Earlier quoted context omitted.
[flagged]
I'm curious, how would looking at the Microsoft MFA app convince me that android apps aren't spying on me?
[flagged]
NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch
121–130 of 142 posts
Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch
#122From the developer of FairEmail. Every once in a while I consider making the switch to KeePassXC. I trust KeePassXC but I don't really trust the mobile apps so last time around I looked into NetGuard. It's really nice but it wasn't a good fit for my use case: > NetGuard will do its best, but it is limited by the fact it must use the Android VPN service. This is the trade-off required to make a firewall which does not…
> I trust KeePassXC but I don't really trust the mobile apps
Even KeePassDX? That's what I use, and it's been rock solid for me.
Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch
#123Earlier quoted context omitted.
The linux kernel has a built-in firewall, and provides iptables to configure it. Firewalld is also installed by default at least on Fedora, and UFW for debian-based. Unless this is just a battle of semantics on the fact iptables/firewalld/ufw are user space apps.
There is no clean interface to configure app-based network rules.
I think the main gripe is Google's lack of API to access a firewall. It would make sense for the kernel to provide that API and leave the UI to user space apps.
Edit: and to clarify, you can have a user space app on Android to configure a firewall but they will either require root or a VPN-based solution like NetGuard.
Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch
#124GrapheneOS has Network as an Android permission, that you can grant/revoke per app
Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch
#125Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch
#126Earlier quoted context omitted.
The linux kernel has a built-in firewall, and provides iptables to configure it. Firewalld is also installed by default at least on Fedora, and UFW for debian-based. Unless this is just a battle of semantics on the fact iptables/firewalld/ufw are user space apps.
There is no clean interface to configure app-based network rules.
Both SELinux and AppArmor support per app network rules, however they both leave something to be desired in terms of ease of use and features.
https://selinuxproject.org/page/NetworkStatements
https://manpages.ubuntu.com/manpages/bionic/en/man5/apparmor...
Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch
#127Earlier quoted context omitted.
( I work on rdns ) > ReThink DNS uses the VPN service as well, by the way. Rethink (since a year ago) has had the ability forward connections per-app to multiple WireGuard upstreams at the same time. https://old.reddit.com/r/rethinkdns/comments/15r1eq9/v055_mu... / https://archive.md/RqUPe (to us, it turned out to be a deceptively difficult thing to integrate with the rest of the firewall).
Not really on topic, but is there any plan on integrating tailscale with it? There's a userspace mode for tailscale that exposes a socks proxy, but you currently have to spawn that with Termux or another terminal, then forward your traffic on Rethink.
Yes (short of anyone sponsoring us to implement it immediately) we do plan to add tsnet support (https://github.com/celzero/rethink-app/issues/1047) once we iron out existing issues with WireGuard.
I'm unsure if we'd be able to support all of Tailscale's features as easily (taildrop, exit nodes etc), we'll see.
Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch
#128Earlier quoted context omitted.
Except that... that doesn't block anything??
it can block, i think it's a 'donation' feature. anyway, it's not the same as netguard. Pcapdroid helps to identify bad application that you can either remove, or if not possible, use netguard later on to block.
> it can block, i think it's a 'donation' feature.
Oh, interesting, I didn't know. A pity that you have to purchase it on the Play Store
> anyway, it's not the same as netguard. Pcapdroid helps to identify bad application that you can either remove, or if not possible, use netguard later on to block.
Well, almost all closed-source apps, and especially many system applications, send data out all the time; blocklisting rather than whitelisting is not a great strategy.
NetGuard allows exporting to PCAP as well, anyhow, as a paid feature
Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch
#129Similar but open source: https://github.com/celzero/rethink-app
I tried Rethink for the day.
I had previously set Android's private DNS to dns.adguard-dns.com, which didn't block anything.
Rethink's battery usage is 15 - 20% on my pixel in logging mode.
It definitely works, but I can't seem to associate blocked requests with apps, which renders it far less useful.
Overall I think it's a very busy UI.
You definitely want to exclude Firefox with uBO as elsewise Firefox behaves as though the network is down, whereas with uBO you can interactively choose to proceed.
I see there is an option to download the block lists locally. Does that mean it no longer uses DNS blocking? I see it described as a DNS blocker but it requires a VPN.
Anyway, off to try a Adaway next.
Re: NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch
#130Installing NetGuard was revelation regarding the amount of tracking in most Android apps. You can configure it to block access by default and notify you every time an app attempts a new connection. And it rings all the time. Some software call home at 4am every day, other every hour, some send data to a dozen "analytics" services - services that I never opted-in for, which shows how few apps respect the RGPD. At leas…
> NetGuard allows you to block connections to Google servers except for Google Apps, which network firewalls and DNS solutions can't.
How do you know those connections are blocked and not merely bypassing Netguard?