explicitly excluded. So as soon as the profile is changed, there’s no need to add applications again. The same thing to be applied once a new app is installed while VPN connection is active, because currently it needs to be added manually. In this scenario, I noticed a strange behavior. Proxy was active, I installed a new app, went to add it in wireguard profile, but the app couldn’t be found even after clicking refresh button. It appeared after it was opened for the first time. > [@ignoramous](#): > > Rethink encrypts all WireGuard configurations with device-specific, unexportable encryption key. This unfortunately also means, they cannot be meaningfully backed up. Is there any possibility this might change in the future? I understand it might not be used as often, but it would come quite handy once switching device or if app requires to be reinstalled. --- ## Post 11 by @ignoramous — 2026-01-02T23:14:10Z > [@0x1](#): > > This is probably the biggest deal breaker currently To unbreak this deal, in `v055v`, the upcoming release due soon-ish, Rethink will let users add the same app to multiple WireGuard tunnels. Internally, Rethink will use the active one and if there are multiple, it’ll load balance among them. > [@0x1](#): > > would be way better to have an option which a standard VPN app has, once connected, all the apps going through Wireguard connection except those explicitly excluded In Rethink, _Simple_ mode WireGuard pretty much works like other VPN apps (that only allow a single active WireGuard at a time). While in _Advanced_ mode, since `v055e` (released over 20+ months ago), turning ON _Always-on_ in \*Configure → Proxy → Setup WireGuard → _Advanced → (some WireGuard config)_ will make it route all apps unless explicitly _excluded_ (if _Configure → Apps → (some app) → Never proxy this app_ is turned ON). > [@0x1](#): > > there any possibility this might change in the future? I Yeah, going against all security good practices, we’ve changed this behaviour in [`v055u`](https://github.com/celzero/rethink-app/releases/tag/v0.5.5u) (the current version) and let users backup the imported WireGuard configurations, which could be later restored. --- ## Post 12 by @any1 — 2026-01-03T13:38:53Z > **Offtopic** > > How does your versioning scheme work? --- ## Post 13 by @Average_Joe — 2026-03-14T16:22:43Z > [@ignoramous](#): > > While in _Advanced_ mode, since `v055e` (released over 20+ months ago), turning ON _Always-on_ in \*Configure → Proxy → Setup WireGuard → _Advanced → (some WireGuard config)_ will make it route all apps unless explicitly _excluded_ (if _Configure → Apps → (some app) → Never proxy this app_ is turned ON). How does your firewall app compare with Netguard for Android? > > > A simple way to block access to the internet per applicatio... --- ## Post 14 by @ignoramous — 2026-03-14T16:43:18Z > [@Average_Joe](#): > > How does your firewall app compare with Netguard Favourably in terms of features. The major issue is NetGuard’s lack of support for Android’s “VPN Lockdown mode”. > NetGuard doesn’t support Android’s leak blocking so it can’t be used without having leaks. It’s a NetGuard issue and isn’t GrapheneOS specific. They document the limitation. > > RethinkDNS is compatible with leak blocking and all around better, although it’s still far from perfect. RethinkDNS supports using a WireGuard VPN or multiple chained WireGuard VPNs instead of having to choose between the filtering or a VPN. NetGuard tries to support forwarding via SOCKS but it’s problematic since it lacks authentication for where it’s forwarding and not much supports it in practice. > > source: [GrapheneOS on their forums](https://discuss.grapheneos.org/d/18718-when-using-netguard-firewall-app-i-cant-access-any-internet-at-all) ([mirror](https://archive.vn/9fJid)). I am also not sure if NetGuard’s DNS stub resolver supports ECH (Encrypted Client Hello via HTTPS/SVCB records) or can encrypt DNS. Though, _Private DNS_ (available on Android 9+) can help overcome any such limitation. I had reached out to Marcel about various things related to this (3+ years ago), but it appears like Marcel isn’t accepting code contributions and NetGuard is effectively in maintenance mode. --- ## Post 15 by @ignoramous — 2026-03-14T17:34:26Z > [@any1](#): > > How does your versioning scheme work? There’s no logic behind it. And some folks don’t like that at all: > **[Why is the versioning of this application so weird? · celzero rethink-app ·...](https://github.com/celzero/rethink-app/discussions/1646)** > > As the title states: why is the versioning so odd/weird? I didn't see this kind of versioning before, where you use semantic versioning + a letter. Why not keeping it 'normal' semantic versioning? ...