Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

netguard.me

Post reply on HN
Print view View original

11–20 of 142 posts

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#11

Post by dugite-code »

dsissitka wrote: post #3

From the developer of FairEmail. Every once in a while I consider making the switch to KeePassXC. I trust KeePassXC but I don't really trust the mobile apps so last time around I looked into NetGuard. It's really nice but it wasn't a good fit for my use case: > NetGuard will do its best, but it is limited by the fact it must use the Android VPN service. This is the trade-off required to make a firewall which does not…

> I believe that also means you can't use it with Tailscale or similar.

You sort of can. It can route over a socks5 proxy to the work profile where you can have a second VPN running. Wouldn't be an easy solution, but it can work

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#12

Post by catlikesshrimp »

transpute wrote: post #4
dsissitka wrote: post #3

From the developer of FairEmail. Every once in a while I consider making the switch to KeePassXC. I trust KeePassXC but I don't really trust the mobile apps so last time around I looked into NetGuard. It's really nice but it wasn't a good fit for my use case: > NetGuard will do its best, but it is limited by the fact it must use the Android VPN service. This is the trade-off required to make a firewall which does not…

> better than nothing Is "nothing" the only Android per-app outbound firewall alternative to NetGuard?

My favorite is another FOSS, but this one is special because it doesn't need network permissions. No root, ofc, so that sticks.

Karma Firewall https://f-droid.org/packages/net.stargw.fok/

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#15

Post by mcsniff »

AOSP has a pretty well functioning firewall, good enough that GrapheneOS implements and builds on it.

https://grapheneos.org/faq#firewall

Yeah there's no stats or traffic info, but until Android has a real way of using multiple VPN interfaces or exposes adding routes to users/apps, these VPN-based local tools are a no-go.

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#16

Post by ignoramous »

transpute wrote: post #6
stevenhuang wrote: post #5

Similar but open source: https://github.com/celzero/rethink-app

> similar but open source Netguard (per HN title) is open-source GPLv3: https://github.com/M66B/NetGuard Rethink uses cloud services by default? The [DNS] resolver is deployed to Fly.io at max.rethinkdns.com and Deno Deploy at rdns.deno.dev too, apart from the default deployment on Cloudflare Workers.

rdns dev here

> Rethink uses cloud services by default?

There isn't anything sinister going on here with the use of "cloud services" [0][1]. Rethink, which is geared more towards anti-censorship, has its default resolver "ip-fronted" on Cloudflare (whose IPs are seldom blocked) and it works great in countries where the app is popular.

Users can opt to switch to any DoH, DoT, ODoH, DNSCrypt v3 resolver of their choice. In fact, we encourage users on our reddit/telegram groups to use ODoH (we also run a public-facing ODoH proxy) and DNSCrypt upstreams because of their privacy guarantees.

[0] If anything, hosting it cost us a bomb: https://old.reddit.com/r/rethinkdns/comments/17h2y6r / https://archive.md/slpZ9

[1] Our stub resolvers are open-source & "open deploy" (ie deploy straight from github actions): https://github.com/serverless-dns/serverless-dns/actions/

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#18

Post by transpute »

microflash wrote: post #10

Is there something like this for iOS? I know Adguard but it is not open source.

Lockdown claims to be open-source. Their appstore client has paid mode for per-app blocklists. I don't know if they support per-app allow lists.

https://github.com/confirmedcode/Lockdown-iOS

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#19

Post by str3wer »

udev4096 wrote: post #17

Afaik, this requires an active VPN connection. With GrapheneOS, there is a network toggle which disables the INTERNET access to any individual app so it doesn't make sense to use NetGuard

> it doesn't make sense to use NetGuard

unless you use any other phone that is not a google pixel running GrapheneOS

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#20

Post by justmarc »

ignoramous wrote: post #16
transpute wrote: post #6

Earlier quoted context omitted.

> similar but open source Netguard (per HN title) is open-source GPLv3: https://github.com/M66B/NetGuard Rethink uses cloud services by default? The [DNS] resolver is deployed to Fly.io at max.rethinkdns.com and Deno Deploy at rdns.deno.dev too, apart from the default deployment on Cloudflare Workers.

rdns dev here > Rethink uses cloud services by default? There isn't anything sinister going on here with the use of "cloud services" [0][1]. Rethink, which is geared more towards anti-censorship, has its default resolver "ip-fronted" on Cloudflare (whose IPs are seldom blocked) and it works great in countries where the app is popular. Users can opt to switch to any DoH, DoT, ODoH, DNSCrypt v3 resolver of their choice…

FWIW, Netguard's UI feels like one of an average opensource mobile app, while Rethink is a very polished experience. Well done!
Post reply on HN