8 ms·

NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

253 points by transpute 2y ago

microflash 2y ago
Is there something like this for iOS? I know Adguard but it is not open source.
- transpute 2y ago
  Lockdown claims to be open-source. Their appstore client has paid mode for per-app blocklists. I don't know if they support per-app allow lists. https://github.com/confirmedcode/Lockdown-iOS https://github.com/confirmedcode/Lockdown-iOS
- radicality 2y ago
  Isn’t AdGuard just dns protection (and Safari extension). Afaik something like this isn’t easily doable in iOS. Some options are: * Shadowrocket - you can set complex rules on what hosts/connections should be routed by what, but afaik you are not able to isolate traffic on a per-app basis. * I think you can set up per-app VPN on iOS, but you must use MDM, can’t do it on an unmanaged profile. Link: https://support.apple.com/guide/deployment/vpn-overview-depae3d361d0/web https://support.apple.com/guide/deployment/vpn-overview-depa...
  - transpute 2y ago
    > per-app VPN on iOS, but you must use MDM Yet iOS allows Safari per-site VPN without enterprise MDM, via Apple Configurator profile.
- quaff 2y ago
  https://github.com/AdguardTeam/AdguardForiOS https://github.com/AdguardTeam/AdguardForiOS I am pretty sure it is open source. I’ve been using it for years both for upstream DNS and blocklist filtering.
  - microflash 2y ago
    Huh, didn’t know about the repo. Thanks for posting it here.
- varenc 2y ago
  The APIs to implement traffic policies on a per-app basis just don’t exist on iOS. You can create a VPN connection and have an app manage all network traffic that way, but you can’t associate traffic with specific apps since this would run afoul of their sandbox. At least without jailbreaking.
- newscracker 2y ago
  I came here to ask a similar question, looking for alternatives to Lockdown Privacy on iOS/iPadOS. [1] I've been using Lockdown for some years as a local and system firewall to block trackers across all apps, but this company got sold a few years ago and has since been annoyingly and frequently pushing for its paid subscription. It also moved some free blocking lists to the paid subscription. Any alternatives to Lockdown on iOS/iPadOS would be nice to know about. [1]: https://lockdownprivacy.com/ https://lockdownprivacy.com/
- saagarjha 2y ago
  Only in China I believe.
- zuhsetaqi 2y ago
  Something similar would be Proxyman: https://apps.apple.com/de/app/proxyman-network-debug-tool/id1551292695 https://apps.apple.com/de/app/proxyman-network-debug-tool/id... But it’s more designed to be a debug tool than to block traffic from specific apps
- alibert 2y ago
  Something already included in iOS is App Privacy Report feature. https://support.apple.com/en-us/102188 https://support.apple.com/en-us/102188
  - halfcat 2y ago
    This doesn’t seem to show any site I browse in the DuckDuckGo app, which raises the question, if DDG can hide connections it makes from showing in privacy report, can any (more nefarious) app do the same?
kyleee 2y ago
Software worth paying for. I bought a license for a Google free lineage os phone that I’ve since moved on from, but still use as a media and general purpose computing device.
dsissitka 2y ago
From the developer of FairEmail. Every once in a while I consider making the switch to KeePassXC. I trust KeePassXC but I don't really trust the mobile apps so last time around I looked into NetGuard. It's really nice but it wasn't a good fit for my use case: > NetGuard will do its best, but it is limited by the fact it must use the Android VPN service. This is the trade-off required to make a firewall which does not require root access. The firewall can only start when Android "allows" it to start, so it will not offer protection during early boot-up (although you can disable your network before rebooting). Also, the Android VPN service needs to be restarted to apply new rules when connectivity has changed or when the screen is being turned on or off. It will, however, be much better than nothing. I believe that also means you can't use it with Tailscale or similar.
- transpute 2y ago
  > better than nothing Is "nothing" the only Android per-app outbound firewall alternative to NetGuard?
  - colordrops 2y ago
    No, if you have a rooted phone you can use AFWall+. And there are other non-root firewalls.
  - catlikesshrimp 2y ago
    My favorite is another FOSS, but this one is special because it doesn't need network permissions. No root, ofc, so that sticks. Karma Firewall https://f-droid.org/packages/net.stargw.fok/ https://f-droid.org/packages/net.stargw.fok/
  - pmontra 2y ago
    I've been using Blockada for many years but that's a firewall against ads and trackers. No ads inside apps. Ideally I would use NetGuard to block the apps and Blockada to block ads and trackers for the apps that I allowed to perform network traffic in NetGuard. But Android allows only one active VPN and they can't be chained, so it's a hard choice. Actually it's not so hard: I keep blocking ads and trackers.
stevenhuang 2y ago
Similar but open source: https://github.com/celzero/rethink-app https://github.com/celzero/rethink-app
- transpute 2y ago
  > similar but open source Netguard (per HN title) is open-source GPLv3: https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard Rethink uses cloud services by default? The [DNS] resolver is deployed to Fly.io at max.rethinkdns.com and Deno Deploy at rdns.deno.dev too, apart from the default deployment on Cloudflare Workers.
  - stevenhuang 2y ago
    Right, I saw their pro features listed and skipped over the oss mention. Yes rethink uses public fly resolver by default but you can self host that as well. Apologies, that's something I should have mentioned. https://github.com/serverless-dns/serverless-dns https://github.com/serverless-dns/serverless-dns
  - ignoramous 2y ago
    rdns dev here > Rethink uses cloud services by default? There isn't anything sinister going on here with the use of "cloud services" [0][1]. Rethink, which is geared more towards anti-censorship, has its default resolver "ip-fronted" on Cloudflare (whose IPs are seldom blocked) and it works great in countries where the app is popular. Users can opt to switch to any DoH, DoT, ODoH, DNSCrypt v3 resolver of their choice. In fact, we encourage users on our reddit/telegram groups to use ODoH (we also run a public-facing ODoH proxy) and DNSCrypt upstreams because of their privacy guarantees. [0] If anything, hosting it cost us a bomb: https://old.reddit.com/r/rethinkdns/comments/17h2y6r https://old.reddit.com/r/rethinkdns/comments/17h2y6r / https://archive.md/slpZ9 https://archive.md/slpZ9 [1] Our stub resolvers are open-source & "open deploy" (ie deploy straight from github actions): https://github.com/serverless-dns/serverless-dns/actions/ https://github.com/serverless-dns/serverless-dns/actions/
    - justmarc 2y ago
colordrops 2y ago
If you use a rootless firewall doesn't it act like a VPN? And then you aren't able to use VPNs unless you disable it? Useless IMO for heavy VPN users.
- attendant3446 2y ago
  You can split the usage by profiles (e.g. work profile with Shelter[1]) or separate users. 1. https://f-droid.org/en/packages/net.typeblog.shelter/ https://f-droid.org/en/packages/net.typeblog.shelter/
  - g-b-r 2y ago
    You can also have NetGuard actually go through the VPN (https://news.ycombinator.com/item?id=41933464 https://news.ycombinator.com/item?id=41933464)
lopkeny12ko 2y ago
How do you use this if you already have an always-on VPN enabled?
- dilawar 2y ago
  You cant. It complains that some other VPN is already running.
- g-b-r 2y ago
  There's a somewhat complex way to use it together with another VPN app, with work profiles, see see https://itsignacioportal.github.io/netguard-pdnsf-any-vpn-combo/ https://itsignacioportal.github.io/netguard-pdnsf-any-vpn-co... But in case the VPN app supports running as a simple proxy, without using the VPN service, you can avoid work profiles and just have NetGuard connect to it.
mcsniff 2y ago
AOSP has a pretty well functioning firewall, good enough that GrapheneOS implements and builds on it. https://grapheneos.org/faq#firewall https://grapheneos.org/faq#firewall Yeah there's no stats or traffic info, but until Android has a real way of using multiple VPN interfaces or exposes adding routes to users/apps, these VPN-based local tools are a no-go.
udev4096 2y ago
Afaik, this requires an active VPN connection. With GrapheneOS, there is a network toggle which disables the INTERNET access to any individual app so it doesn't make sense to use NetGuard
- str3wer 2y ago
  > it doesn't make sense to use NetGuard unless you use any other phone that is not a google pixel running GrapheneOS
  - notpushkin 2y ago
    LineageOS has this too, and it’s available on a fair bit of non-Pixel phones.
    - udev4096 2y ago
      LineageOS doesn't really cut off the INTERNET access properly. Graphene's approach is more robust. I still wonder why such an important feature is not in the AOSP itself
      - notpushkin 2y ago
        Hmm, I haven’t looked much into it, but I assumed they both expose the same mechanism from AOSP?
        udev4096 2y ago
        https://grapheneos.org/faq#firewall https://grapheneos.org/faq#firewall
      - aucisson_masque 2y ago
        > still wonder why such an important feature is not in the AOSP itself Really? Remind yourself who works on Android. Google have been removing functionalities that benefit privacy for ever, and then put half backed alternative buried under tons of settings.
notpushkin 2y ago
This is really good. Using it on my Oculus to block connections to Facebook servers. (On my phones, I use LineageOS which can manage network permissions per app right in app settings.)
p0w3n3d 2y ago
I'm using netguard. It's really good, but conflicts with wireguard (another VPN I am using). It's because the firewall is realised using VPN API, when running netguard it uses VPN API to control the traffic
- okso 2y ago
  I am dreaming of an open-source app that adds Wireguard capabilities to NetGuard or vice-versa. Having to switch from one to the other is very annoying.
  - p0w3n3d 2y ago
    especially that Wireguard silently disables NetGuard, and then the communication undergoes (at least in my case) silent
  - thatloststudent 2y ago
    There's no need to dream about it, it already exists: https://f-droid.org/packages/com.celzero.bravedns/ https://f-droid.org/packages/com.celzero.bravedns/ I used to use it when I wasn't on grapheneOS and needed to block internet access.
    - miroljub 2y ago
      It's annoying to see so much RethinkDNS propaganda on every Netguard or Invizible Pro thread on the internet. That gives me a bad feeling, and it's the reason I started to consider RethinkDNS scummy.
      - lightdot 2y ago
        Was the above post propaganda? Or was it just a user recommendation? Perhaps the reason it gets mentioned often is simply because it's a good piece of software. Then again, perhaps not! In any case, I'd be careful about using 3rd party DNS (and other) services, but that's for the user to decide, depending on the situation one is in. Using one's own resolver is always a good practice, even in countries where ISPs are not selling customer's private data to anyone that comes along and where governments don't monitor and repress their citizens on every step... We live in strange times where even EU countries misuse resolvers to censor certain web pages, while, for example, independent Balkan countries do not. Go figure...
okso 2y ago
Installing NetGuard was revelation regarding the amount of tracking in most Android apps. You can configure it to block access by default and notify you every time an app attempts a new connection. And it rings all the time. Some software call home at 4am every day, other every hour, some send data to a dozen "analytics" services - services that I never opted-in for, which shows how few apps respect the RGPD. At least most apps still work when those are blocked, and NetGuard allows you to block connections to Google servers except for Google Apps, which network firewalls and DNS solutions can't.
- 0x1ceb00da 2y ago
  > Some software call home at 4am every day Which app?
  - okso 2y ago
    Not sure anymore since I removed them, it may have been BlaBlaCar and/or Tricount.
- daghamm 2y ago
  [flagged]
  - PawgerZ 2y ago
    I'm curious, how would looking at the Microsoft MFA app convince me that android apps aren't spying on me?
    - daghamm 2y ago
      [flagged]
      - mistermann 2y ago
        You did the same thing above but in the opposite direction.
- 2y ago
user070223 2y ago
Don't forget to periodicly update the hosts file: Settings -> Backup -> Download hosts file. The creator also made XPrivacyLua (hooks Android API system calls to block premissions)
qwertox 2y ago
Its' really telling that Google doesn't offer an API to access a firewall which provides a clear list of connections and the apps which create them and a way to prohibit such specific connections, possibly also according to blacklists. They really don't want users to have control over this.
- ilbeeper 2y ago
  Is it? Do Fedora or Ubuntu provide an API like that?
  - lightdot 2y ago
    You mean, like unrestricted access to the kernel with full firewalling capabilities? ;) Yes, GNU/Linux distributions provide exactly that.
    - irundebian 2y ago
      No, you have to install additional software for that.
      - prophesi 2y ago
        The linux kernel has a built-in firewall, and provides iptables to configure it. Firewalld is also installed by default at least on Fedora, and UFW for debian-based. Unless this is just a battle of semantics on the fact iptables/firewalld/ufw are user space apps.
        irundebian 2y ago
        There is no clean interface to configure app-based network rules.
        prophesi 2y ago
        I think the main gripe is Google's lack of API to access a firewall. It would make sense for the kernel to provide that API and leave the UI to user space apps. Edit: and to clarify, you can have a user space app on Android to configure a firewall but they will either require root or a VPN-based solution like NetGuard.
aucisson_masque 2y ago
Pcapdroid is a very good alternative that allows to see which connections are made from what app to what server and at what time. You just leave it in background, check one day later and see what sneaky app you never thought of have been sending tons of data in the background. For me it helped me remove and search alternative for 4 apps, including a pill reminder (mytherapy). I would never have thought the trade-off to be reminded to take vitamin would be to constantly spy on me and sell all my data. Had i known, I would have put a reminder in my calendar.
- g-b-r 2y ago
  Except that... that doesn't block anything??
  - octygen 2y ago
    Yeah, but you can just uninstall offenders
    - g-b-r 2y ago
      With a firewall you can keep using them, instead (and maybe only let through some of the traffic)
    - aucisson_masque 2y ago
      What about microsoft office ? I want to be able to open word and excel file on my phone, but i don't want to give microsoft access to everything on my phone including dick pics, sextape, bank sheet and other personal data. Because android allows such bad practice, blocking internet access can be usefull.
  - aucisson_masque 2y ago
    it can block, i think it's a 'donation' feature. anyway, it's not the same as netguard. Pcapdroid helps to identify bad application that you can either remove, or if not possible, use netguard later on to block.
palata 2y ago
How does that compare to having filtering done by the VPN? Many VPN services tend to do that nowadays, right?
cinntaile 2y ago
When you try to purchase pro features it should really display the price...
noname120 2y ago
AdGuard is also rootless, but in addition if you have root then it can install a system-wide certificate that enables it to decrypt HTTPS requests to do granular filtering (not just at the domain level). Basically just like uBlock does, except that it's system-wide and works in all apps[1]. [1] Except apps that pin their certificates. But you can exclude those or install another module[2] (not from AdGuard) which disables certificate pinning. [2] For example: https://github.com/cryptoexpertssss/TrustMeAlready https://github.com/cryptoexpertssss/TrustMeAlready
tuananh 2y ago
is this the best available option on Android? Is there any alternative I should give a try?
extraduder_ire 2y ago
While I'm normally not someone who pays for apps, and is annoyed at fdroid releases having paid features, I had such a fun time figuring out and bypassing the challenge/response part of the app (without just commenting it out and recompiling) that I decided to send €1.23 his way.
acidburnNSA 2y ago
Does this show anything at all without purchases? I installed it and turned on notify on access and I have gotten no notifications so far.
- g-b-r 2y ago
  If you downloaded the Play Store version, it can't intercept all the apps
- ldoughty 2y ago
  Looks like most of the information features require a purchase... And the price is only visible at checkout.
awsation 2y ago
Blokada (blokada.org) is another good alternative.
t0bia_s 2y ago
It drains battery because of VPN service solution, which is only non-rooted solution. Also if you use VPN (like Wireguard), you cannot use both. Every app has own settings for allowing WiFi, data, VPN, background data connections natively in Android. I use custom ROM that has turned off internet connection for all apps by default and you need manually allow them to connect. Which solve mine problem with constant unwanted connections. If you want really control over traffic on Android and combine with VPN, try ReThing DNS. https://www.rethinkdns.com/ https://www.rethinkdns.com/
- g-b-r 2y ago
  > It drains battery because of VPN service solution It doesn't really, just try it (and take actual battery duration measurements, Android misreports VPN apps battery usages)
  - t0bia_s 2y ago
    I did, battery drains 5-10% faster.
    - g-b-r 2y ago
      If it's so, it's not a lot for privacy and security --- ReThink DNS uses the VPN service as well, by the way. And it is possible to use two VPN apps, see https://news.ycombinator.com/item?id=41933464 https://news.ycombinator.com/item?id=41933464 (yes, the battery usage adds up). Rethink DNS seems fine, anyhow.
      - ignoramous 2y ago
        (I work on rdns) > ReThink DNS uses the VPN service as well, by the way. Rethink (since a year ago) has had the ability forward connections per-app to multiple WireGuard upstreams at the same time. https://old.reddit.com/r/rethinkdns/comments/15r1eq9/v055_multiple_wireguard_vpns/ https://old.reddit.com/r/rethinkdns/comments/15r1eq9/v055_mu... / https://archive.md/RqUPe https://archive.md/RqUPe (to us, it turned out to be a deceptively difficult thing to integrate with the rest of the firewall).
calvinmorrison 2y ago
NetGuard is amazing. Whats disgusting is that android has so many permissions controls EXCEPT network access! it's insane and its because its just a data vacuuming device.
sheerun 2y ago
LineageOS is fine for me, just I wish I could restrict connections to some ip ranges somehow, like allowing only 10.x.x.x in/out connections from given app on os level
achristmascarl 2y ago
After seeing the post[0] yesterday about how much surveillance can be done using mobile app data that can be bought online by pretty much anyone... I am very happy to learn about NetGuard today. [0] https://news.ycombinator.com/item?id=41923931 https://news.ycombinator.com/item?id=41923931
bramhaag 2y ago
I occasionally set up notifications when apps make requests using NetGuard and let it run for a day. The result is always depressing, lots of apps phoning home that I haven't opened in days... I let it run today, and the worst offenders I have installed are Spotify (various requests to Facebook endpoints, I have no Facebook integration turned on) and Speedtest (constant requests to their logging endpoint and ad partners). This is all happening without me actually using those apps.
o999 2y ago
GrapheneOS has Network as an Android permission, that you can grant/revoke per app
brinerustle 2y ago
I am very happy with IodéOS (a privacy-focused OS based on Lineage) as it has a per-app firewall and adblocker built into the OS. A major drawback of "stock android" is that google itself has elevated privileges, which is a strong argument for degoogling android at the OS level. Until recently, it has been pretty difficult to find a degoogled OS for a given device, (less than 1%) but now with GSIs it's getting better: https://blog.iode.tech/what-are-gsis-and-how-to-install-them/ https://blog.iode.tech/what-are-gsis-and-how-to-install-them...
willywanker 2y ago
Better off disabling advertising components, which of course needs root. There's tools like AppManager for that - https://github.com/MuntashirAkon/AppManager/ https://github.com/MuntashirAkon/AppManager/

253 points by transpute 2y ago

microflash 2y ago

Is there something like this for iOS? I know Adguard but it is not open source.

transpute 2y ago
Lockdown claims to be open-source. Their appstore client has paid mode for per-app blocklists. I don't know if they support per-app allow lists. https://github.com/confirmedcode/Lockdown-iOS https://github.com/confirmedcode/Lockdown-iOS
radicality 2y ago
Isn’t AdGuard just dns protection (and Safari extension). Afaik something like this isn’t easily doable in iOS. Some options are: * Shadowrocket - you can set complex rules on what hosts/connections should be routed by what, but afaik you are not able to isolate traffic on a per-app basis. * I think you can set up per-app VPN on iOS, but you must use MDM, can’t do it on an unmanaged profile. Link: https://support.apple.com/guide/deployment/vpn-overview-depae3d361d0/web https://support.apple.com/guide/deployment/vpn-overview-depa...
- transpute 2y ago
  > per-app VPN on iOS, but you must use MDM Yet iOS allows Safari per-site VPN without enterprise MDM, via Apple Configurator profile.
quaff 2y ago
https://github.com/AdguardTeam/AdguardForiOS https://github.com/AdguardTeam/AdguardForiOS I am pretty sure it is open source. I’ve been using it for years both for upstream DNS and blocklist filtering.
- microflash 2y ago
  Huh, didn’t know about the repo. Thanks for posting it here.
varenc 2y ago
The APIs to implement traffic policies on a per-app basis just don’t exist on iOS. You can create a VPN connection and have an app manage all network traffic that way, but you can’t associate traffic with specific apps since this would run afoul of their sandbox. At least without jailbreaking.
newscracker 2y ago
I came here to ask a similar question, looking for alternatives to Lockdown Privacy on iOS/iPadOS. [1] I've been using Lockdown for some years as a local and system firewall to block trackers across all apps, but this company got sold a few years ago and has since been annoyingly and frequently pushing for its paid subscription. It also moved some free blocking lists to the paid subscription. Any alternatives to Lockdown on iOS/iPadOS would be nice to know about. [1]: https://lockdownprivacy.com/ https://lockdownprivacy.com/
saagarjha 2y ago
Only in China I believe.
zuhsetaqi 2y ago
Something similar would be Proxyman: https://apps.apple.com/de/app/proxyman-network-debug-tool/id1551292695 https://apps.apple.com/de/app/proxyman-network-debug-tool/id... But it’s more designed to be a debug tool than to block traffic from specific apps
alibert 2y ago
Something already included in iOS is App Privacy Report feature. https://support.apple.com/en-us/102188 https://support.apple.com/en-us/102188
- halfcat 2y ago
  This doesn’t seem to show any site I browse in the DuckDuckGo app, which raises the question, if DDG can hide connections it makes from showing in privacy report, can any (more nefarious) app do the same?

kyleee 2y ago

Software worth paying for. I bought a license for a Google free lineage os phone that I’ve since moved on from, but still use as a media and general purpose computing device.

dsissitka 2y ago

From the developer of FairEmail. Every once in a while I consider making the switch to KeePassXC. I trust KeePassXC but I don't really trust the mobile apps so last time around I looked into NetGuard. It's really nice but it wasn't a good fit for my use case: > NetGuard will do its best, but it is limited by the fact it must use the Android VPN service. This is the trade-off required to make a firewall which does not require root access. The firewall can only start when Android "allows" it to start, so it will not offer protection during early boot-up (although you can disable your network before rebooting). Also, the Android VPN service needs to be restarted to apply new rules when connectivity has changed or when the screen is being turned on or off. It will, however, be much better than nothing. I believe that also means you can't use it with Tailscale or similar.

transpute 2y ago
> better than nothing Is "nothing" the only Android per-app outbound firewall alternative to NetGuard?
- colordrops 2y ago
  No, if you have a rooted phone you can use AFWall+. And there are other non-root firewalls.
- catlikesshrimp 2y ago
  My favorite is another FOSS, but this one is special because it doesn't need network permissions. No root, ofc, so that sticks. Karma Firewall https://f-droid.org/packages/net.stargw.fok/ https://f-droid.org/packages/net.stargw.fok/
- pmontra 2y ago
  I've been using Blockada for many years but that's a firewall against ads and trackers. No ads inside apps. Ideally I would use NetGuard to block the apps and Blockada to block ads and trackers for the apps that I allowed to perform network traffic in NetGuard. But Android allows only one active VPN and they can't be chained, so it's a hard choice. Actually it's not so hard: I keep blocking ads and trackers.

stevenhuang 2y ago

Similar but open source: https://github.com/celzero/rethink-app https://github.com/celzero/rethink-app

transpute 2y ago
> similar but open source Netguard (per HN title) is open-source GPLv3: https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard Rethink uses cloud services by default? The [DNS] resolver is deployed to Fly.io at max.rethinkdns.com and Deno Deploy at rdns.deno.dev too, apart from the default deployment on Cloudflare Workers.
- stevenhuang 2y ago
  Right, I saw their pro features listed and skipped over the oss mention. Yes rethink uses public fly resolver by default but you can self host that as well. Apologies, that's something I should have mentioned. https://github.com/serverless-dns/serverless-dns https://github.com/serverless-dns/serverless-dns
- ignoramous 2y ago
  rdns dev here > Rethink uses cloud services by default? There isn't anything sinister going on here with the use of "cloud services" [0][1]. Rethink, which is geared more towards anti-censorship, has its default resolver "ip-fronted" on Cloudflare (whose IPs are seldom blocked) and it works great in countries where the app is popular. Users can opt to switch to any DoH, DoT, ODoH, DNSCrypt v3 resolver of their choice. In fact, we encourage users on our reddit/telegram groups to use ODoH (we also run a public-facing ODoH proxy) and DNSCrypt upstreams because of their privacy guarantees. [0] If anything, hosting it cost us a bomb: https://old.reddit.com/r/rethinkdns/comments/17h2y6r https://old.reddit.com/r/rethinkdns/comments/17h2y6r / https://archive.md/slpZ9 https://archive.md/slpZ9 [1] Our stub resolvers are open-source & "open deploy" (ie deploy straight from github actions): https://github.com/serverless-dns/serverless-dns/actions/ https://github.com/serverless-dns/serverless-dns/actions/
  - justmarc 2y ago

colordrops 2y ago

If you use a rootless firewall doesn't it act like a VPN? And then you aren't able to use VPNs unless you disable it? Useless IMO for heavy VPN users.

attendant3446 2y ago
You can split the usage by profiles (e.g. work profile with Shelter[1]) or separate users. 1. https://f-droid.org/en/packages/net.typeblog.shelter/ https://f-droid.org/en/packages/net.typeblog.shelter/
- g-b-r 2y ago
  You can also have NetGuard actually go through the VPN (https://news.ycombinator.com/item?id=41933464 https://news.ycombinator.com/item?id=41933464)

lopkeny12ko 2y ago

How do you use this if you already have an always-on VPN enabled?

dilawar 2y ago
You cant. It complains that some other VPN is already running.
g-b-r 2y ago
There's a somewhat complex way to use it together with another VPN app, with work profiles, see see https://itsignacioportal.github.io/netguard-pdnsf-any-vpn-combo/ https://itsignacioportal.github.io/netguard-pdnsf-any-vpn-co... But in case the VPN app supports running as a simple proxy, without using the VPN service, you can avoid work profiles and just have NetGuard connect to it.

mcsniff 2y ago

AOSP has a pretty well functioning firewall, good enough that GrapheneOS implements and builds on it. https://grapheneos.org/faq#firewall https://grapheneos.org/faq#firewall Yeah there's no stats or traffic info, but until Android has a real way of using multiple VPN interfaces or exposes adding routes to users/apps, these VPN-based local tools are a no-go.

udev4096 2y ago

Afaik, this requires an active VPN connection. With GrapheneOS, there is a network toggle which disables the INTERNET access to any individual app so it doesn't make sense to use NetGuard

str3wer 2y ago
> it doesn't make sense to use NetGuard unless you use any other phone that is not a google pixel running GrapheneOS
- notpushkin 2y ago
  LineageOS has this too, and it’s available on a fair bit of non-Pixel phones.
  - udev4096 2y ago
    LineageOS doesn't really cut off the INTERNET access properly. Graphene's approach is more robust. I still wonder why such an important feature is not in the AOSP itself
    - notpushkin 2y ago
      Hmm, I haven’t looked much into it, but I assumed they both expose the same mechanism from AOSP?
      - udev4096 2y ago
        https://grapheneos.org/faq#firewall https://grapheneos.org/faq#firewall
    - aucisson_masque 2y ago
      > still wonder why such an important feature is not in the AOSP itself Really? Remind yourself who works on Android. Google have been removing functionalities that benefit privacy for ever, and then put half backed alternative buried under tons of settings.

notpushkin 2y ago

This is really good. Using it on my Oculus to block connections to Facebook servers. (On my phones, I use LineageOS which can manage network permissions per app right in app settings.)

p0w3n3d 2y ago

I'm using netguard. It's really good, but conflicts with wireguard (another VPN I am using). It's because the firewall is realised using VPN API, when running netguard it uses VPN API to control the traffic

okso 2y ago
I am dreaming of an open-source app that adds Wireguard capabilities to NetGuard or vice-versa. Having to switch from one to the other is very annoying.
- p0w3n3d 2y ago
  especially that Wireguard silently disables NetGuard, and then the communication undergoes (at least in my case) silent
- thatloststudent 2y ago
  There's no need to dream about it, it already exists: https://f-droid.org/packages/com.celzero.bravedns/ https://f-droid.org/packages/com.celzero.bravedns/ I used to use it when I wasn't on grapheneOS and needed to block internet access.
  - miroljub 2y ago
    It's annoying to see so much RethinkDNS propaganda on every Netguard or Invizible Pro thread on the internet. That gives me a bad feeling, and it's the reason I started to consider RethinkDNS scummy.
    - lightdot 2y ago
      Was the above post propaganda? Or was it just a user recommendation? Perhaps the reason it gets mentioned often is simply because it's a good piece of software. Then again, perhaps not! In any case, I'd be careful about using 3rd party DNS (and other) services, but that's for the user to decide, depending on the situation one is in. Using one's own resolver is always a good practice, even in countries where ISPs are not selling customer's private data to anyone that comes along and where governments don't monitor and repress their citizens on every step... We live in strange times where even EU countries misuse resolvers to censor certain web pages, while, for example, independent Balkan countries do not. Go figure...

okso 2y ago

Installing NetGuard was revelation regarding the amount of tracking in most Android apps. You can configure it to block access by default and notify you every time an app attempts a new connection. And it rings all the time. Some software call home at 4am every day, other every hour, some send data to a dozen "analytics" services - services that I never opted-in for, which shows how few apps respect the RGPD. At least most apps still work when those are blocked, and NetGuard allows you to block connections to Google servers except for Google Apps, which network firewalls and DNS solutions can't.

0x1ceb00da 2y ago
> Some software call home at 4am every day Which app?
- okso 2y ago
  Not sure anymore since I removed them, it may have been BlaBlaCar and/or Tricount.
daghamm 2y ago
[flagged]
- PawgerZ 2y ago
  I'm curious, how would looking at the Microsoft MFA app convince me that android apps aren't spying on me?
  - daghamm 2y ago
    [flagged]
    - mistermann 2y ago
      You did the same thing above but in the opposite direction.
2y ago

user070223 2y ago

Don't forget to periodicly update the hosts file: Settings -> Backup -> Download hosts file. The creator also made XPrivacyLua (hooks Android API system calls to block premissions)

qwertox 2y ago

Its' really telling that Google doesn't offer an API to access a firewall which provides a clear list of connections and the apps which create them and a way to prohibit such specific connections, possibly also according to blacklists. They really don't want users to have control over this.

ilbeeper 2y ago
Is it? Do Fedora or Ubuntu provide an API like that?
- lightdot 2y ago
  You mean, like unrestricted access to the kernel with full firewalling capabilities? ;) Yes, GNU/Linux distributions provide exactly that.
  - irundebian 2y ago
    No, you have to install additional software for that.
    - prophesi 2y ago
      The linux kernel has a built-in firewall, and provides iptables to configure it. Firewalld is also installed by default at least on Fedora, and UFW for debian-based. Unless this is just a battle of semantics on the fact iptables/firewalld/ufw are user space apps.
      - irundebian 2y ago
        There is no clean interface to configure app-based network rules.
        prophesi 2y ago
        I think the main gripe is Google's lack of API to access a firewall. It would make sense for the kernel to provide that API and leave the UI to user space apps. Edit: and to clarify, you can have a user space app on Android to configure a firewall but they will either require root or a VPN-based solution like NetGuard.

aucisson_masque 2y ago

Pcapdroid is a very good alternative that allows to see which connections are made from what app to what server and at what time. You just leave it in background, check one day later and see what sneaky app you never thought of have been sending tons of data in the background. For me it helped me remove and search alternative for 4 apps, including a pill reminder (mytherapy). I would never have thought the trade-off to be reminded to take vitamin would be to constantly spy on me and sell all my data. Had i known, I would have put a reminder in my calendar.

g-b-r 2y ago
Except that... that doesn't block anything??
- octygen 2y ago
  Yeah, but you can just uninstall offenders
  - g-b-r 2y ago
    With a firewall you can keep using them, instead (and maybe only let through some of the traffic)
  - aucisson_masque 2y ago
    What about microsoft office ? I want to be able to open word and excel file on my phone, but i don't want to give microsoft access to everything on my phone including dick pics, sextape, bank sheet and other personal data. Because android allows such bad practice, blocking internet access can be usefull.
- aucisson_masque 2y ago
  it can block, i think it's a 'donation' feature. anyway, it's not the same as netguard. Pcapdroid helps to identify bad application that you can either remove, or if not possible, use netguard later on to block.

palata 2y ago

How does that compare to having filtering done by the VPN? Many VPN services tend to do that nowadays, right?

cinntaile 2y ago

When you try to purchase pro features it should really display the price...

noname120 2y ago

AdGuard is also rootless, but in addition if you have root then it can install a system-wide certificate that enables it to decrypt HTTPS requests to do granular filtering (not just at the domain level). Basically just like uBlock does, except that it's system-wide and works in all apps[1]. [1] Except apps that pin their certificates. But you can exclude those or install another module[2] (not from AdGuard) which disables certificate pinning. [2] For example: https://github.com/cryptoexpertssss/TrustMeAlready https://github.com/cryptoexpertssss/TrustMeAlready

tuananh 2y ago

is this the best available option on Android? Is there any alternative I should give a try?

extraduder_ire 2y ago

While I'm normally not someone who pays for apps, and is annoyed at fdroid releases having paid features, I had such a fun time figuring out and bypassing the challenge/response part of the app (without just commenting it out and recompiling) that I decided to send €1.23 his way.

acidburnNSA 2y ago

Does this show anything at all without purchases? I installed it and turned on notify on access and I have gotten no notifications so far.

g-b-r 2y ago
If you downloaded the Play Store version, it can't intercept all the apps
ldoughty 2y ago
Looks like most of the information features require a purchase... And the price is only visible at checkout.

awsation 2y ago

Blokada (blokada.org) is another good alternative.

t0bia_s 2y ago

It drains battery because of VPN service solution, which is only non-rooted solution. Also if you use VPN (like Wireguard), you cannot use both. Every app has own settings for allowing WiFi, data, VPN, background data connections natively in Android. I use custom ROM that has turned off internet connection for all apps by default and you need manually allow them to connect. Which solve mine problem with constant unwanted connections. If you want really control over traffic on Android and combine with VPN, try ReThing DNS. https://www.rethinkdns.com/ https://www.rethinkdns.com/

g-b-r 2y ago
> It drains battery because of VPN service solution It doesn't really, just try it (and take actual battery duration measurements, Android misreports VPN apps battery usages)
- t0bia_s 2y ago
  I did, battery drains 5-10% faster.
  - g-b-r 2y ago
    If it's so, it's not a lot for privacy and security --- ReThink DNS uses the VPN service as well, by the way. And it is possible to use two VPN apps, see https://news.ycombinator.com/item?id=41933464 https://news.ycombinator.com/item?id=41933464 (yes, the battery usage adds up). Rethink DNS seems fine, anyhow.
    - ignoramous 2y ago
      (I work on rdns) > ReThink DNS uses the VPN service as well, by the way. Rethink (since a year ago) has had the ability forward connections per-app to multiple WireGuard upstreams at the same time. https://old.reddit.com/r/rethinkdns/comments/15r1eq9/v055_multiple_wireguard_vpns/ https://old.reddit.com/r/rethinkdns/comments/15r1eq9/v055_mu... / https://archive.md/RqUPe https://archive.md/RqUPe (to us, it turned out to be a deceptively difficult thing to integrate with the rest of the firewall).

calvinmorrison 2y ago

NetGuard is amazing. Whats disgusting is that android has so many permissions controls EXCEPT network access! it's insane and its because its just a data vacuuming device.

sheerun 2y ago

LineageOS is fine for me, just I wish I could restrict connections to some ip ranges somehow, like allowing only 10.x.x.x in/out connections from given app on os level

achristmascarl 2y ago

After seeing the post[0] yesterday about how much surveillance can be done using mobile app data that can be bought online by pretty much anyone... I am very happy to learn about NetGuard today. [0] https://news.ycombinator.com/item?id=41923931 https://news.ycombinator.com/item?id=41923931

bramhaag 2y ago

I occasionally set up notifications when apps make requests using NetGuard and let it run for a day. The result is always depressing, lots of apps phoning home that I haven't opened in days... I let it run today, and the worst offenders I have installed are Spotify (various requests to Facebook endpoints, I have no Facebook integration turned on) and Speedtest (constant requests to their logging endpoint and ad partners). This is all happening without me actually using those apps.

o999 2y ago

GrapheneOS has Network as an Android permission, that you can grant/revoke per app

brinerustle 2y ago

I am very happy with IodéOS (a privacy-focused OS based on Lineage) as it has a per-app firewall and adblocker built into the OS. A major drawback of "stock android" is that google itself has elevated privileges, which is a strong argument for degoogling android at the OS level. Until recently, it has been pretty difficult to find a degoogled OS for a given device, (less than 1%) but now with GSIs it's getting better: https://blog.iode.tech/what-are-gsis-and-how-to-install-them/ https://blog.iode.tech/what-are-gsis-and-how-to-install-them...

willywanker 2y ago

Better off disabling advertising components, which of course needs root. There's tools like AppManager for that - https://github.com/MuntashirAkon/AppManager/ https://github.com/MuntashirAkon/AppManager/