[CLOSED][APP][6.0+] NetGuard - No-root firewall

[M66B]

I am sorry to say that I have cancelled all my public projects, please see the XDA FairEmail thread about why, in particular this comment:

https://forum.xda-developers.com/t/...vacy-oriented-email-app.3824168/post-87200335

The app has been removed the Play store.

 

[M66B]

Although nobody seem to care, the app was restored in the Play Store.

 

[iwanttoknow]

Although nobody seem to care, the app was restored in the Play Store.

I don't think so. It's important for all of us following you in this thread.

By the way it was difficult for me to understand all about FairEmail and Google. It was to technical for me as you know it ;-)

 

[bmwdroid]

Although nobody seem to care, the app was restored in the Play Store.

As I'm using the donated github version I didn't notice indeed.

I hope there will be less ignorant trolls on Playstore in the future misrating your brilliant app.
All the best to your family and you.

 

[RichZ]

The problem is that all network traffic is routed through the VPN, including VoLTE.
Since VoLTE traffic is encrypted, there is no way to forward it.
The only thing you can do is find the system component responsible for VoLTE traffic and disable 'Apply rules and conditions' for it.

sorry to reply so late. On my Android 12 system VoLTE works fine with Netguard enabled so perhaps my system is somewhat special and doesn't route VoLTE through VPN.

However, as said I have a problem accepting VoLTE calls IF Netguard is enabled AND wifi disabled AND mobile data disabled AND phone locked. Note that it still works if wifi is enabled but not available. Also outgoing calls work fine, it is just accepting calls. Because it only happens when screen is locked I suspect it is a actually a problem with the screen unlocking which for some reason attempts an internet access and fails in some unusual way under this special circumstances.

Right now I simply leave on wifi at all times as a workaround which works. A Netguard option to disable itself if no data connection of any kind is available would also solve it.

 

[Treu55]

my phone was hacked using third apps like WhatsApp to bypass Netguard using port number 123.
Not doubt of this bypassing because some of these ips belongs to far countries and local ISP phone companies, without any relation with Whatsapp

It seems the traffic by these ports is opened at free requests.

A new option to allow only specific ports per app will be useful to limit this bypassing. Is this possible?

 

[M66B]

my phone was hacked using third apps like WhatsApp to bypass Netguard using port number 123.
Not doubt of this bypassing because some of these ips belongs to far countries and local ISP phone companies, without any relation with Whatsapp

It seems the traffic by these ports is opened at free requests.

A new option to allow only specific ports per app will be useful to limit this bypassing. Is this possible?

View attachment 5672847

You can block WiFi and mobile data and allow the connections you want only.

 

[Treu55]

You can block WiFi and mobile data and allow the connections you want only.

I have both options enabled, although these new connections by port 123 were established anyway

 

[M66B]

I have both options enabled, although these new connections by port 123 were established anyway

47 bytes, a packet, were sent, please see here:

https://github.com/M66B/NetGuard/blob/master/FAQ.md#user-content-faq19

 

[Treu55]

47 bytes, a packet, were sent, please see here:

https://github.com/M66B/NetGuard/blob/master/FAQ.md#user-content-faq19

I don't have Google Services and all the system apps are blocked. The previous image belongs to recent data, some days ago I have found MB's traffic through these ports.

Now I'm checking frequently the logs to block manually in case I detect that traffic, and for that reason that traffic in the image appears like denied.

One question: I have option "Apply rules with Screen On" disabled. Is this a probable cause?.

Thanks and hope you keep your work despite the monopoly attempts from big companies which should be located in some nazi regime or North Korea.

 

[M66B]

...

One question: I have option "Apply rules with Screen On" disabled. Is this a probable cause?.

...

No, it won't be.

 

[houmles]

UDP port 123 is used for NTP service and it's common to have servers in different countries around the world.
You are probablby not hacked but Whatsapp (or other app) just trying to sync time and because you don't allow connection to that server it's just trying another one.

 

[Treu55]

UDP port 123 is used for NTP service and it's common to have servers in different countries around the world.
You are probablby not hacked but Whatsapp (or other app) just trying to sync time and because you don't allow connection to that server it's just trying another one.

no, as I wrote before, some of those ip were from local isp's, some of them from russia and without any ntp server behind, I have checked ports from those ips and it was no ntp traffic.

I don't know how they take profit of installed apps with internet permission like Whatsapp, although obviously this is possible.

The use of standard assigned ports for hacking is not new:

Ubuntu - UDP Traffic on port 123

I have noticing that, lately, my Odroid's ethernet LED is constantly blinking, even when I'm expecting no traffic. I ran iptraf and, besides the attempts of SSH brute force guess attempts (that are...

unix.stackexchange.com

having control of ports per app it could help to mitigate this problem. In example, Whatsapp can work with 80,443 and 5322, no more. Then the control would be really simplified with one option to limit ports. per app

However, it seems Netguard by default allows all new traffic to any new ip through any port while the app is authorized.

An improvement in this point would be very needed.

 

[fraschi51]

However, it seems Netguard by default allows all new traffic to any new ip through any port while the app is authorized.

You will be informed about every new attempt to access the Internet and could react immediately.

 

[AW1]

Hi,
I'm trying to setup Netguard to block absolutely everything except Whatsapp, reason being I sometimes go to places with ridiculously expensive data charges. From what I understand Whatsapp needs google play services but when I allow this, google backup transport also gets allowed. From what I have read, google backup transport is not essential for Whatsapp and can use a lot of data. Is there a way to block google backup transport but allow google play services? Or another way to block everything expect Whatsapp?
Thanks.

 

[ItsIgnacioPortal]

Hey @M66B, can we add a a mention of this guide to the FAQ? It provides a solution for question 2:

How to use NetGuard + personalDNSFilter+ Any VPN, without root, without external self-hosted servers.

 

[M66B]

Hey @M66B, can we add a a mention of this guide to the FAQ? It provides a solution for question 2:

Added to FAQ #2. Thanks.

 

[FlowSlo]

@M66B

First of all thanks and props 4 all your apps. Have also 'paid' 4 it cause it worth.
I'm new to Netguard (donotaion will come ) and testing it.
The question i have is the following:

I have wireshark on my network to sniffer. I have blocked all apps (incl system apps) from wi-fi/mobile on my Samsung phone. Also have 'always on vpn' setting on. Android version is 12.

1. When i enable wi-fi on my phone i can still see network traffic from google. DNS request to www.google.com and connectivity.

2. I leave my phone on wi-fi untill i see no network traffic anymore. Then i will tapp on my phone screen to switch it on. Also in this case i see network traffic from google. DNS request and connectivity

Note : I have tried this with and without the 'lock' function off your app

Is this normal leakage or am i doing something wrong ?

 

[M66B]

@M66B

First of all thanks and props 4 all your apps. Have also 'paid' 4 it cause it worth.
I'm new to Netguard (donotaion will come ) and testing it.
The question i have is the following:

I have wireshark on my network to sniffer. I have blocked all apps (incl system apps) from wi-fi/mobile on my Samsung phone. Also have 'always on vpn' setting on. Android version is 12.

1. When i enable wi-fi on my phone i can still see network traffic from google. DNS request to www.google.com and connectivity.

2. I leave my phone on wi-fi untill i see no network traffic anymore. Then i will tapp on my phone screen to switch it on. Also in this case i see network traffic from google. DNS request and connectivity

Note : I have tried this with and without the 'lock' function off your app

Is this normal leakage or am i doing something wrong ?

Please disable private DNS and check this FAQ:

https://github.com/M66B/NetGuard/blob/master/FAQ.md#user-content-faq63

Note that DNS requests is not the same as actual app traffic.

 

[FlowSlo]

Please disable private DNS and check this FAQ:

https://github.com/M66B/NetGuard/blob/master/FAQ.md#user-content-faq63

Note that DNS requests is not the same as actual app traffic.

You are right. I see DNS requests to google but that is not the same as traffic. i will monitor if i see TLS traffic. I am trying to block google traffic