[APP][6.0+] RethinkDNS: Anti-Censorship + Adblocker + Firewall + VPN [open source] [no root]

[ignoramous]

Thank you very much for this app! I'm now able to capture those ip addresses of system apps. However, I always get a blank screen for network logs or dns logs . I have to close the app so that I can see the logs. Seems that it is also the same with configure firewall.

That sounds like a strange bug. We haven't explicitly fixed the issues you're facing, but we are releasing an update with some stability fixes (that avoids background crashes) to PlayStore today (should be live in about 2 to 3 days).

It'll soon be uploaded to our website and github, too. Look for version 0.4.4.

It's a great idea behind this app. Kudos to developers
However I am facing the following problem
- Sometimes when I try to configure firewall to block certain app it freezes and returns to homepage and when I try to access firewall again it shows blank page.
I need to clear app data again in order for the app to work properly
- Also dns and firewall apps do not identify all apps. It shows unknown
it would also be convenient to have options to block the app or configure it through logs.
Hope to see the issues resolved in future versions
Thanks

Yes, adding firewall/block rules from network logs and DNS logs is upcoming in the next release (0.4.5), likely by Friday, September 11.

Re: Clear data bug: Yes, that's a silly one which we have fixed in 0.4.4 (will be uploaded to website and github in 24hrs from now) and probably in PlayStore in two to three days from today.

---

 

[bilalrajput]

your app is awesome,Thank You.
Is there any app like that for PC too? like windows or dns like that

 

[Techdroid20]

Hi
I am still facing problems in using a custom dns server such as adguard or any other server.
The connection breaks and I am not able to connect to some sites while some others work.
Is there any bug??

 

[ignoramous]

your app is awesome,Thank You.
Is there any app like that for PC too? like windows or dns like that

Hi there. Thanks for your kind words. The app is lacking a lot of features but the next release hopefully bridges that gap a bit.

As for PC and other platforms: No, we aren't building for those as our focus right now remains on Android.

https://glasswire.com is a similar product for Windows but they're not free or open-source, afaik.

Mac has LuLu Firewall (open-source): https://objective-see.com/products/lulu.html

Linux has OpenSnitch (free and open-source): https://github.com/evilsocket/opensnitch

 

[ignoramous]

Hi
I am still facing problems in using a custom dns server such as adguard or any other server.
The connection breaks and I am not able to connect to some sites while some others work.
Is there any bug??

Hi there. That's strange. Are you using the "Block any app not in use" firewall setting? That setting is too aggressive and may seem to "break the connections" pretty often.

If not, it could be that adguard's DNS itself was down?

 

[Techdroid20]

Hi there. That's strange. Are you using the "Block any app not in use" firewall setting? That setting is too aggressive and may seem to "break the connections" pretty often.

If not, it could be that adguard's DNS itself was down?

Yes I am using the setting as mentioned by you.
I tried different times using adguard or clean browsing dns
But when I am browsing using Chrome or Firefox some of the sites are not connecting.

Should I disable the above setting or perform some other option after adding the servers.
Also the latency is also high.
But I never got this issue using server through private dns.

Please inform

 

[bilalrajput]

Hi there. Thanks for your kind words. The app is lacking a lot of features but the next release hopefully bridges that gap a bit.

As for PC and other platforms: No, we aren't building for those as our focus right now remains on Android.

https://glasswire.com is a similar product for Windows but they're not free or open-source, afaik.

Mac has LuLu Firewall (open-source): https://objective-see.com/products/lulu.html

Linux has OpenSnitch (free and open-source): https://github.com/evilsocket/opensnitch

Thank YOu so much bro

 

[ignoramous]

Yes I am using the setting as mentioned by you.
I tried different times using adguard or clean browsing dns
But when I am browsing using Chrome or Firefox some of the sites are not connecting.

Should I disable the above setting or perform some other option after adding the servers.
Also the latency is also high.
But I never got this issue using server through private dns.

Please inform

Yes please, disable the option "Block any app not in use". It is an aggressive kill-switch and not intended for everyone but just the power users.

In the upcoming v0.5 release, we plan to include ability to add apps to whitelist (so that they aren't subject to aggressive firewall rules such as this). Another thing we are doing is to add a 30s to 1min delay before that rules is applied, so that, rapidly switching back and forth between apps doesn't cause wierd connectivity issues.

Like I said, this feature is very hard for end-users to reason about...I think we'd probably add an "experimental" tag next to it.

 

[formerglory]

"Pi-hole in the cloud" - sounds just like NextDNS. Are you familiar with them? I use it and it's excellent, any advantages to your app over NextDNS?

Competition is always good, looking forward to seeing how your development progresses.

 

[ignoramous]

"Pi-hole in the cloud" - sounds just like NextDNS. Are you familiar with them? I use it and it's excellent, any advantages to your app over NextDNS?

Competition is always good, looking forward to seeing how your development progresses.

Yes I'm aware of NextDNS and other such solutions in the market like DNSFilter, CleanBrowsing, OpenDNS and others.

Our focus is anti censorship (our servers are domain-fronted by Cloudflare right now, and that means it costs us more money than it usually would, to run a public DNS resolver, but it is censorship resistant: ESNI, behind Cloudflare IPs and firewall etc). Our DNS stub-resolver code (open source may be in a week or two from today-- we need to clean it up of our secrets and keys and stuff) would he dead simple to deploy and run it yourself: Think "one click" and you have a DoH server deployed to over 50+ servers worldwide (pi-hole esque analytics wouldn't be as simple though) with $0 in costs for upto 5 devices (or may be more) worth DNS queries.

As for advantages over NextDNS: There wouldn't be any (DNS-wise they're so prefect) except for the fact (if that counts) that we are focused on being more open with our code: Think GitHub vs GitLab. Our client is already open source, for example, whilst I'm not sure about NextDNS' plans.

Also, apart from anti-censorship, our focus remains on client-side capabilities (mobile-- specifically Android).

If you have any ideas or suggestions please don't hesitate to write to me, I'm [email protected]

 

[wulfnuts]

Are apps like this safe to use ? Does all my info go through their servers ?

 

[Technical]

No it isn't affiliated with brave.com.

I miss this info into the OP and that's was the reason for me to not install (test) BraveDNS at first time, as I do not want to use brave.com apps.

1. Would it be worth to add ads-filters like Blokada (or other adblockers around)? (Maybe the need for an app outside Google Play again).
2. I really miss blocking apps phoning home facebook.com or google-analytics, for instance. It's not the Facebook/Messenger app itself, but others. By the way, using the DNS log is not possible to know which app is connecting to which subdomain. Anti-tracker features could be added with filters like DuckDuckGo Tracker Radar filter.
3. Show more info in the notification: blocked ads or blocked queries.

 

[ignoramous]

Are apps like this safe to use ? Does all my info go through their servers ?

Hey there. You must definitely not install any app you don't trust.

BraveDNS (new name: RethinkDNS) is opensource and you can view the exodus report on the app that's live on the PlayStore here: https://reports.exodus-privacy.eu.org/en/reports/com.celzero.bravedns/latest/ That said, even Exodus has well-known limitations, one of which is it can only reveal well-known, already known forms of tracking since it relies on static code analysis and doesn't have much intelligence otherwise built-in. But hey, we come out clean in their tests: How many other apps can say that?

BraveDNS doesn't really tunnel all your traffic through its servers but just the DNS traffic and even that is configurable, that is, if you prefer to use another DNS resolver, you're welcome to reconfigure the app to use that. As for our privacy policy, see this: https://bravedns.com/privacy

Either ways, let me know if you have any more questions.

I miss this info into the OP and that's was the reason for me to not install (test) BraveDNS at first time, as I do not want to use brave.com apps.

1. Would it be worth to add ads-filters like Blokada (or other adblockers around)? (Maybe the need for an app outside Google Play again).
2. I really miss blocking apps phoning home facebook.com or google-analytics, for instance. It's not the Facebook/Messenger app itself, but others. By the way, using the DNS log is not possible to know which app is connecting to which subdomain. Anti-tracker features could be added with filters like DuckDuckGo Tracker Radar filter.
3. Show more info in the notification: blocked ads or blocked queries.

Yeah, it is an unfortunate naming choice, I guess. We've now changed our name to RethinkDNS (hey, don't judge me, our community on Telegram voted this name in .

Re #1, you can configure blocklists and use the resulting URL as the DoH endpoint in the app: https://bravedns.com/configure

Re #2, we'll add a heuristic to map a DNS request to an app. This feature is due release may be a month or so from now (not more): https://github.com/celzero/brave-android-app/issues/3

Re #3: Interesting suggestion. I've added it to our backlog: https://github.com/celzero/rethink-app/issues/123

BTW, you may also want to try v05 (alpha release and bugs abound, download from the website: https://bravedns.com) which has on-device blocklists, IP blacklists, DNScrypt v2 support, DNS over Tor via Orbot support, forwarding connections to SOCKS5 TCP proxies, and 20 other features.

If you have anymore questions or suggestions, feel free to reach us over on GitHub, here, or over on email: I am [email protected]

 

[Technical]

Re #1, you can configure blocklists and use the resulting URL as the DoH endpoint in the app: https://bravedns.com/configure

I'm not a newbie in any sense. But it's not user-friendly at all. Too intimidating and requires a lot of interactions among the lists.

Re #2, we'll add a heuristic to map a DNS request to an app. This feature is due release may be a month or so from now (not more): https://github.com/celzero/brave-android-app/issues/3

Thank you.

Re #3: Interesting suggestion. I've added it to our backlog: https://github.com/celzero/rethink-app/issues/123

It shows value. Thank you again.

BTW, you may also want to try v05 (alpha release and bugs abound, download from the website: https://bravedns.com) which has on-device blocklists, IP blacklists, DNScrypt v2 support, DNS over Tor via Orbot support, forwarding connections to SOCKS5 TCP proxies, and 20 other features.

I've tested... Wow! It's a huge change in the interface (for better) and features. The configuration of block lists are much easier.
I'll have to start "new" suggestions

---------- Post added at 10:59 ---------- Previous post was at 10:47 ----------

On alpha version:

1. I miss the version number on the About section.
2. How the non-Play Store version will be updated? There is no setting for updating.
3. Export/import settings: heavy users will like this feature. For instance, when upgrading from v4, I lost all the "excluded apps".
4. I think an option to set a password to protect settings will help (for instance: kids' phone and adult content)
5. I'm a bit worried with the latency time (too high). Is there a way to remove redundancy of the lists or calculate the impact on performance (speed)?
6. On the apps lists (exclusion), can we have filter options? Like "running apps", "system apps", etc.?
7. Minor wish: themes (dark/light) + accent color

 

[username1100]

does it support tls over dot ?

 

[Keule-Tm]

does it support tls over dot ?

DOT=DNS over TLS

 

[ignoramous]

...
1. I miss the version number on the About section.
2. How the non-Play Store version will be updated? There is no setting for updating.
3. Export/import settings: heavy users will like this feature. For instance, when upgrading from v4, I lost all the "excluded apps".
4. I think an option to set a password to protect settings will help (for instance: kids' phone and adult content)
5. I'm a bit worried with the latency time (too high). Is there a way to remove redundancy of the lists or calculate the impact on performance (speed)?
6. On the apps lists (exclusion), can we have filter options? Like "running apps", "system apps", etc.?
7. Minor wish: themes (dark/light) + accent color

Thanks.

1. Quite a few users asked for this. Added version number in the about page.
2. The app now has a "check for updates" in the About page.
3. Android's native backup solution should work like a charm for import/export, but we haven't implemented it yet. Issue tracker: https://github.com/celzero/brave-android-app/issues/103
4. It is trivial to disable VPN (example, from Android's own Settings app, or by connecting to another VPN, for example, unless "Always-on VPN" is set, which again could be toggled off through the Android's Settings app). What I am trying to say is, protecting an app with password does nothing to prevent anyone from killing it or disabling it, unfortunately. We need to see what else could be done here, but nothing so far that I've looked at will solve this unfortunate problem.
5. Blocklists have no bearing on latency. It is usually either the network or the resolver. The RethinkDNS resolvers are deployed to within 50ms of any city. What latency times do you see and which resolver are you using?
6. Interesting suggestion. Noted: https://github.com/celzero/rethink-app/issues/129
7. Someday... we need to fix the code-base, which is a proper hot-mess of soup, to eventually properly do UI theming among other things.

Please do let me know if you have anything else in mind.

does it support tls over dot ?

DOT=DNS over TLS

No, it does not support DoT. It does support DNSCrypt v2, though.

Nebulo, which is another free and open source DNS changer for Android, supports DoT (and DoH and custom blocklists and DNS proxy mode): https://play.google.com/store/apps/details?id=com.frostnerd.smokescreen

And so, you can forward DNS connections from RethinkDNS to Nebulo if you really want to use DoT: Run Nebulo in "proxy mode" and afterwards setup RethinkDNS to forward it to Nebulo (from the "Configure" screen in the "DNS" page in RethinkDNS, choose "DNS Proxy", click "Add" and fill in Nebulo's local IP address and port number in the pop-up).

I hope that was clear enough? If not, do let me know if you have any more questions.

 

[ignoramous]

block/allow individual domains which are showed by log.
change dns servers just like nebulo app.
also proxy on tor n dnscrypt support like invizible-pro app.

pls add system apps block on firewall, also block domain on dns log and dns server change

Hey there,

The features you requested are live:

1. DNSCrypt v2 (with anonymized relays) is now supported. One can choose from existing DNSCrypt resolvers and relays or add their own.

2. One can now add DNS over HTTPS and plain-old (unencrypted) DNS resolvers.

3. One can also forward requests to other apps: That is, RethinkDNS can forward both DNS and TCP connections to Orbot, to use DNS over Tor and generally Tor itself as a proxy for all TCP traffic.

4. Added "System Apps" and "System Components" in the application firewall list.

5. You cannot really block a domain yet (this is coming next month), but you can now block individual IP addresses from the "Network Logs" screen in the "Firewall" page.

Try it out and let me know what you think: https://play.google.com/store/apps/details?id=com.celzero.bravedns

 

[Technical]

4. It is trivial to disable VPN (example, from Android's own Settings app, or by connecting to another VPN, for example, unless "Always-on VPN" is set, which again could be toggled off through the Android's Settings app). What I am trying to say is, protecting an app with password does nothing to prevent anyone from killing it or disabling it, unfortunately. We need to see what else could be done here, but nothing so far that I've looked at will solve this unfortunate problem.

Indeed. I just suggested because, maybe, under the hood we have a different approach, but I think we don't.

5. Blocklists have no bearing on latency. It is usually either the network or the resolver. The RethinkDNS resolvers are deployed to within 50ms of any city. What latency times do you see and which resolver are you using?

I was seeing the latency displayed by the app itself. I've noticed that it shows a higher number and some seconds after that it goes down by ~50ms.

I have issues with WhatsApp Web even allowing it to by-pass the app into Rethink's settings.
The Web interface have quite some issues to sync with the phone.
If I disable Rethink at all, it connects.
The issue does not apply to Blokada.
What kind of logs could be collected to debug this?

 

[ignoramous]

I have issues with WhatsApp Web even allowing it to by-pass the app into Rethink's settings.
The Web interface have quite some issues to sync with the phone.
If I disable Rethink at all, it connects.
The issue does not apply to Blokada.
What kind of logs could be collected to debug this?

Are you using any of the two "Universal Firewall" settings: "Block any app not in-use" or "Block all apps when device locked"? If so, that might explain why WhatsApp might have been blocked. Of course, if you add WhatsApp to the "Whitelist" (from the Universal Firewall screen), then firewall rules shouldn't apply.

You can inspect the "Network Log" (from the Firewall screen) as well to see if WhatsApp is in fact being blocked by RethinkDNS: Tapping on any entry in Network Log would why a particular connection was allowed or blocked, and that might help narrow down the issue with WhatsApp Web further.

I am on Vanilla Android 10 and WhatsApp Web works for me just fine: Allow Bypass isn't enabled.