Um.... Wtf?

Using Rethink DNS app btw, I want to use a firewall and VPN at the same time on Android. Wtf?!?

So my IP has somehow just been leaking all this time...

Edit: Typo

34 comments

you are doing nothing wrong. To my knowledge, there is no effective firewall app for android that doesn't occupy the VPN connection. From my understanding, you either have a VPN or a firewall. I have found no work around for both that was effective.
- I mean, Rethink DNS was working, then it broke. 😓
  I mean, I switched to a different wireguard config and it seems to work, I'll see if it breaks in a few days...
  
  I have a strange bug where RethinkDNS wireguard session keeps failling after a while if my phone is not used for a while.
  I have to reconnect my wireguard session or it just doesn't work. I need to ADB and check the logs to see what's happening and write some kind of bug report to rethink's DNS bug tracking support.
  It's not the first time they have some kind of misbehave with their firewall and wireguard tunnel. Other than that, RethinkDNS rocks !!
- yes, but actually no.
  there are apps (like rethink DNS) that pack multiple functions in the app. if an app is being used to handle a VPN connection, it gets to process all your network traffic, see for each packet which app does it belong to, and can do both firewalling, split tunneling by app or type of traffic, and can also filter packets. most VPN apps just don't bother with it because its a complex task, and most users wouldn't use it anyway.
  There's also AFWall+ that can configure the kernel's firewall with root permissions, without setting itself up to handle a V0N connection.
  both of these apps are available on f-droid
- Invizible Pro is the best option here. Uses Tor not a VPN though. Does firewall, i2p, and DNS. Is on FDroid
- Same, that's why I stopped using rethink a while ago, even though I loved it.
- I use tasker. Is SSID name "my home SSID name"?
  Yes: disable wireguard
  No: enable wireguard
  Always on vpn. I have no need to use these other VPNs like everyone else is, but if I were I'd set that up on my opnsense firewall at home. That way everything in my network, and my phone's when away from home, are all tunnelled through the VPN provider. Opnsense does all the content filtering and security stuff well enough for my needs.

Did you activate "block connections without vpn" aka kill switch?
There's only one vpn slot on android. How do you tunnel the connection without a second device?
Did you activate "always on vpn"?
- I do, along with "block connections without VPN", but traffic goes through either way 🤷‍♂️
  
  Tgen it's a bug. Can you reproduce it? Which os?
- must be firewall > socks > wireguard > vpn
  2nd question on netGuard FAQ https://github.com/M66B/NetGuard/blob/master/FAQ.md

Oh, you got to use the always-on vpn setting on android. I don't even trust that not to leak, but it's a must.
- I did, also the "Block Connections without VPN", idk what happened. The VPN logo (the little key looking symbol) is showing up, so its not the Android system leaking it, something is buggy with the Rethink DNS app. Oh well, its FOSS, I can't blame anyone.
  
  That's a real bad bug if the failure condition is to bypass your system security settings.
  I saw after I commented that you had already configured it to block. Didnt feel necessary to correct it..

are you using DNS-over-TLS?
i don't use nextDNS app. Is nextDNS app using nextDNS by default?
i had to try different configurations to get what you're trying to get (firewall + vpn without leaks)
- are you using DNS-over-TLS?
  I manually copy pasted mullvad's DNS into DNS over TLS
  
  which vpn are you using?

https://www.dnsleaktest.com/
- Funny thing is, DNS shows as Mullvad (because I manually set it in the Rethink DNS app), but IP is not Mullvad's
  
  What happens when you let mullvad handle your dns?

I have this exact same issue with Proton VPN using RethinkDNS...my Wireguard proxy works for a while but then randomly cuts out (on my second user profile). In my case it looks like there's a kill switch when that happens at least but still...can't find any reason why it keeps dropping.

You want two VPN connection at the same time? I'm not sure it's possible
- Um, no that's not what I meant.
  Its one VPN, but any "Firewall" apps in Android also use the "VPN" function. And you can't have both on android.
  So the only app that does both a VPN and Firewall at the same time is Rethink DNS, and the problem with this app is: ⬆️
  
  If you're using Mulvad it has DNS content block

You can configure Rethink to use always on VPN inside the app.

34 comments