Repolode
Submit
celzero

celzero/rethink-app

Android app combining a DNS-over-HTTPS/TLS/DNSCrypt client, a per-app firewall and network monitor, and a split-tunnel WireGuard/SOCKS5 proxifier, without requiring root.

Open-source alternative to:NetGuardIntra

View on GitHubWebsite
Stars
5,718
Forks
366
Open issues
642
Last commit
4 days ago

What is it?

Rethink DNS + Firewall + VPN is an Android app with three modes: VPN (a proxifier that forwards TCP and UDP over SOCKS5, HTTP CONNECT, or multiple WireGuard tunnels at once), DNS (routes app DNS traffic to a chosen DoH, Oblivious DoH, DoT, or DNSCrypt resolver, with optional blocklists), and Firewall (blocks internet access per app based on screen state, foreground status, metered connections, Play Store category, or custom domain and IP denylists).

The firewall works by identifying which app opened each connection rather than filtering by IP rules, similar to Little Snitch or OpenSnitch. Per-app mapping uses Android's ConnectivityService on Android 10 and later, and reads procfs on older versions. The app also includes a network monitor that logs connection times, counts, and destinations, with DNS tracking being more approximate on Android 11 and below.

The app's network stack is built on firestack, a Go fork of outline-go-tun2socks. It does not need root access, and the project states it is not an anonymity tool or a traditional anti-virus.

Key features

  • 01Split-tunnel proxifier supporting SOCKS5, HTTP CONNECT, and multiple WireGuard tunnels at once.
  • 02DNS routing to DoH, Oblivious DoH, DoT, or DNSCrypt resolvers, with per-app DNS split-tunneling.
  • 03Per-app firewall that can block apps by screen state, foreground status, metered networks, or Play Store category.
  • 04Custom domain and IP denylists for the firewall.
  • 05Network monitor logging connection times, counts, and destinations per app.
  • 06Works without root access on Android.

Use cases

  • Blocking ads and trackers system-wide with a DoH resolver and custom blocklists.
  • Routing different apps through different tunnels, such as Tor for a browser and WireGuard for streaming.
  • Limiting background network access for specific apps on a phone without root.
  • Reviewing which apps contact which domains on an Android device.

Quick start

  1. 1

    Install from F-Droid, Google Play, or Obtainium using the links in the README

  2. 2

    Build from source using the project's Development instructions (none are given as commands in the README)

Things to know

  • Android only; it does not run on other platforms.
  • The codebase is described by its authors as raw, with limited documentation and comprehensive tests.
  • On Android 11 and below, DNS request tracking uses a rough heuristic that may not be accurate in all cases.

In collections

Privacy & local-first toolsAndroid apps & phone tools

Topics

#android#dns-over-https#firewall#wireguard#privacy#dnscrypt#vpn#network-monitor#android-app#android-application

FAQ

What is rethink-app?
Android app combining a DNS-over-HTTPS/TLS/DNSCrypt client, a per-app firewall and network monitor, and a split-tunnel WireGuard/SOCKS5 proxifier, without requiring root. Rethink DNS + Firewall + VPN is an Android app with three modes: VPN (a proxifier that forwards TCP and UDP over SOCKS5, HTTP CONNECT, or multiple WireGuard tunnels at once), DNS (routes app DNS traffic to a chosen DoH, Oblivious DoH, DoT, or DNSCrypt resolver, with optional blocklists), and Firewall (blocks internet access per app based on screen state, foreground status, metered connections, Play Store category, or custom domain and IP denylists).
Is rethink-app free to use? What license does it have?
rethink-app is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is rethink-app still maintained?
Actively maintained. The last commit to rethink-app was on Oct 18, 2026.
What can I use rethink-app for?
Blocking ads and trackers system-wide with a DoH resolver and custom blocklists. Routing different apps through different tunnels, such as Tor for a browser and WireGuard for streaming. Limiting background network access for specific apps on a phone without root. Reviewing which apps contact which domains on an Android device.
How do I install rethink-app?
Install from F-Droid, Google Play, or Obtainium using the links in the README Build from source using the project's Development instructions (none are given as commands in the README)
Where can I get rethink-app?
The source code and installation instructions are on GitHub: https://github.com/celzero/rethink-app

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects