Get the top HN stories in your inbox every day.
okso
mmooss
> NetGuard allows you to block connections to Google servers except for Google Apps, which network firewalls and DNS solutions can't.
How do you know those connections are blocked and not merely bypassing Netguard?
okso
I am using GrapheneOS. GrapheneOS has a compatibility layer providing the option to install and use the official releases of Google Play in the standard app sandbox.
See https://grapheneos.org/features#sandboxed-google-play
NetGuard also shows network requests from GrapheneOS itself, all proxied by the GrapheneOS project, as described here: https://grapheneos.org/faq#default-connections
mmooss
I could see how they are blocked on your system, using GrapheneOS, but that doesn't tell us if Netguard blocks them on Android systems. One reason for GrapheneOS is to close that kind of hole.
0x1ceb00da
> Some software call home at 4am every day
Which app?
okso
Not sure anymore since I removed them, it may have been BlaBlaCar and/or Tricount.
dsissitka
From the developer of FairEmail.
Every once in a while I consider making the switch to KeePassXC. I trust KeePassXC but I don't really trust the mobile apps so last time around I looked into NetGuard. It's really nice but it wasn't a good fit for my use case:
> NetGuard will do its best, but it is limited by the fact it must use the Android VPN service. This is the trade-off required to make a firewall which does not require root access. The firewall can only start when Android "allows" it to start, so it will not offer protection during early boot-up (although you can disable your network before rebooting). Also, the Android VPN service needs to be restarted to apply new rules when connectivity has changed or when the screen is being turned on or off. It will, however, be much better than nothing.
I believe that also means you can't use it with Tailscale or similar.
distances
> I trust KeePassXC but I don't really trust the mobile apps
I'm using Keepass2Android Offline. It doesn't have the network permission, which for me adds a ton of trust already.
Of course there are other ways to infiltrate data too, but you can be only so paranoid if you want to get things done.
https://play.google.com/store/apps/details?id=keepass2androi...
dugite-code
> I believe that also means you can't use it with Tailscale or similar.
You sort of can. It can route over a socks5 proxy to the work profile where you can have a second VPN running. Wouldn't be an easy solution, but it can work
3np
Would be curious to hear if anyone actually did (or attempted) this and have results to share.
I know I have experienced VPN leaks on Android (not the one they publically fixed as it was after). A second layer wouldn't fix that properly but it should make it less likely.
dugite-code
Here you go, a fairly detailed blog post about it: https://itsignacioportal.github.io/netguard-pdnsf-any-vpn-co...
Got this from a thread about Tracker Control, a NetGuard fork, and VPN chaining https://github.com/TrackerControl/tracker-control-android/is...
seanw444
> I trust KeePassXC but I don't really trust the mobile apps
Even KeePassDX? That's what I use, and it's been rock solid for me.
transpute
> better than nothing
Is "nothing" the only Android per-app outbound firewall alternative to NetGuard?
Springtime
At the OS level LineageOS offers per-app network permissions, which I've used and functions as expected.
One quirk from what I understand of this ticket[1] is if there's a proxy set up via a separate internet allowed app it can bypass the restriction via that app. GrapheneOS' implementation is said to prevent this.
[1] https://gitlab.com/LineageOS/issues/android/-/issues/3228
thatloststudent
There's RethinkDNS [1](not affiliated to them, just like their software). Sometimes it gets killed on my phone, but otherwise it's a great replacement, adds some much-needed features like proxies and wireguard VPNs on top of a DNS and app level control.
colordrops
No, if you have a rooted phone you can use AFWall+. And there are other non-root firewalls.
pmontra
I've been using Blockada for many years but that's a firewall against ads and trackers. No ads inside apps.
Ideally I would use NetGuard to block the apps and Blockada to block ads and trackers for the apps that I allowed to perform network traffic in NetGuard. But Android allows only one active VPN and they can't be chained, so it's a hard choice. Actually it's not so hard: I keep blocking ads and trackers.
Onavo
Blockada is most likely a DNS level blocker, netguard supports that. Alternatively you can configure it to point the DNS servers at NextDNS if you just want a nice UI to configure block lists (though NextDNS might track you).
saint_yossarian
NetGuard does ad-blocking with a DNS blacklist, but it's a Pro feature (which I use and works great).
catlikesshrimp
My favorite is another FOSS, but this one is special because it doesn't need network permissions. No root, ofc, so that sticks.
Karma Firewall https://f-droid.org/packages/net.stargw.fok/
saganus
I have used GlassWire (not affiliated) for a few years without issues.
It's also rootless so I assume it has the same restrictions, but it's been very helpful with apps like Uber, which I use seldomly, but prefer not to have their notifications shoved in my face every 30 minutes.
It's also helpful for disabling access to most of the bloatware that comes with e.g. Samsung phones and such.
Probably not blocking everything, but I feel like it's at least something.
aucisson_masque
Pcapdroid is a very good alternative that allows to see which connections are made from what app to what server and at what time.
You just leave it in background, check one day later and see what sneaky app you never thought of have been sending tons of data in the background.
For me it helped me remove and search alternative for 4 apps, including a pill reminder (mytherapy). I would never have thought the trade-off to be reminded to take vitamin would be to constantly spy on me and sell all my data. Had i known, I would have put a reminder in my calendar.
boneitis
Thanks for chiming in; I will probably try this out in the near future and see what insights I can glean.
Kind of wish there was more discussion about solutions for rooted devices and how much unwanted traffic is already blocked by AdAway (in rooted mode).
baby_souffle
> including a pill reminder (mytherapy)
This is an app you wanted to replace? Or this is one of the apps that you found to be a good replacement?
(I am also looking for a basic medication reminder/logging app)
aucisson_masque
no that's the rogue app.
i checked on the play store, all full of trackers. open source is great but always having issue, either it lacks functionalities or it's buggy.
at the end, i decided i could put a reminder on my phone and be done with that.
miroljub
Netguard does the same. You can see a per-app list of connections. Furthermore, you can many hosts either globally, or on an app level.
g-b-r
Except that... that doesn't block anything??
aucisson_masque
it can block, i think it's a 'donation' feature.
anyway, it's not the same as netguard. Pcapdroid helps to identify bad application that you can either remove, or if not possible, use netguard later on to block.
g-b-r
> it can block, i think it's a 'donation' feature.
Oh, interesting, I didn't know. A pity that you have to purchase it on the Play Store
> anyway, it's not the same as netguard. Pcapdroid helps to identify bad application that you can either remove, or if not possible, use netguard later on to block.
Well, almost all closed-source apps, and especially many system applications, send data out all the time; blocklisting rather than whitelisting is not a great strategy.
NetGuard allows exporting to PCAP as well, anyhow, as a paid feature
octygen
Yeah, but you can just uninstall offenders
aucisson_masque
What about microsoft office ?
I want to be able to open word and excel file on my phone, but i don't want to give microsoft access to everything on my phone including dick pics, sextape, bank sheet and other personal data.
Because android allows such bad practice, blocking internet access can be usefull.
g-b-r
With a firewall you can keep using them, instead (and maybe only let through some of the traffic)
qwertox
Its' really telling that Google doesn't offer an API to access a firewall which provides a clear list of connections and the apps which create them and a way to prohibit such specific connections, possibly also according to blacklists.
They really don't want users to have control over this.
alexashka
It's more telling that governments haven't made it a mandatory feature on all devices with networking capabilities.
Google hasn't made a successful product in over a decade (nor have their existing products improved in any meaningful sense) - these people are not capable of anything besides hoarding power (and passing leet code I guess :P).
ilbeeper
Is it? Do Fedora or Ubuntu provide an API like that?
lightdot
You mean, like unrestricted access to the kernel with full firewalling capabilities? ;)
Yes, GNU/Linux distributions provide exactly that.
irundebian
No, you have to install additional software for that.
kristofferg
Yes.
t0bia_s
It drains battery because of VPN service solution, which is only non-rooted solution. Also if you use VPN (like Wireguard), you cannot use both.
Every app has own settings for allowing WiFi, data, VPN, background data connections natively in Android. I use custom ROM that has turned off internet connection for all apps by default and you need manually allow them to connect. Which solve mine problem with constant unwanted connections.
If you want really control over traffic on Android and combine with VPN, try ReThing DNS.
baby_souffle
> It drains battery because of VPN service solution, which is only non-rooted solution.
It's not the _only_ solution. If you're on a modern (read: last 6 years or so) version of android, you can specify a DNS over TLS server to use.
If that DNS server also happens to be a PiHole, you have a good filter mechanism that doesn't hit battery life / data quotas quite like an always-on VPN does.
It's a bit old, but I put together a basic project for this here: https://github.com/kquinsland/skyhole/
t0bia_s
I prefer to connect via Wireguard to home network that has DNS filters (ie Pi-hole or NextDNS), because I can benefit with connection to home network any time.
g-b-r
> It drains battery because of VPN service solution
It doesn't really, just try it (and take actual battery duration measurements, Android misreports VPN apps battery usages)
t0bia_s
I did, battery drains 5-10% faster.
g-b-r
If it's so, it's not a lot for privacy and security
---
ReThink DNS uses the VPN service as well, by the way.
And it is possible to use two VPN apps, see https://news.ycombinator.com/item?id=41933464 (yes, the battery usage adds up).
Rethink DNS seems fine, anyhow.
bramhaag
I occasionally set up notifications when apps make requests using NetGuard and let it run for a day. The result is always depressing, lots of apps phoning home that I haven't opened in days...
I let it run today, and the worst offenders I have installed are Spotify (various requests to Facebook endpoints, I have no Facebook integration turned on) and Speedtest (constant requests to their logging endpoint and ad partners). This is all happening without me actually using those apps.
colordrops
If you use a rootless firewall doesn't it act like a VPN? And then you aren't able to use VPNs unless you disable it? Useless IMO for heavy VPN users.
attendant3446
You can split the usage by profiles (e.g. work profile with Shelter[1]) or separate users.
g-b-r
You can also have NetGuard actually go through the VPN (https://news.ycombinator.com/item?id=41933464)
notpushkin
This is really good. Using it on my Oculus to block connections to Facebook servers.
(On my phones, I use LineageOS which can manage network permissions per app right in app settings.)
noname120
AdGuard is also rootless, but in addition if you have root then it can install a system-wide certificate that enables it to decrypt HTTPS requests to do granular filtering (not just at the domain level). Basically just like uBlock does, except that it's system-wide and works in all apps[1].
[1] Except apps that pin their certificates. But you can exclude those or install another module[2] (not from AdGuard) which disables certificate pinning.
[2] For example: https://github.com/cryptoexpertssss/TrustMeAlready
p0w3n3d
I'm using netguard. It's really good, but conflicts with wireguard (another VPN I am using). It's because the firewall is realised using VPN API, when running netguard it uses VPN API to control the traffic
okso
I am dreaming of an open-source app that adds Wireguard capabilities to NetGuard or vice-versa.
Having to switch from one to the other is very annoying.
thatloststudent
There's no need to dream about it, it already exists: https://f-droid.org/packages/com.celzero.bravedns/
I used to use it when I wasn't on grapheneOS and needed to block internet access.
bubblesnort
That only uses wg for DNS queries. Everything else remains untunneled.
miroljub
It's annoying to see so much RethinkDNS propaganda on every Netguard or Invizible Pro thread on the internet.
That gives me a bad feeling, and it's the reason I started to consider RethinkDNS scummy.
p0w3n3d
especially that Wireguard silently disables NetGuard, and then the communication undergoes (at least in my case) silent
microflash
Is there something like this for iOS? I know Adguard but it is not open source.
transpute
Lockdown claims to be open-source. Their appstore client has paid mode for per-app blocklists. I don't know if they support per-app allow lists.
alibert
Something already included in iOS is App Privacy Report feature.
halfcat
This doesn’t seem to show any site I browse in the DuckDuckGo app, which raises the question, if DDG can hide connections it makes from showing in privacy report, can any (more nefarious) app do the same?
zuhsetaqi
Something similar would be Proxyman: https://apps.apple.com/de/app/proxyman-network-debug-tool/id...
But it’s more designed to be a debug tool than to block traffic from specific apps
quaff
https://github.com/AdguardTeam/AdguardForiOS
I am pretty sure it is open source. I’ve been using it for years both for upstream DNS and blocklist filtering.
microflash
Huh, didn’t know about the repo. Thanks for posting it here.
radicality
Isn’t AdGuard just dns protection (and Safari extension). Afaik something like this isn’t easily doable in iOS. Some options are:
* Shadowrocket - you can set complex rules on what hosts/connections should be routed by what, but afaik you are not able to isolate traffic on a per-app basis.
* I think you can set up per-app VPN on iOS, but you must use MDM, can’t do it on an unmanaged profile. Link: https://support.apple.com/guide/deployment/vpn-overview-depa...
transpute
> per-app VPN on iOS, but you must use MDM
Yet iOS allows Safari per-site VPN without enterprise MDM, via Apple Configurator profile.
varenc
The APIs to implement traffic policies on a per-app basis just don’t exist on iOS. You can create a VPN connection and have an app manage all network traffic that way, but you can’t associate traffic with specific apps since this would run afoul of their sandbox. At least without jailbreaking.
newscracker
I came here to ask a similar question, looking for alternatives to Lockdown Privacy on iOS/iPadOS. [1] I've been using Lockdown for some years as a local and system firewall to block trackers across all apps, but this company got sold a few years ago and has since been annoyingly and frequently pushing for its paid subscription. It also moved some free blocking lists to the paid subscription.
Any alternatives to Lockdown on iOS/iPadOS would be nice to know about.
saagarjha
Only in China I believe.
udev4096
Afaik, this requires an active VPN connection. With GrapheneOS, there is a network toggle which disables the INTERNET access to any individual app so it doesn't make sense to use NetGuard
str3wer
> it doesn't make sense to use NetGuard
unless you use any other phone that is not a google pixel running GrapheneOS
palata
Which is literally the meaning of "With GrapheneOS, [...] it doesn't make sense to use NetGuard", isn't it?
notpushkin
LineageOS has this too, and it’s available on a fair bit of non-Pixel phones.
udev4096
LineageOS doesn't really cut off the INTERNET access properly. Graphene's approach is more robust. I still wonder why such an important feature is not in the AOSP itself
wanderingmind
It can do other things. It can monitor network traffic and block ads within apps through multiple host files . Also having a single app to toggle is more UX friendly than toggling multiple apps network access.
udev4096
Running pihole as your home DNS is far more feasible for blocking ads and other intrusive requests. The UX perspective is a valid point
prmoustache
But that ties you down to connecting to a vpn every single time you leave home.
attendant3446
NetGuard allows you to block specific hosts. I use it on GrapheneOS for monitoring and selective host blocking.
saint_yossarian
I use NetGuard on GrapheneOS to block mobile data for certain apps.
Get the top HN stories in your inbox every day.
Installing NetGuard was revelation regarding the amount of tracking in most Android apps.
You can configure it to block access by default and notify you every time an app attempts a new connection. And it rings all the time.
Some software call home at 4am every day, other every hour, some send data to a dozen "analytics" services - services that I never opted-in for, which shows how few apps respect the RGPD.
At least most apps still work when those are blocked, and NetGuard allows you to block connections to Google servers except for Google Apps, which network firewalls and DNS solutions can't.