[APP][6.0+] RethinkDNS: Anti-Censorship + Adblocker + Firewall + VPN [open source] [no root]

[Nastrahl]

My understanding is that this app bypasses my blocking rules from the /etc/hosts file, right?

Is there a benefit to using this app instead of energized protection magisk module + a custom dns server? (ISP cannot see requests bc they are encrypted with https?).
Or any drawbacks? (More battery usage than hosts file?)

Thanks for any advice .

Editing the HOSTS file is the worst method actually.

It's slow. Hosts file needs to be cached in RAM by the DNS client and that takes time + processing power.

When the DNS cache is flushed, it needs to cache it again.

Internet may be completely unresponsive during the caching

It takes an enormous quantity of RAM especially if you use energized because their lists are huge

There's a high risk of blocking useless domain because you'll never try to resolve in the first place so it's a waste of resources.

It's non optimized as it's supports no filtering rules.

Using a VPN means that it will ignore system's hosts file for the VPN's database so it's an other waste of resources

If you already use a custom DNS server there's no need to use the hosts file. Instead, let the DNS server to filter domains out by importing energized lists in it.

The benefit i see is than you can also make use of the firewall to block locally everything you need per apps, while hosts file/ DNS filtering are system wide.

You can customize a lot of rules based on your preferences also.

I don't know if it can do cosmetic blocking to hide placeholders of ads on websites though

 

[buddy96]

Just came across it whilst looking for an alternative to blokada as I wanted the ability to block specific apps. Amazing ! and I've only scratched the surface. I'm surprised this has not attracted more attention from users with non-rooted devices.

Thank you !

 

[celestialspring]

I am waiting for the next version because it will have some features that i must have in such an app.

The devs are working hard on it! Hopefully we will get an update soon.

 

[FFW]

I just stumbled upon this app from a comment in the weblog of Mike Kuketz - and I did not believe my eyes when I read through this thread: finally there seems a chance to have the combination of a local firewall, ad blocker AND a VPN client to forward the traffic to my own network after filtering on an unrooted Android! This is ***so*** great news!
With an integrated Wireguard client included, this app will be quite likely to replace NetGuard on my phone if it runs stable

Some questions I had during setup:

• what is the difference between unblocking and whitelisting apps in the firewall module?
• while transferring my blocked apps from NetGuard for the test, I found the grouping of the blocked apps a little irritating, especially since there is a button that switches to "unblocked" as soon as I unblock one app of the whole group (and blocks the whole group again if I accidentially press it). Can this be turned off?
• I know from Netguard there is a switch to block/unblock apps with "root" id. Is there something similar in ReThinkDNS?
• how are the blocklists I have chosen updated? For Netguard, I have the possbility to update the Blocklist I chose to use via tasker in a time interval I can specify (yes, not the most intuitive way to do this...).
• can I backup/import my list of blocked/allowed apps and chosen blocklist(s) and other settings?

But: all in all, this looks very promising! I am looking forward on how this app develops!

 

[ignoramous]

I just stumbled upon this app from a comment in the weblog of Mike Kuketz - and I did not believe my eyes when I read through this thread: finally there seems a chance to have the combination of a local firewall, ad blocker AND a VPN client to forward the traffic to my own network after filtering on an unrooted Android!

Interesting Mike Kuketz should talk about Rethink. We're not European, you see

----

Re: Unblocking and whitelisting: Whitelisting is letting an app bypass all "Universal" firewall rules ("Block apps when device is locked", "Block all UDP traffic except DNS and NTP" etc that are enforced across all apps). We have renamed whitelisting to "Bypass universal" in the latest version (`v053i`) to make that more clearer.

Re: Unblock app UI: The UI has seen a considerable change in `v053i`. How do you find the new one? Still long ways to go to fix all the niggling confusing bits in Rethink... but I hope we're going in the right direction.

Re: NetGuard `root` ID: I don't know why NetGuard calls it `root`? On Rethink, `root` only appears in "All Apps" tab if it makes an internet connection. `root` is named `ANDROID` (all caps) in Rethink. There are many such `root` apps, like `GPS`, `MDNSR`, etc. You'd find Rethink track them (and show them in "All Apps") only if they make atleast one internet connection when Rethink is enabled, otherwise not.

Re: Blocklist update: We compress the blocklists and make them available for download on our servers. Users can download them on-demand (these are not auto-downloaded). We tend to update blocklists once a week. As for user setting their own blocklists, Rethink doesn't support them yet, but soon will.

Re: Backup: We're implementing this as we speak!

But: all in all, this looks very promising! I am looking forward on how this app develops!

Thanks. We have been doing this for a good part of 2 years now (with two long health / pandemic enforced breaks in between), and despite the bugs and lack of features, it warms our hearts that people find the app promising (we have our share of haters too).

 

[ignoramous]

Just came across it whilst looking for an alternative to blokada as I wanted the ability to block specific apps. Amazing ! and I've only scratched the surface. I'm surprised this has not attracted more attention from users with non-rooted devices.

Thank you !

Do you know just how they run Blokda? If you did, you'd start questioning the transparency of it all...

 

[FFW]

Interesting Mike Kuketz should talk about Rethink. We're not European, you see

No, it was one of his visitors, not the master himself. By the way - as long as your software follows the european logic of "privacy" (which it seems to do form what I can tell) it does not matter at all if you are European or not.

----

Re: Unblocking and whitelisting: Whitelisting is letting an app bypass all "Universal" firewall rules ("Block apps when device is locked", "Block all UDP traffic except DNS and NTP" etc that are enforced across all apps). We have renamed whitelisting to "Bypass universal" in the latest version (`v053i`) to make that more clearer.

Re: Unblock app UI: The UI has seen a considerable change in `v053i`. How do you find the new one? Still long ways to go to fix all the niggling confusing bits in Rethink... but I hope we're going in the right direction.

Yes, the new app list is indeed much better! Looks a bit netguard-y
Just two questions about this:
1. why is it impossible to edit DNS or Firewall if I RethinkDNS is not active? I am still switching between Netguard and RethinkDNS and I would like to be able to edit the blocked/allowed apps before I activate RethinkDNS
2. Since RethinkDNS is also limited by Android App IDs, I miss the possibility to either group/sort apps by App ID (as AfWall+ does it) or to at least search for the App ID as Netguard allows.

Re: NetGuard `root` ID: I don't know why NetGuard calls it `root`? On Rethink, `root` only appears in "All Apps" tab if it makes an internet connection. `root` is named `ANDROID` (all caps) in Rethink. There are many such `root` apps, like `GPS`, `MDNSR`, etc. You'd find Rethink track them (and show them in "All Apps") only if they make atleast one internet connection when Rethink is enabled, otherwise not.

That's quite simple: App ID "0" means "Apps run with administrator rights" for Android and Admin is called "Root" for Linux and Android, so both AfWall+ and Netguard call this App ID "Root". But this is a downside of RethinkDNS then: if I understand you correctly, it cannot block these apps at all. Understandable since you definitely need to know what you do if you want to limit these - but a downside nevertheless.

Re: Blocklist update: We compress the blocklists and make them available for download on our servers. Users can download them on-demand (these are not auto-downloaded). We tend to update blocklists once a week. As for user setting their own blocklists, Rethink doesn't support them yet, but soon will.

Re: Backup: We're implementing this as we speak!

This is good to hear I would however also vote to add some kind of auto update for the blocklists.

Thanks. We have been doing this for a good part of 2 years now (with two long health / pandemic enforced breaks in between), and despite the bugs and lack of features, it warms our hearts that people find the app promising (we have our share of haters too).

Please do not let such assh***s come close to you. But I really wonder (as I do in the case of Netguard) how many of these haters might be paid by marketing companies who do not like such apps at all. With PiHole at home and Netguard or RethinkDNS on my phone, I rarely see any ads at all - and I ****love**** it.

From my point of view, RethinkDNS seems a viable Alternative to NetGuard - with the main drawbacks that
- you are limited to the provided blocklists that also don't auto-update since it seems you have a large monolithic blocklist file
- you cannot block anything running with App ID 0

But: your app is new, and you are working on it and enhancing it with every release.
And there is a chance you implement Wireguard which would enable a user to use your firewall and then forward the traffic to his VPN without a rooted device - and as soon as that happens I think RethinkDNS really is a leap forward.

 

[ignoramous]

No, it was one of his visitors, not the master himself.

Gotcha. I don't expect the master to review us, though.

why is it impossible to edit DNS or Firewall if I RethinkDNS is not active?

That's because we do a bunch of "reactive" stuff when rules change (like re-hydrate the firewall-rules cache, for example). And if the firewall / dns isn't active, these reactive changes may result in unexpected behaviour (including app crashes). In short, the limitation is with the code base, as it is setup currently. We would have to untangle and fight with it to let users add rules when the app is inactive. I'd rather we spend whatever time we have on other important feature requests. So: I wouldn't expect this to get done anytime soon.

Besides, the way I envision it, Rethink is not meant to be used in intervals; it is meant to be used as an Always-on VPN.

But this is a downside of RethinkDNS then: if I understand you correctly, it cannot block these apps at all. Understandable since you definitely need to know what you do if you want to limit these - but a downside nevertheless.

You understood what I said incorrectly. Rethink can (and does) absolutely block UID 0 (aka root) if its traffic happens to tunnel over Rethink's local-VPN. The thing with root is, it can easily bypass such a restriction (since it is root!). NetGuard cannot prevent it either. May be, AfWall+ (needs a clever implementation) does; not sure.

I would however also vote to add some kind of auto update for the blocklists.

It is rote work to do auto-updates, but we're thinking about it: https://github.com/celzero/rethink-app/issues/564

how many of these haters might be paid by marketing companies who do not like such apps at all

Nah, don't think that's the case. Unlike NetGuard, Rethink has a very, very tiny userbase. Probably like 100x smaller. The haters are more likely because they are unable to communicate their criticism without expressing extreme emotion.

- you are limited to the provided blocklists that also don't auto-update since it seems you have a large monolithic blocklist file

Yeah, but we want to add ability to let users point Rethink to any blocklist. Coming in probably 3 months or so: https://github.com/celzero/rethink-app/issues/237

- you cannot block anything running with App ID 0

Rethink can.

And there is a chance you implement Wireguard which would enable a user to use your firewall and then forward the traffic to his VPN without a rooted device - and as soon as that happens I think RethinkDNS really is a leap forward.

I had this impl in March, but we never get around to releasing it. May be this December in we do!

Btw, thanks for your feedback. Appreciate it

 

[gemlion]

I am a little bit stuck here. Had to reinstall RethinkDNS app while Always-On VPN was active. Due uninstalling the VPN profile was gone. But now RethinkDNS thinks the profile is still there and active. I cannot start RethinkDNS and get the error "Always-On VPN active. Do you really want to stop?" or something like that.

Any idea how to solve this and start the connection?

Best regards and thanks for this great app/service.

 

[celestialspring]

I am a little bit stuck here. Had to reinstall RethinkDNS app while Always-On VPN was active. Due uninstalling the VPN profile was gone. But now RethinkDNS thinks the profile is still there and active. I cannot start RethinkDNS and get the error "Always-On VPN active. Do you really want to stop?" or something like that.

Any idea how to solve this and start the connection?

Best regards and thanks for this great app/service.

Try their telegram group for more responses.

 

[y0himba]

Just got a Pixel 7 Pro with Android 13. I am having an issue where I cannot turn on the notifications for RethinkDNS.

At your request android is blocking this app's notifications from appearing on this device

The toggle for turning them back on is greyed out and will not work. I cleared the app's cache and storage, rebooted, then reinstalled the app, rebooted. Still unable to use the notification to pause/start RethinkDNS.

I think this is the culprit:
https://developer.android.com/develop/ui/views/notifications/notification-permission

More here: https://www.singular.net/blog/android-13-push-notifications/

It's not only RethinkDNS experiencing this issue, but a LOT of other apps as well.

 

[ignoramous]

The toggle for turning them back on is greyed out and will not work. I cleared the app's cache and storage, rebooted, then reinstalled the app, rebooted. Still unable to use the notification to pause/start RethinkDNS.

Thanks for the bug report. We've since fixed it this issue in v053l: https://github.com/celzero/rethink-app/issues/594

But now RethinkDNS thinks the profile is still there and active. I cannot start RethinkDNS and get the error "Always-On VPN active. Do you really want to stop?" or something like that.

That's a strange bug. I don't think the app is at fault. Which Android version are you on? Are you on a custom ROM or stock OEM ROM? Did reboot not fix this issue?

 

[pyereciae2788]

I've been using ReThinkDNS for some time, and just happened to stumble upon this XDA thread. It's pretty reliable, although I'd say an important missing piece is custom blacklists/whitelists. Looking forward to when custom lists are added, since those will definitely be useful.

Also, by any chance, are emails checked? In the Support section of the FAQ (https://rethinkdns.com/faq#faq-support), an email address is linked, which I'm assuming is an alternative contact method for those who don't use Telegram. I'm not sure about the situation, though, since I've sent an email to there a long time ago with no repsonse.

 

[ignoramous]

I'm not sure about the situation, though, since I've sent an email to there a long time ago with no repsonse.

Hi there, we do check emails and reply when necessary (for example, we may not reply if we have since fixed the bug, or there might already be a discussion or issue about it on Github, or the FAQ covers it, or the email is scant on the details of the bug, and so on). I know it is frustrating to send emails into a blackhole, but if you'd see our inbox, you'd understand just why we possibly can't reply to every email we get

Support is always the fastest on Telegram since a plenty community members are up-to-date with the state of the development, planned changes, existing bugs, and functionality of the app.

 

[lenny64]

@ignoramous
How can I set up a specific DNS in the app for my home wifi?
If it's not yet possible, then maybe as a new feature?

For example, it should use my local DNS (pihole) when I am conneted to my home wifi (ssid). For everything else use a different DNS server.

 

[ZxPyP]

@ignoramous
When I use RethinkDNS apps I quit, automatically launch again(like Firefox, Youtube, Conversations and so on). When I use Netguard, the manually terminated apps stay closed.

Do you have any idea why the system behaves this way with RethinkDNS?

 

[ignoramous]

How can I set up a specific DNS in the app for my home wifi?
If it's not yet possible, then maybe as a new feature?

Hi there

Not possible yet. This is a very niche use case, so we intend to implement it once we get other majors asks out of the way: https://github.com/celzero/rethink-app/issues/445

We do want to integrate Tasker which would make it automatable: https://github.com/celzero/rethink-app/issues/63

 

[ignoramous]

Do you have any idea why the system behaves this way with RethinkDNS?

No clue. But the behaviour you describe is the first I have heard of it. Can you share a screen recording, if you're comfortable? Also, make sure the ROM / Android version you're using doesn't have bugs in them.

v054 is the latest rdns version, btw. Is that the one you're using?

 

[donjoe0]

Editing the HOSTS file is the worst method actually.

It's slow. Hosts file needs to be cached in RAM by the DNS client and that takes time + processing power.

IDK, the uBlock author says the performance penalty is negligible.
https://github.com/mtxadmin/ublock/blob/master/docs/hosts_file_performance_en.mdNope, some testing immediately confirmed for me a large hosts file produces visible connection slowdown.

And speaking of performance, @ignoramous I just read today that the AFWall+ firewall solution of using iptables has very low processing demand and battery drain. Are you forced to do it some other way in RDNS, maybe because of the configurability you want to offer, and is that why there's significant extra battery drain from your firewall? Because right now I'm thinking the optimal combination for me would be to use AFWall+ in tandem with DNS-only RDNS to get the juiciest part of RDNS working with a perfectly fine firewall for no visible battery sacrifice.

 

[ZxPyP]

No clue. But the behaviour you describe is the first I have heard of it. Can you share a screen recording, if you're comfortable? Also, make sure the ROM / Android version you're using doesn't have bugs in them.

v054 is the latest rdns version, btw. Is that the one you're using?

I am currently using Netguard again because I noticed this bevavior with RethinkDNS.
As a long-time Netguard user, I found the behavior a bit odd. No future for Netguard, because it is no longer actively developed further. I hope RethinkDNS runs better on my smartphone in the future.

Unfortunately I can't test much at the moment, but when I have time I can open a bug report about it on github.com.
Maybe I can test it this weekend.

The problem occurred on two Samsung A52 4G, Android 13 February Security-Patch. RethinkDNS 054a from Google Play Store.