[APP][6.0+] RethinkDNS: Anti-Censorship + Adblocker + Firewall [open source] [no root]

Search This thread

ignoramous

Member
Sep 22, 2012
38
21
Thank you very much for this app! I'm now able to capture those ip addresses of system apps. However, I always get a blank screen for network logs or dns logs . I have to close the app so that I can see the logs. Seems that it is also the same with configure firewall.
txpQH6d

jGcp6k5

rf3mJx9

That sounds like a strange bug. We haven't explicitly fixed the issues you're facing, but we are releasing an update with some stability fixes (that avoids background crashes) to PlayStore today (should be live in about 2 to 3 days).

It'll soon be uploaded to our website and github, too. Look for version 0.4.4.


It's a great idea behind this app. Kudos to developers
However I am facing the following problem
- Sometimes when I try to configure firewall to block certain app it freezes and returns to homepage and when I try to access firewall again it shows blank page.
I need to clear app data again in order for the app to work properly
- Also dns and firewall apps do not identify all apps. It shows unknown
it would also be convenient to have options to block the app or configure it through logs.
Hope to see the issues resolved in future versions
Thanks
Yes, adding firewall/block rules from network logs and DNS logs is upcoming in the next release (0.4.5), likely by Friday, September 11.

Re: Clear data bug: Yes, that's a silly one which we have fixed in 0.4.4 (will be uploaded to website and github in 24hrs from now) and probably in PlayStore in two to three days from today.

---
 

Techdroid20

Member
Oct 17, 2014
8
4
Hi
I am still facing problems in using a custom dns server such as adguard or any other server.
The connection breaks and I am not able to connect to some sites while some others work.
Is there any bug??
 

ignoramous

Member
Sep 22, 2012
38
21
your app is awesome,Thank You.
Is there any app like that for PC too? like windows or dns like that

Hi there. Thanks for your kind words. The app is lacking a lot of features but the next release hopefully bridges that gap a bit.

As for PC and other platforms: No, we aren't building for those as our focus right now remains on Android.

https://glasswire.com is a similar product for Windows but they're not free or open-source, afaik.

Mac has LuLu Firewall (open-source): https://objective-see.com/products/lulu.html

Linux has OpenSnitch (free and open-source): https://github.com/evilsocket/opensnitch
 

ignoramous

Member
Sep 22, 2012
38
21
Hi
I am still facing problems in using a custom dns server such as adguard or any other server.
The connection breaks and I am not able to connect to some sites while some others work.
Is there any bug??

Hi there. That's strange. Are you using the "Block any app not in use" firewall setting? That setting is too aggressive and may seem to "break the connections" pretty often.

If not, it could be that adguard's DNS itself was down?
 

Techdroid20

Member
Oct 17, 2014
8
4
Hi there. That's strange. Are you using the "Block any app not in use" firewall setting? That setting is too aggressive and may seem to "break the connections" pretty often.

If not, it could be that adguard's DNS itself was down?

Yes I am using the setting as mentioned by you.
I tried different times using adguard or clean browsing dns
But when I am browsing using Chrome or Firefox some of the sites are not connecting.

Should I disable the above setting or perform some other option after adding the servers.
Also the latency is also high.
But I never got this issue using server through private dns.

Please inform
 

bilalrajput

Senior Member
Feb 8, 2015
148
7
Hi there. Thanks for your kind words. The app is lacking a lot of features but the next release hopefully bridges that gap a bit.

As for PC and other platforms: No, we aren't building for those as our focus right now remains on Android.

https://glasswire.com is a similar product for Windows but they're not free or open-source, afaik.

Mac has LuLu Firewall (open-source): https://objective-see.com/products/lulu.html

Linux has OpenSnitch (free and open-source): https://github.com/evilsocket/opensnitch

Thank YOu so much bro
 

ignoramous

Member
Sep 22, 2012
38
21
Yes I am using the setting as mentioned by you.
I tried different times using adguard or clean browsing dns
But when I am browsing using Chrome or Firefox some of the sites are not connecting.

Should I disable the above setting or perform some other option after adding the servers.
Also the latency is also high.
But I never got this issue using server through private dns.

Please inform

Yes please, disable the option "Block any app not in use". It is an aggressive kill-switch and not intended for everyone but just the power users.

In the upcoming v0.5 release, we plan to include ability to add apps to whitelist (so that they aren't subject to aggressive firewall rules such as this). Another thing we are doing is to add a 30s to 1min delay before that rules is applied, so that, rapidly switching back and forth between apps doesn't cause wierd connectivity issues.

Like I said, this feature is very hard for end-users to reason about...I think we'd probably add an "experimental" tag next to it.
 

formerglory

Member
Jul 24, 2007
24
7
"Pi-hole in the cloud" - sounds just like NextDNS. Are you familiar with them? I use it and it's excellent, any advantages to your app over NextDNS?

Competition is always good, looking forward to seeing how your development progresses.
 

ignoramous

Member
Sep 22, 2012
38
21
"Pi-hole in the cloud" - sounds just like NextDNS. Are you familiar with them? I use it and it's excellent, any advantages to your app over NextDNS?

Competition is always good, looking forward to seeing how your development progresses.

Yes I'm aware of NextDNS and other such solutions in the market like DNSFilter, CleanBrowsing, OpenDNS and others.

Our focus is anti censorship (our servers are domain-fronted by Cloudflare right now, and that means it costs us more money than it usually would, to run a public DNS resolver, but it is censorship resistant: ESNI, behind Cloudflare IPs and firewall etc). Our DNS stub-resolver code (open source may be in a week or two from today-- we need to clean it up of our secrets and keys and stuff) would he dead simple to deploy and run it yourself: Think "one click" and you have a DoH server deployed to over 50+ servers worldwide (pi-hole esque analytics wouldn't be as simple though) with $0 in costs for upto 5 devices (or may be more) worth DNS queries.

As for advantages over NextDNS: There wouldn't be any (DNS-wise they're so prefect) except for the fact (if that counts) that we are focused on being more open with our code: Think GitHub vs GitLab. Our client is already open source, for example, whilst I'm not sure about NextDNS' plans.

Also, apart from anti-censorship, our focus remains on client-side capabilities (mobile-- specifically Android).

If you have any ideas or suggestions please don't hesitate to write to me, I'm [email protected]
 
Last edited:

Technical

Senior Member
Jun 2, 2008
3,468
1,220
No it isn't affiliated with brave.com.
I miss this info into the OP and that's was the reason for me to not install (test) BraveDNS at first time, as I do not want to use brave.com apps.

1. Would it be worth to add ads-filters like Blokada (or other adblockers around)? (Maybe the need for an app outside Google Play again).
2. I really miss blocking apps phoning home facebook.com or google-analytics, for instance. It's not the Facebook/Messenger app itself, but others. By the way, using the DNS log is not possible to know which app is connecting to which subdomain. Anti-tracker features could be added with filters like DuckDuckGo Tracker Radar filter.
3. Show more info in the notification: blocked ads or blocked queries.
 
Last edited:

ignoramous

Member
Sep 22, 2012
38
21
Are apps like this safe to use ? Does all my info go through their servers ?
Hey there. You must definitely not install any app you don't trust.

BraveDNS (new name: RethinkDNS) is opensource and you can view the exodus report on the app that's live on the PlayStore here: https://reports.exodus-privacy.eu.org/en/reports/com.celzero.bravedns/latest/ That said, even Exodus has well-known limitations, one of which is it can only reveal well-known, already known forms of tracking since it relies on static code analysis and doesn't have much intelligence otherwise built-in. But hey, we come out clean in their tests: How many other apps can say that?

BraveDNS doesn't really tunnel all your traffic through its servers but just the DNS traffic and even that is configurable, that is, if you prefer to use another DNS resolver, you're welcome to reconfigure the app to use that. As for our privacy policy, see this: https://bravedns.com/privacy

Either ways, let me know if you have any more questions.

I miss this info into the OP and that's was the reason for me to not install (test) BraveDNS at first time, as I do not want to use brave.com apps.

1. Would it be worth to add ads-filters like Blokada (or other adblockers around)? (Maybe the need for an app outside Google Play again).
2. I really miss blocking apps phoning home facebook.com or google-analytics, for instance. It's not the Facebook/Messenger app itself, but others. By the way, using the DNS log is not possible to know which app is connecting to which subdomain. Anti-tracker features could be added with filters like DuckDuckGo Tracker Radar filter.
3. Show more info in the notification: blocked ads or blocked queries.

Yeah, it is an unfortunate naming choice, I guess. We've now changed our name to RethinkDNS (hey, don't judge me, our community on Telegram voted this name in :).

Re #1, you can configure blocklists and use the resulting URL as the DoH endpoint in the app: https://bravedns.com/configure

Re #2, we'll add a heuristic to map a DNS request to an app. This feature is due release may be a month or so from now (not more): https://github.com/celzero/brave-android-app/issues/3

Re #3: Interesting suggestion. I've added it to our backlog: https://github.com/celzero/rethink-app/issues/123

BTW, you may also want to try v05 (alpha release and bugs abound, download from the website: https://bravedns.com) which has on-device blocklists, IP blacklists, DNScrypt v2 support, DNS over Tor via Orbot support, forwarding connections to SOCKS5 TCP proxies, and 20 other features.

If you have anymore questions or suggestions, feel free to reach us over on GitHub, here, or over on email: I am [email protected]
 
Last edited:

Technical

Senior Member
Jun 2, 2008
3,468
1,220
Re #1, you can configure blocklists and use the resulting URL as the DoH endpoint in the app: https://bravedns.com/configure
I'm not a newbie in any sense. But it's not user-friendly at all. Too intimidating and requires a lot of interactions among the lists.

Re #2, we'll add a heuristic to map a DNS request to an app. This feature is due release may be a month or so from now (not more): https://github.com/celzero/brave-android-app/issues/3
Thank you.

Re #3: Interesting suggestion. I've added it to our backlog: https://github.com/celzero/rethink-app/issues/123
It shows value. Thank you again.

BTW, you may also want to try v05 (alpha release and bugs abound, download from the website: https://bravedns.com) which has on-device blocklists, IP blacklists, DNScrypt v2 support, DNS over Tor via Orbot support, forwarding connections to SOCKS5 TCP proxies, and 20 other features.
I've tested... Wow! It's a huge change in the interface (for better) and features. The configuration of block lists are much easier.
I'll have to start "new" suggestions :eek:

---------- Post added at 10:59 ---------- Previous post was at 10:47 ----------

On alpha version:

1. I miss the version number on the About section.
2. How the non-Play Store version will be updated? There is no setting for updating.
3. Export/import settings: heavy users will like this feature. For instance, when upgrading from v4, I lost all the "excluded apps".
4. I think an option to set a password to protect settings will help (for instance: kids' phone and adult content)
5. I'm a bit worried with the latency time (too high). Is there a way to remove redundancy of the lists or calculate the impact on performance (speed)?
6. On the apps lists (exclusion), can we have filter options? Like "running apps", "system apps", etc.?
7. Minor wish: themes (dark/light) + accent color
 

ignoramous

Member
Sep 22, 2012
38
21
...
1. I miss the version number on the About section.
2. How the non-Play Store version will be updated? There is no setting for updating.
3. Export/import settings: heavy users will like this feature. For instance, when upgrading from v4, I lost all the "excluded apps".
4. I think an option to set a password to protect settings will help (for instance: kids' phone and adult content)
5. I'm a bit worried with the latency time (too high). Is there a way to remove redundancy of the lists or calculate the impact on performance (speed)?
6. On the apps lists (exclusion), can we have filter options? Like "running apps", "system apps", etc.?
7. Minor wish: themes (dark/light) + accent color
Thanks.

1. Quite a few users asked for this. Added version number in the about page.
2. The app now has a "check for updates" in the About page.
3. Android's native backup solution should work like a charm for import/export, but we haven't implemented it yet. Issue tracker: https://github.com/celzero/brave-android-app/issues/103
4. It is trivial to disable VPN (example, from Android's own Settings app, or by connecting to another VPN, for example, unless "Always-on VPN" is set, which again could be toggled off through the Android's Settings app). What I am trying to say is, protecting an app with password does nothing to prevent anyone from killing it or disabling it, unfortunately. We need to see what else could be done here, but nothing so far that I've looked at will solve this unfortunate problem.
5. Blocklists have no bearing on latency. It is usually either the network or the resolver. The RethinkDNS resolvers are deployed to within 50ms of any city. What latency times do you see and which resolver are you using?
6. Interesting suggestion. Noted: https://github.com/celzero/rethink-app/issues/129
7. Someday... we need to fix the code-base, which is a proper hot-mess of soup, to eventually properly do UI theming among other things. :)

Please do let me know if you have anything else in mind.

does it support tls over dot ?

No, it does not support DoT. It does support DNSCrypt v2, though.

Nebulo, which is another free and open source DNS changer for Android, supports DoT (and DoH and custom blocklists and DNS proxy mode): https://play.google.com/store/apps/details?id=com.frostnerd.smokescreen

And so, you can forward DNS connections from RethinkDNS to Nebulo if you really want to use DoT: Run Nebulo in "proxy mode" and afterwards setup RethinkDNS to forward it to Nebulo (from the "Configure" screen in the "DNS" page in RethinkDNS, choose "DNS Proxy", click "Add" and fill in Nebulo's local IP address and port number in the pop-up).

I hope that was clear enough? If not, do let me know if you have any more questions.
 

ignoramous

Member
Sep 22, 2012
38
21
block/allow individual domains which are showed by log.
change dns servers just like nebulo app.
also proxy on tor n dnscrypt support like invizible-pro app.

pls add system apps block on firewall, also block domain on dns log and dns server change

Hey there,

The features you requested are live:

1. DNSCrypt v2 (with anonymized relays) is now supported. One can choose from existing DNSCrypt resolvers and relays or add their own.

2. One can now add DNS over HTTPS and plain-old (unencrypted) DNS resolvers.

3. One can also forward requests to other apps: That is, RethinkDNS can forward both DNS and TCP connections to Orbot, to use DNS over Tor and generally Tor itself as a proxy for all TCP traffic.

4. Added "System Apps" and "System Components" in the application firewall list.

5. You cannot really block a domain yet (this is coming next month), but you can now block individual IP addresses from the "Network Logs" screen in the "Firewall" page.

Try it out and let me know what you think: https://play.google.com/store/apps/details?id=com.celzero.bravedns
 
Last edited:

Technical

Senior Member
Jun 2, 2008
3,468
1,220
4. It is trivial to disable VPN (example, from Android's own Settings app, or by connecting to another VPN, for example, unless "Always-on VPN" is set, which again could be toggled off through the Android's Settings app). What I am trying to say is, protecting an app with password does nothing to prevent anyone from killing it or disabling it, unfortunately. We need to see what else could be done here, but nothing so far that I've looked at will solve this unfortunate problem.
Indeed. I just suggested because, maybe, under the hood we have a different approach, but I think we don't.

5. Blocklists have no bearing on latency. It is usually either the network or the resolver. The RethinkDNS resolvers are deployed to within 50ms of any city. What latency times do you see and which resolver are you using?
I was seeing the latency displayed by the app itself. I've noticed that it shows a higher number and some seconds after that it goes down by ~50ms.

I have issues with WhatsApp Web even allowing it to by-pass the app into Rethink's settings.
The Web interface have quite some issues to sync with the phone.
If I disable Rethink at all, it connects.
The issue does not apply to Blokada.
What kind of logs could be collected to debug this?
 

ignoramous

Member
Sep 22, 2012
38
21
I have issues with WhatsApp Web even allowing it to by-pass the app into Rethink's settings.
The Web interface have quite some issues to sync with the phone.
If I disable Rethink at all, it connects.
The issue does not apply to Blokada.
What kind of logs could be collected to debug this?

Are you using any of the two "Universal Firewall" settings: "Block any app not in-use" or "Block all apps when device locked"? If so, that might explain why WhatsApp might have been blocked. Of course, if you add WhatsApp to the "Whitelist" (from the Universal Firewall screen), then firewall rules shouldn't apply.

You can inspect the "Network Log" (from the Firewall screen) as well to see if WhatsApp is in fact being blocked by RethinkDNS: Tapping on any entry in Network Log would why a particular connection was allowed or blocked, and that might help narrow down the issue with WhatsApp Web further.

I am on Vanilla Android 10 and WhatsApp Web works for me just fine: Allow Bypass isn't enabled.
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 16
    apple-icon-120x120.png


    RethinkDNS is an anti-internet censorship tool with DNS-based adblocking and a firewall built-in for Android 6+ devices.

    The app itself is free to use and comes with RethinkDNS (previous name BraveDNS) resolver with support custom denylists, allowlists, ability to store DNS logs for later analysis, view those logs consolidated from multiple devices in a single interface and so on: Pretty much a pi-hole in the cloud.

    Why'd we build this?

    As concerned Android users
    : It absolutely irks us that people who do care enough about privacy still couldn't use privacy-enhancing apps without requiring a degree in computer science. We saw this pattern unfold multiple times and a lot of tools over the years have done a tremendous job of making niche security tools accessible to naive users. We wanted to further that conversation on Android with a vision for what we think such a tool should look like:

    1. Anti-censorship: Enable open internet. DNS over HTTPS (and the imminent ESNI standard) is going to effectively break censorship as implemented in a lot of countries without requiring to route the traffic through VPNs. VPNs (and distributed tech like IPFS and mesh networks like Lantern) are still required in countries that employ Deep Packet Inspection. That's something we'd like to tackle in the near future.

    2. Anti-surveillance: Expose apps, their activity logs, network logs, and provide some actionable insights to the users on what they could do next. Exodus Privacy does a good job at statically analyzing an app and laying bare the trackers and permissions in-use, whilst the evergreen NetGuard does ever-so-well in revealing an app's connectivity history. We believe, there's a lot more that can be done than simply firewall an app: For instance, you could disable it, uninstall it, remove its permissions, remove the so-called special permissions (like read notification permission, read SMS permission, read app-usage statistics permission etc). Basically, empower the user with whatever control is available without-root in a neat little interface (think CleanMaster vs using the stock Settings app but being actually effective and not lie).

    The current version of RethinkDNS (previous name: BraveDNS) is a start in the direction laid out above partly because we want such an app ourselves and partly because we feel people deserve more such tools, and we hope to build it with this community's input, because god knows we have been wrong plenty when it comes to "what people really want".

    As privacy enthusiasts: We were frustrated that if we wanted to use NetGuard we couldn't use another VPN app, or if we wanted to use a DNS changer like Blokada then we couldn't use NetGuard (though, NetGuard + Private DNS feature alleviates the problem on Android 9+). We wanted something that wasn't as restrictive because we knew it could be built and so we did.

    Key points:
    1. Easy configuration.
    2. No root required.
    3. Free and open source (forked from Intra).
    4. No built-in trackers or analytics.
    5. In continuous development.

    Current features:
    1. DNS over HTTPS (circumvent censorship and prevent surveillance of DNS logs by ISPs and everyone else), DNSCrypt v2 with Anonymized Relays, and DNS over Tor.
    2. View DNS logs, including latencies and other metadata.
    3. Ad-block through RethinkDNS (previous name: BraveDNS) free resolver and local blocklists.
    4. Add your own DNS over HTTPS / DNSCrypt v2 servers.
    5. Firewall by app categories.
    6. Firewall individual apps.
    7. Firewall individual IP addresses.
    8. Firewall when apps are in the background (not-in-active-use).
    9. Firewall when device is locked.
    10. Forward DNS and TCP connections to Orbot (Tor as a proxy).
    11. Forward HTTP connections to any HTTP proxy.
    12. Forward TCP connections to any SOCKS5 endpoint or to Orbot.
    13. Forward DNS connections to any app running locally on-device or any endpoint (either local or on the Internet).
    14. [v053g / Sep '21] Firewall when apps bypass DNS (for example, block connections to IPs that apps resolve themselves).
    15. [v053g / Sep '21] Pause: Pause the Firewall and DNS for a brief time-period.
    16. [v053g / Sep '21] DNS Trap: Proxy all requests made on Port 53 to user-set DNS endpoint (for instance, this traps and redirects all custom DNS requests WhatsApp sends to Google's `8.8.8.8` DNS servers to the DNS endpoint of a user's choice).

    Planned (in order):
    0. Custom DNS allowlists/denylists.
    1. WireGuard VPN integration.
    2. Firewall based on metered (LTE) or unmetered connection (Wifi).
    3. Per-app DNS and VPN (route traffic to multiple VPNs / DNS based on which app is making those connections).
    4. IPv6 support.


    See: github/celzero/rethink-app/feature-backlog.

    We can't emphasize this enough: Let us know what you'd like to see us build and more importantly what'd make this tool use-able for other Android users who care enough but aren't as tech-savvy.

    If you'd like to contribute, please feel free to send pull requests our way.

    Thanks.

    ---

    Source: github/celzero/rethink-app
    Website: rethinkfirewall.com
    Blog: blog.rethinkdns.com
    Twitter: twitter.com/rethinkdns
    FAQ: rethinkdns.com/faq
    License: Apache 2.0

    Download: via RethinkDNS.com | PlayStore | F-Droid.

    ---

    v053g.home.pngv053g.dlog.pngv053g.tor.pngv053g.nlog.pngv053g.fire.pngv053g.low.png
    2
    Thanks. Nice work.
    Unfortunately, it usually comes down to firewall or VPN

    Would love to see what you guys do (if at all) to allow third party VPNs
    2
    Just want to say many thanks for this app, I can finally use custom private DNS, firewall and VPN together. Waiting now for the next update :)
    1
    So this still exposes one's real IP address, yes?

    Yes, BraveDNS isn't a VPN service like ProtonVPN / Mullvad / Lantern etc are. Right now (though we do have plans to add VPN servers like Lantern et al in probably two to three months from today but that'd be only to support anti-censorship and not anonymity). See: https://github.com/celzero/brave-android-app/issues/52 and https://github.com/celzero/brave-android-app/issues/51

    We're adding support for SOCKS5 and HTTPS-Proxy in the upcoming release (next week) which would help forward traffic to VPNs (like NordVPN) that support those protocols: https://github.com/celzero/brave-android-app/issues/45

    Right now, BraveDNS uses VPN access on-device to change DNS and implement Firewall functionality (similar to what the excellent NetGuard app does).
    1
    I just started using this app again on a new android 10 device and so far no crashes!

    I have a couple of questions:

    1. Is it possible to block apps in my work profile? I currently don't see them in the app list (I don't think I can run this app in my work profile and my main profile at the same time...)

    2. Are you thinking of implementing separate blocking for different networks (e.g. unmetered WiFi vs cellular)? Something similar to what NetGuard can do? That would be awesome but I know probably a lot of work.

    Currently your app is the best firewall/adblocker that I have found so thank very much for it!

    Thanks, v053g (released Sep 15) must be even more stable (live on both F-Droid and Google Playstore). We refactored a lot of things and paid up the accumulated technical debt (but it took us 5 months to do it, unfortunately).

    Re: Your queries:

    1. We haven't tested the app in Work Profile or in multi-user mode, so it may or may not work. As far as limitation in Android is concerned: One can definitely run the same app (even a VPN app) in both the profiles at the same time.

    2. Yes, this is coming in v054, due end of this month (October)... or next, depending on how the development goes.