Rethink DNS and Firewall – monitor and control Android app activity

Thanks for your kind words.

> ...there is a disclaimer that apps which use Google Play services for their data transfers cannot be individually blocked.

Well, inter-process communication (IPC) in Android is such that, a firewalled app can still ask another unblocked app to do its biding. This isn't an Android thing but rather a limitation for any multi-tasking OS that has mechanisms for IPC (pretty much establishing the need for MicroVMs, Containers, Jailers and what not).

In Google Play services (GPS) case, of course, the firewalled app can communicate with it and ask it to fetch notifications and such on the app's behalf, and this would succeed. This isn't a firewall leak, because from the firewall's point of view (which isn't a jailer), if GPS isn't firewalled, then its connections are allowed, regardless of whichever app it is connecting on behalf of.

> Is this a problem to which you have managed to find a solution?

A network firewall cannot solve for this unless it MiTMs GPS traffic (which isn't straight-forward on Android since Android supports certificate-pinning). What I'd do instead is either disable or force stop apps I don't use. And the ones I use but want firewalled, I accept that there are IPC mechanisms which provide escape hatches for the app. And short of the OS itself implementing mitigations, there isn't much that a userspace app can do.

A dns name may be mapped to multiple IPs (case 1). Same IP could be mapped to multiple dns names (case 2).

So, if you're blocking an IP, you might end up blocking multiple domains (case 2) or end up not even effectively blocking a single domain (case 1). This confuses users, and you get reports like:

1. I blocked a Google IP but my app still connects to google.com (case 1, since Google owns a gazillion IPs).

2. I blocked a cloudflare.com IP and now can't access reactjs.org (case 2, where IPs are shared).

Some folks find it easier to reason about rules on domain names than IPs. So, blocking/allowing domain names makes for a better user experience, when implemented right.

They seem to be beta testing a paid dns service.

"On-device firewall is free. The in-the-cloud Rethink DNS content-blocking resolver has both free (public beta) and paid tiers (private beta). Currently, pricing isn't implemented and so the private beta is essentially also free till then."

Like another user pointed out, we intend to charge for a cloud-based dns service. We intend to add other anti-censorship / anti-surveillance features too that may incur charges; like reselling a Private Relay like proxy, a remote browser, a disposable chat room, calls, and so on. Of course, a lot depends on if we manage to stay upfloat. We are a small team after all: Just the 2 of us, with zero funds ;)

Yes, like NextDNS / ControlD / AdGuard etc. Just a way to generate funds for the development of the app, so it will likely be way cheaper (think 5x) than existing providers.

But we exist as an anti-censorship and anti-surveillance solution, so expect us to build more than just a content-blocking DNS.

> TrackerControl also supports viewing network activity for each app, and then blocking network access entirely or for specific hosts.

Rethink blocks based on IP addresses (rather than host names). TrackerControl (TC) may be doing something similar (since it runs NetGuard underneath), but in the UI it appears as so that TC is blocking based on host names?

For DNS (host name) based blocks, Rethink bundles in 180+ popular host files (like StevenBlack, 1Hosts, GoodbyeAds, OISD, CPBL) in the app (on GitHub and F-Droid versions only). We are in the process of implementing a allowlist/whitelist and denylist/blocklist for individual host names, as we speak. Release in perhaps a month or so.