Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

netguard.me

Post reply on HN
Print view View original

61–70 of 142 posts

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#61

Post by noname120 »

AdGuard is also rootless, but in addition if you have root then it can install a system-wide certificate that enables it to decrypt HTTPS requests to do granular filtering (not just at the domain level). Basically just like uBlock does, except that it's system-wide and works in all apps[1].

[1] Except apps that pin their certificates. But you can exclude those or install another module[2] (not from AdGuard) which disables certificate pinning.

[2] For example: https://github.com/cryptoexpertssss/TrustMeAlready

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#63

Post by 3np »

dugite-code wrote: post #11
dsissitka wrote: post #3

From the developer of FairEmail. Every once in a while I consider making the switch to KeePassXC. I trust KeePassXC but I don't really trust the mobile apps so last time around I looked into NetGuard. It's really nice but it wasn't a good fit for my use case: > NetGuard will do its best, but it is limited by the fact it must use the Android VPN service. This is the trade-off required to make a firewall which does not…

> I believe that also means you can't use it with Tailscale or similar. You sort of can. It can route over a socks5 proxy to the work profile where you can have a second VPN running. Wouldn't be an easy solution, but it can work

Would be curious to hear if anyone actually did (or attempted) this and have results to share.

I know I have experienced VPN leaks on Android (not the one they publically fixed as it was after). A second layer wouldn't fix that properly but it should make it less likely.

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#64

Post by extraduder_ire »

While I'm normally not someone who pays for apps, and is annoyed at fdroid releases having paid features, I had such a fun time figuring out and bypassing the challenge/response part of the app (without just commenting it out and recompiling) that I decided to send €1.23 his way.

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#65

Post by halfcat »

alibert wrote: post #54
microflash wrote: post #10

Is there something like this for iOS? I know Adguard but it is not open source.

Something already included in iOS is App Privacy Report feature. https://support.apple.com/en-us/102188

This doesn’t seem to show any site I browse in the DuckDuckGo app, which raises the question, if DDG can hide connections it makes from showing in privacy report, can any (more nefarious) app do the same?

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#66

Post by dugite-code »

3np wrote: post #63
dugite-code wrote: post #11

Earlier quoted context omitted.

> I believe that also means you can't use it with Tailscale or similar. You sort of can. It can route over a socks5 proxy to the work profile where you can have a second VPN running. Wouldn't be an easy solution, but it can work

Would be curious to hear if anyone actually did (or attempted) this and have results to share. I know I have experienced VPN leaks on Android (not the one they publically fixed as it was after). A second layer wouldn't fix that properly but it should make it less likely.

Here you go, a fairly detailed blog post about it: https://itsignacioportal.github.io/netguard-pdnsf-any-vpn-co...

Got this from a thread about Tracker Control, a NetGuard fork, and VPN chaining https://github.com/TrackerControl/tracker-control-android/is...

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#68

Post by p0w3n3d »

okso wrote: post #26
p0w3n3d wrote: post #23

I'm using netguard. It's really good, but conflicts with wireguard (another VPN I am using). It's because the firewall is realised using VPN API, when running netguard it uses VPN API to control the traffic

I am dreaming of an open-source app that adds Wireguard capabilities to NetGuard or vice-versa. Having to switch from one to the other is very annoying.

especially that Wireguard silently disables NetGuard, and then the communication undergoes (at least in my case) silent

Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch

#70

Post by thatloststudent »

okso wrote: post #26
p0w3n3d wrote: post #23

I'm using netguard. It's really good, but conflicts with wireguard (another VPN I am using). It's because the firewall is realised using VPN API, when running netguard it uses VPN API to control the traffic

I am dreaming of an open-source app that adds Wireguard capabilities to NetGuard or vice-versa. Having to switch from one to the other is very annoying.

There's no need to dream about it, it already exists: https://f-droid.org/packages/com.celzero.bravedns/

I used to use it when I wasn't on grapheneOS and needed to block internet access.

Post reply on HN