Rethink DNS + Firewall + VPN for Android

A WireGuard client, an OpenSnitch-inspired firewall and network monitor + a pi-hole-inspired DNS over HTTPS, DNS over TLS, DNSCrypt client with blocklists.

^{Release certificate SHA-256 digest: 1f32d432e81a1dc5c00aafeb0c6636cd7819965d174420e59db9675dff7a88e9.}

In other words, Rethink DNS + Firewall + VPN has three primary modes, VPN, DNS, and Firewall. The VPN (proxifier) mode supports multiple WireGuard upstreams in a split-tunnel configuration. The DNS mode routes all DNS traffic generated by apps to any user-chosen DNS-over-HTTPS / DNS-over-TLS / DNSCrypt resolver, or to WireGuard-configured DNS in a split-tunnel configuration. The Firewall mode lets the user deny internet-access to entire applications based on events like screen-on / screen-off, app-foreground / app-background, unmetered-connection / metered-connection; or based on play-store defined categories like Social, Games, Utility, Productivity; or additionally, based on user-defined domain & IP denylists.

^{screenshots from v055e.}

VPN / Proxifier

Rethink supports forwarding TCP & UDP over SOCKS5, HTTP CONNECT, and WireGuard tunnels. Split-tunneling further helps run multiple such tunnels at the same time and lets users route different apps over different tunnels. For example, one could route Firefox over SOCKS5 connecting to Tor, Netflix over WireGuard connecting through any popular VPN provider, and Telegram or WhatsApp over censorship-resistant HTTP CONNECT endpoints at the same time.

Firewall

The firewall doesn't really care about the connections per se rather what's making those connections. This is different from the traditional firewalls but in-line with Little Snitch, LuLu, Glasswire and others.

Currently, per-app connection mapping is implemented by capturing udp and tcp connections managed by firestack (written in golang) and asking ConnectivityService for the owner, an API available only on Android 10 or higher. procfs (/proc/net/tcp and /proc/net/udp) is read on-demand to track per-app connections like NetGuard or OpenSnitch do, on Android 9 and lower versions.

Network Monitor

A network monitor is a per-app report-card of sorts on when connections were made, how many were made, and to where. Tracking UDP / TCP (and DNS on Android 12+) is straight-forward. DNS are trickier to track on Android 11 and below, and so a rough heuristic is used for now, which may not hold good in all cases.

DNS over HTTPS client

Almost all of the network related code (firestack), including DNS over HTTPS split-tunnel, is a hard fork of Jigsaw-Code/outline-go-tun2socks written in golang. The UI is vastly different but borrows minimally from Jigsaw-Code/Intra. A split-tunnel traps requests sent to the VPN's DNS endpoint and relays it to a DNS-over-HTTPS / DNS-over-TLS / DNSCrypt / Oblivious DNS-over-HTTPS endpoint of the user's choosing, logging the end-to-end latency, time of request, the DNS request query itself, and its answer.

The Rethink DNS Resolver

A malware and ad-blocking DNS over HTTPS resolver at https://sky.rethinkdns.com/rs (deployed to 300+ locations world-wide via Cloudflare Workers) is the default DNS endpoint on the app, though the user is free to change that. A configurable DNS resolver that lets users add or remove denylists and allowlists, add rewrites, analyse DNS requests is launching late 2026. Right now, a free-to-use DNS over HTTPS endpoint with custom blocklists can be setup here: rethinkdns.com/configure.

The resolver, sponsored by FLOSS/fund, is deployed to Fly.io at max.rethinkdns.com, and Deno Deploy at rdns.deno.dev too, apart from the default deployment on Cloudflare Workers. The resolver is open source software: serverless-dns.

The Rethink Proxy Network

RPN is a multi-party relay, with connections hopping over serverless proxy (hosted on Cloudflare Workers) exiting through Windscribe. Users would be able to self-host the first hop or use the ones run by us. At launch in Dec 2025, this service would cost $3/month for unlimited bandwidth.

The proxy is open source software: serverless-proxy.

Community

• The telegram community is super active and full of crypto-bros. Kidding. We are generally a welcoming bunch. Feel free to get in touch: t.me/rethinkdns.
• Or, if you prefer Matrix (which is bridged to Telegram): #rethinkdns:matrix.org (or: !jrTSpJiEkFNNBMhSaE:matrix.org).
• Or, email us: hello@celzero.com (we read all emails immediately and reply once we fix the issues being reported).
• We regularly hangout in our subreddit: r/rethinkdns.
• We're also kind of active on the bird and toot apps, mostly nerd-sniping other engs or shit-posting about our tech stack: twitter/rethinkdns, mastodon/rdns.

Translation

Help translate Rethink DNS + Firewall + VPN on Weblate:

What Rethink DNS + Firewall + VPN is not

Rethink is not an anonymity tool: It helps users tackle unabated censorship and surveillance but doesn't lay claim to protecting a user's identity at all times, if ever.

Rethink does not aim to be a feature-rich traditional firewall: It is more in-line with Little Snitch than IP tables, say.

Rethink is not an anti-virus: Rethink may stop users from phishing attacks, malware, scareware websites through its DNS-based blocklists, but it doesn't actively mitigate threats or even look for them or act on them, otherwise.

What Rethink DNS + Firewall + VPN aspires to be

To turn Android devices into user-agents: Something that users can control as they please without requiring root-access. A big part of this, for an always-on, always-connected devices, is capturing network traffic and reporting it in a way that makes sense to the end-users who can then take a series of actions to limit their exposure but not necessarily eliminate it. Take DNS for example-- for most if not all connections, apps send out a DNS request first, and by tracking just those one can glean a lot of intelligence about what's happening on their Androids and which app's responsible.

To deliver the promise of open-internet for all: With the inevitable ECH (encrypted client hello) standardization and the imminent adoption of DNS-over-HTTPS and DNS-over-TLS across operating systems and browsers, we're that much closer to an open internet. Of course, Deep Packet Inspection remains a credible threat that can't be mitigated with just encrypted DNS, but it is one example of delivering maximum impact (circumvent internet censorship in most countries) with minimal effort (not requiring use of a VPN or access via IPFS, for example). Rethink would continue to make these technologies accessible in the simplest way possible, especially the ones that get 90% of the way there with 10% effort.

Development

       

• Feel free to fork and send a pull request for any reproducible bug fixes.

1. The codebase is raw and is lacking documentation and comprehensive tests. If you need help, feel free to create a Wikipage to highlight the pain with building, testing, writing, committing code. DeepWiki and Copilot may also help, but they do hallucinate. 2. Write descriptive commit messages that explain concisely the changes made. 3. Each commit must reference an open issue on the project to make sure there isn't duplicated effort and prior discussion to refer to.

• If you plan to work on a feature, please create a github issue on the project first to kickstart the discussion before committing to doing any work.
• Prod releases are usually once every few months, while alpha is released monthly.

Tenets (unless you know better ones)

We aren't there yet, may never will be but these are some tenets for the project for the foreseeable future.

• Make it right, make it secure, make it resilient, make it fast. In that order.
• Easy to use, no-root, no-gimmicks features that are anti-censorship and anti-surveillance.

- Easy to use: Any of the 3B+ Android users must be able to use it. Think CleanMaster / Instagram levels of ease-of-use. - no-root: Shouldn't require root-access for any functionality added to it. - no-gimmicks: Misleading material bordering on scareware, for example.

• Anti-censorship: Features focused on helping bring an open internet to everyone, preferably in the most efficient way possible (both monetarily and technically).
• Anti-surveillance: As above, but features that further limit (may not necessarily eliminate) surveillance by apps.
• Incremental changes in balance with newer features.

- For example, work on nagging UI issues or OEM specific bugs, must be taken up on equal weight to newer features, and a release must probably establish a good balance between the two. However; working on only incremental changes for a release is fine.

• Opinionated. Chip-away complexity. Do not expect users to require a PhD in Computer Science to use the app.

- No duplicate functionality. - A concerted effort to not provide too many tunable knobs and settings. To err on the side of easy over simple.

• Ignore all tenets.

- Common sense always takes over when tenets get in the way.

• Must be distributable on the PlayStore, at least some toned down version of it.

- This unfortunately means on-device blocklists aren't possible; however, Cloudflare Gateway-esque cloud-based per-user blocklists get us the same functionality.

• Practice what you preach: Be obsessively private and secure.

Backstory

      Internet censorship (sometimes ISP-enforced and often times government-enforced), unabated dragnet surveillance (by pretty much every company and app) stirred us upon this path. The three of us university classmates, Mohammed, Murtaza, Santhosh got together in late 2019 in the sleepy town of Coimbatore, India to do something about it. Our main gripe was there were all these wonderful tools that people could use but couldn't, either due to cost or due to inability to grok Computer-specific jargon. A lot has happened since we started and a lot has changed but our focus has always been on Android and its 3B+ unsuspecting users. The current idea has been in the works for since May 2020, with the pandemic derailing a bit of progress, and a bit of snafu with abandoning our previous version in favour of the current fork, which we aren't proud of yet, but it is a start. All's good now that we've won a grant from the Mozilla Builders MVP program to go ahead and build this thing that we wanted to... do so faster... and not simply sleep our way through the execution. I hope you're excited but not as much as us that you quit your jobs for this like we did.