6 ms·

Someone else posted that this isn't a feature they would look for in a VPN, and I'd mostly agree except for one big problem: VPNs are the only way to effectivel

Someone else posted that this isn't a feature they would look for in a VPN, and I'd mostly agree except for one big problem: VPNs are the only way to effectively block things in iOS and (un-rooted) Android, and you can only have one VPN active at a time. This means that you have to choose between either having a proper VPN connected or a fake one to block content you don't like. Mullvad's ads, trackers and malware blocking DNS has been awesome when I'm on my iPhone and don't want to deal with ads in apps. I'm sure some other people who have dependence issues with gambling or adult content would appreciate being able to use their preferred VPN while also blocking content.

jeroenhd 4y ago
As I've recently been made aware here on HN, on Android system applications can bind to an arbitrary interface so they can effectively bypass the VPN system. I don't think it happens often in practice, but it's something to keep in mind.
- flas9sd 4y ago
  on paper (Android 8 and up) has the always-on type VPN that blocks any network connection not using the vpn (disallows bypass). Didn't poke it yet how it works if multiple apps create VPNs, I assume only one VPN of this type can be active
  - jeroenhd 4y ago
    The single app restriction is a consequence of how the API works, but the always on VPN doesn't prohibit system apps from binding to an interface and bypassing the VPN configuration. This kind of makes sense, you probably want a modem manager to talk to the modem interface directly, but it can be abused by data hungry manufacturers and perhaps Google.
    - flas9sd 4y ago
      thanks for your clarification. With custom roms there is at least user control on system apps and their permissions.
yewenjie 4y ago
Doesn't Android have a private DNS server option now?
- rand49an 4y ago
  Yes, I NextDNS with this option and it works great.
cntrl 4y ago
By using a WireGuard VPN you could actually be connected to multiple endpoints at a time, if you are able to set the same tunnel IP for all endpoints. That would enable you to have that one connection open routing to different servers (Mullvad / Homelab / Offsite Lab / Work / etc ...) hence also using your own DNS resolver with a commercial VPN.
tambeb 4y ago
Android, since Pie, supports DNS over TLS, and I personally use it for ad blocking.
Arubis 4y ago
Without disagreeing that folks would want an all-in-one solution, a potential alternative is to use a service like https://nextdns.io/ https://nextdns.io/ in addition to your VPN.
- comprev 4y ago
  Upvote for NextDNS. Their platform has been a game changer for me on all devices/computers and really enjoy the granularity of filtering. Happy customer here!
- notRobot 4y ago
  On Android, the NextDNS app registers itself as a VPN, so you can't use it simultaneously with, say, Mullvad. The custom DNS option in Android's network settings rarely seems to work in my experience, but I haven't tried in a couple years.
  - sha-3 4y ago
    It has almost always worked on my devices though.
    - zinekeller 4y ago
      If you're only using Pixels, don't underestimate how bad OEMs can screw up their version of Android.
  - onlyusername 4y ago
    >On Android, the NextDNS app registers itself as a VPN It does this for macOS and iOS too, which has caused issues when both were trying to set the DNS on the machines.
    - whatsthatabout 4y ago
      This is particularly unlucky for macOS if you want to use a application-firewall like "Little Snitch" - since Apple removed kernelextensions on macOS (which LittleSnitch and others used before) they now have to also fake a VPN. Because of this, you cannot use a custom DNS and Little Snitch. [1] [1]:https://github.com/AdguardTeam/AdGuardDNS/issues/214 https://github.com/AdguardTeam/AdGuardDNS/issues/214
neonsunset 4y ago
If you only need Safari, AdGuard does a surprisingly good job, far superior than what you can get on Android.
- ugjka 4y ago
  On Android you can have Firefox with uBlock origin
  - hgazx 4y ago
    He said superior.
    - scopecreep 4y ago
      Doesn't AdGuard allow 'approved ads'?
achairapart 4y ago
On iOS you can install a configuration profile that setup a DNS-over-HTTPS endpoint without touching the VPN settings. NextDNS does this when you install their app from what I remember. For other examples, see the profiles offered by AhaDNS.com[0]. On Android there is a Private DNS option where you can also setup a DNS-over-HTTPS endpoint of your choice. These options may be also a better choice for battery life than a fake VPN connection. [0]: https://github.com/AhaDNS/setup-guides/blob/master/Apple/iOS.md https://github.com/AhaDNS/setup-guides/blob/master/Apple/iOS...
- rsync 4y ago
  The android setting wherein you can input a standard DNS-over-HTTPS endpoint is sensible and sane. Is it, in fact, correct that there is no such setting in iOS and has to be app-enabled ? Or are you saying I can either manage the device with configurator2 and put that setting in or I can install an app (like nextdns) that does it for me ? Really frustrating that simple config options like DNS server and setting the name of your hotspot SSID are nonexistent in iOS ...
  - achairapart 4y ago
    In iOS from what I know you need a configuration profile for that, I don't think it needs to be signed. Yes, you can make one with Apple Configurator 2, but there is also some tooling/app that may help, like: https://dns.notjakob.com/ https://dns.notjakob.com/ https://github.com/kkk669/DNSecure https://github.com/kkk669/DNSecure
- whatsthatabout 4y ago
  Is this really true? Because on macOS exactly this "workaround" does not work: https://github.com/AdguardTeam/AdGuardDNS/issues/214 https://github.com/AdguardTeam/AdGuardDNS/issues/214
  - achairapart 4y ago
    Sorry, I can't tell for macOS, but on iOS i have a few DNS profiles and they all seems to work.
sillysaurusx 4y ago
Wait, Mullvad acts as an adblocker for iOS? That’s wonderful. I didn’t know such a thing existed.
- deleted 4y ago
  [deleted]

jeroenhd 4y ago

As I've recently been made aware here on HN, on Android system applications can bind to an arbitrary interface so they can effectively bypass the VPN system. I don't think it happens often in practice, but it's something to keep in mind.

flas9sd 4y ago
on paper (Android 8 and up) has the always-on type VPN that blocks any network connection not using the vpn (disallows bypass). Didn't poke it yet how it works if multiple apps create VPNs, I assume only one VPN of this type can be active
- jeroenhd 4y ago
  The single app restriction is a consequence of how the API works, but the always on VPN doesn't prohibit system apps from binding to an interface and bypassing the VPN configuration. This kind of makes sense, you probably want a modem manager to talk to the modem interface directly, but it can be abused by data hungry manufacturers and perhaps Google.
  - flas9sd 4y ago
    thanks for your clarification. With custom roms there is at least user control on system apps and their permissions.

yewenjie 4y ago

Doesn't Android have a private DNS server option now?

rand49an 4y ago
Yes, I NextDNS with this option and it works great.

cntrl 4y ago

By using a WireGuard VPN you could actually be connected to multiple endpoints at a time, if you are able to set the same tunnel IP for all endpoints. That would enable you to have that one connection open routing to different servers (Mullvad / Homelab / Offsite Lab / Work / etc ...) hence also using your own DNS resolver with a commercial VPN.

tambeb 4y ago

Android, since Pie, supports DNS over TLS, and I personally use it for ad blocking.

Arubis 4y ago

Without disagreeing that folks would want an all-in-one solution, a potential alternative is to use a service like https://nextdns.io/ https://nextdns.io/ in addition to your VPN.

comprev 4y ago
Upvote for NextDNS. Their platform has been a game changer for me on all devices/computers and really enjoy the granularity of filtering. Happy customer here!
notRobot 4y ago
On Android, the NextDNS app registers itself as a VPN, so you can't use it simultaneously with, say, Mullvad. The custom DNS option in Android's network settings rarely seems to work in my experience, but I haven't tried in a couple years.
- sha-3 4y ago
  It has almost always worked on my devices though.
  - zinekeller 4y ago
    If you're only using Pixels, don't underestimate how bad OEMs can screw up their version of Android.
- onlyusername 4y ago
  >On Android, the NextDNS app registers itself as a VPN It does this for macOS and iOS too, which has caused issues when both were trying to set the DNS on the machines.
  - whatsthatabout 4y ago
    This is particularly unlucky for macOS if you want to use a application-firewall like "Little Snitch" - since Apple removed kernelextensions on macOS (which LittleSnitch and others used before) they now have to also fake a VPN. Because of this, you cannot use a custom DNS and Little Snitch. [1] [1]:https://github.com/AdguardTeam/AdGuardDNS/issues/214 https://github.com/AdguardTeam/AdGuardDNS/issues/214

neonsunset 4y ago

If you only need Safari, AdGuard does a surprisingly good job, far superior than what you can get on Android.

ugjka 4y ago
On Android you can have Firefox with uBlock origin
- hgazx 4y ago
  He said superior.
  - scopecreep 4y ago
    Doesn't AdGuard allow 'approved ads'?

achairapart 4y ago

On iOS you can install a configuration profile that setup a DNS-over-HTTPS endpoint without touching the VPN settings. NextDNS does this when you install their app from what I remember. For other examples, see the profiles offered by AhaDNS.com[0]. On Android there is a Private DNS option where you can also setup a DNS-over-HTTPS endpoint of your choice. These options may be also a better choice for battery life than a fake VPN connection. [0]: https://github.com/AhaDNS/setup-guides/blob/master/Apple/iOS.md https://github.com/AhaDNS/setup-guides/blob/master/Apple/iOS...

rsync 4y ago
The android setting wherein you can input a standard DNS-over-HTTPS endpoint is sensible and sane. Is it, in fact, correct that there is no such setting in iOS and has to be app-enabled ? Or are you saying I can either manage the device with configurator2 and put that setting in or I can install an app (like nextdns) that does it for me ? Really frustrating that simple config options like DNS server and setting the name of your hotspot SSID are nonexistent in iOS ...
- achairapart 4y ago
  In iOS from what I know you need a configuration profile for that, I don't think it needs to be signed. Yes, you can make one with Apple Configurator 2, but there is also some tooling/app that may help, like: https://dns.notjakob.com/ https://dns.notjakob.com/ https://github.com/kkk669/DNSecure https://github.com/kkk669/DNSecure
whatsthatabout 4y ago
Is this really true? Because on macOS exactly this "workaround" does not work: https://github.com/AdguardTeam/AdGuardDNS/issues/214 https://github.com/AdguardTeam/AdGuardDNS/issues/214
- achairapart 4y ago
  Sorry, I can't tell for macOS, but on iOS i have a few DNS profiles and they all seems to work.

sillysaurusx 4y ago

Wait, Mullvad acts as an adblocker for iOS? That’s wonderful. I didn’t know such a thing existed.

deleted 4y ago
[deleted]