Comment by ignoramous | Hacker News Reader

Comment by ignoramous | Hacker News Reader

Parent Full thread

rdns dev here

Hi, Rethink is more in line with LittleSnitch / LuLu Firewall / Glasswire than NextDNS or Pi-Hole. And it is nothing like Blokada [0]

To illustrate that point, here's some of the features we recently released:

1. Block all connections where an app is deemed to have bypassed user-set DNS (either by using DoH like Telegram does, or connecting straight to hard-coded IPs like WhatsApp and Instagram on occasion).

2. Block all newly installed apps by default. This in particular was apparently helpful for folks in Hong Kong forced to install contact-tracing apps.

3. Per-app IP allowlists. Ideally, you'd set these for apps you tend to use the often and selectively allow it to connect to only a handful no. of IPs (for ex, GMail only to Google-owned IPs; and WhatsApp to Facebook-owned IPs, and so on).

We use a fairly effective heuristic to map DNS names with outgoing IP connections, which comes in handy to impl some of the above features.

Our immediate focus is supporting IPv6 (mostly DNS64, DSLite, & 464Xlat) and embedding WireGuard. If you have any feature requests, I am all ears (:

[0] https://www.reddit.com/r/privacy/comments/nlzyit/opinion_abo...

Thank you for working on this problem space. Solutions are sorely needed.

I am a current NetGuard user, and, at least on a non-rooted device, there is a disclaimer that apps which use Google Play services for their data transfers cannot be individually blocked. Is this a problem to which you have managed to find a solution?

Thanks for your kind words.

> ...there is a disclaimer that apps which use Google Play services for their data transfers cannot be individually blocked.

Well, inter-process communication (IPC) in Android is such that, a firewalled app can still ask another unblocked app to do its biding. This isn't an Android thing but rather a limitation for any multi-tasking OS that has mechanisms for IPC (pretty much establishing the need for MicroVMs, Containers, Jailers and what not).

In Google Play services (GPS) case, of course, the firewalled app can communicate with it and ask it to fetch notifications and such on the app's behalf, and this would succeed. This isn't a firewall leak, because from the firewall's point of view (which isn't a jailer), if GPS isn't firewalled, then its connections are allowed, regardless of whichever app it is connecting on behalf of.

> Is this a problem to which you have managed to find a solution?

A network firewall cannot solve for this unless it MiTMs GPS traffic (which isn't straight-forward on Android since Android supports certificate-pinning). What I'd do instead is either disable or force stop apps I don't use. And the ones I use but want firewalled, I accept that there are IPC mechanisms which provide escape hatches for the app. And short of the OS itself implementing mitigations, there isn't much that a userspace app can do.

Sorry, I ment to say "looks like". This is all really cool, I'll definitely check it out!

This looks great, looking forward to giving it a go.

Interested to see how it works for me though my set up is some what unique in between using Tailscale and NextDNS on my mobile phone. Thanks for creating this, Android is in desperate need of more tools like this.

Reply on news.ycombinator.com