JUjurakovic·Oct 6, 2026
Just use Rethink app
https://github.com/celzero/rethink-app
In System-level ad-blocking in Androidcelzero
rethink-app
Kotlin2021–2026
celzero / rethink-app
rethink-app
DNS over HTTPS / DNS over Tor / DNSCrypt client, WireGuard proxifier, firewall, and connection tracker for Android.
14Distinct people
42Mentions
0Explicit recommenders
5.9KGitHub stars
What to know before exploring
What it is
DNS over HTTPS / DNS over Tor / DNSCrypt client, WireGuard proxifier, firewall, and connection tracker for Android.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- serverless-dns/serverless-dns · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year42 dated mentions
Observed mentions: 2021-02-14 18:48:27 UTC to 2026-10-06 22:33:36 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 15 | 0 | 15 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 5 | 0 | 5 |
What Hacker News says
42 sourcesI use Rethink DNS for this, see (https://github.com/celzero/rethink-app).
Despite it's name it can also block IPs and specific apps from connecting to specific servers. I use it to block all manufacturer and OEM related apps that I cannot uninstall through adb or disable. Very handy for blocking constant Chinese phone telemetry pings, as well as additional network level blocklists for ads (Pi-hole like), completely locally so you can trust it unlike a shady VPN.
I checked out your link; it seems to be a mailing list for a hosts file for telemetry? Why is there no option to just see the file without giving in my email? Not the most private.
In On non-rooted Android 17, ADB uninstall of system apps failsrdns dev here
The latest version is v055z [0], which handles WireGuard re-connectivity better across a range of providers. One Proton specific quirk we've hit was: Since Rethink lets you connect multiple WireGuards at once, their free tier especially may start rejecting "WireGuard handshakes" from your client, if you do so.
Some tips:
- If you don't mind extra battery use, setup "Persistent KeepAlive" for your all your WireGuard Peers. Any value between 30s to 100s is decent enough.
- Alternatively, if you're on version v055v+, then consider turning on Configure -> Network -> Smart Persistent Keepalive which shouldn't use up as much battery but yet attempt to keep a connection open whenever "user presence" is expected by Rethink.
- Turn on Configure -> DNS -> Split DNS only if you're Android 12+ which has comparatively better APIs to be a
Read the rest
ble to implement per-app split-tunnel DNS across multiple WireGuards.
- Tap on the "Refresh" icon in Configure -> Proxy -> Setup WireGuard to instruct Rethink to attempt re-connections to all dormant Peers.
- Look for internal state in About -> General (scroll to the bottom to the section that goes "WireGuard") and see if you spot any mismatch there with respect to MTU, for example. And if so, consider opening a report on GitHub.
- Look for About -> App Logs and see if you spot any errors (or for warning, info, or debug, you'll have to change the log level when prompted) related to WireGuard. You can use the search bar to filter for "wg", which should keep the output limited to WireGuard stuff.
- Change Configure -> Network -> Choose IP version to "Auto" if you happen to go between IPv4-only / IPv6-only / dual-stack networks, or set it to "IPv4 & IPv6", if you're always on dual-stack networks.
[0] https://github.com/celzero/rethink-app/releases/v0.5.5z
> Blocking UID 1000 connections, and blocking QUIC, has not caused any problems for me
By design, the app sandbox isn't applied as strictly on "privileged apps" (like UID 1000). There's nothing NetGuard or any userspace app can do to shore that up. System/privileged apps can bypass most OS-enforced isolation mechanisms at will: https://github.com/celzero/rethink-app/issues/224
This is besides the fact that NetGuard doesn't (yet) support "Block connections without VPN" mode.
In Android VPN IP Leak Even If Always-On VPN EnabledI've used GrapheneOS on a Pixel 3a, 5, 8 and 10 Pro so far and it's worked really well. I couldn't imagine going back.
The only things I'm missing (which don't exist in other OS'es either):
- Being able to configure contact scopes in such a way that the app in question only gets access to the phone numbers of the contacts belonging to the label I specified, e.g. "WhatsApp", nothing more. Yes, one can of course add contacts' phone numbers to the contact scopes "by hand" but 1) there is a limit on the number of contacts/phone numbers configured this way, and 2) AFAIK there is no way to back up that list.
- Being able to install browser extensions in Vanadium.
- Being able to configure multiple VPNs at once, e.g. for Tailscale, ad filtering, blocking HackerNews during times when I should be doing something more productive :) etc., especiall
Read the rest
y since the Vanadium browser doesn't support extensions (see above). I was hoping that the Rethink app might implement something like this (https://github.com/celzero/rethink-app/issues/1047) but it doesn't look like it's coming and it'd probably be much better to do this at the OS level.
> should be noted that Google doesn't really like apps abusing the VPN API like this
Not really.
Only apps that use the VpnService and have VPN as their core functionality can create a secure device-level tunnel to a remote server. Exceptions include apps that require a remote server for core functionality such as:
- Parental control and enterprise management apps
- App usage tracking
- Device security apps (for example, anti-virus, mobile device management, firewall)
- Network-related tools (for example, remote access)
- Web browsing apps
- Carrier apps that require the use of VPN functionality to provide telephony or connectivity services.
https://support.google.com/googleplay/android-developer/answ... / https://archive.vn/KY51z
> It should be noted that system applications (phone OS, Google, sometimes carrier apps) can
Read the rest
bind to specific network interfaces bypassing this API entirely
Whilst this is true for Android (connectivity checks bypass VPNs, as do VoWiFi and Hotspot traffic) [0], other OSes are known to do the same thing: https://news.ycombinator.com/item?id=24838816
[0] https://github.com/celzero/rethink-app/issues/224
Rethink DNS on fdroid is great. Way better than the official wireguard android app: https://github.com/celzero/rethink-app
In Setting up a home VPN server with WireGuard (2019)I've heard good things about RethinkDNS but I've been waiting for integration with Tailscale[0], which doesn't sound entirely trivial[1]. :'-(
[0]: https://github.com/celzero/rethink-app/issues/1047
[1]: https://github.com/tailscale/tailscale/issues/12280
In Graphene OS: a security-enhanced Android build>in years.
not even past 1 year.
See https://github.com/celzero/rethink-app/discussions/1884
In RethinkDNS Resolver That Deploys to CF Workers, Deno Deploy, Fastly, Fly.ioThe Rethink DNS mobile app hasn't seen a release in years. Is the project still alive?
https://github.com/celzero/rethink-app
In RethinkDNS Resolver That Deploys to CF Workers, Deno Deploy, Fastly, Fly.ioYes (short of anyone sponsoring us to implement it immediately) we do plan to add tsnet support (https://github.com/celzero/rethink-app/issues/1047) once we iron out existing issues with WireGuard.
I'm unsure if we'd be able to support all of Tailscale's features as easily (taildrop, exit nodes etc), we'll see.
In NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitchSimilar but open source: https://github.com/celzero/rethink-app
In NetGuard – rootless Android outbound per-app OSS firewall, like LittleSnitch> with an on-device VPN, which is no good if you actually want to use a VPN of your own.
I co-develop a FOSS Android app that can run DoH, ODoH, firewall, and WireGuard: https://github.com/celzero/rethink-app
In Ask HN: What currently is the best, nerd-friendly, rootable Android phone?You can run WireGuard (as a proxy not a VPN; ie, TCP/UDP only) with Rethink DNS + Firewall, an app I co-develop: https://github.com/celzero/rethink-app
In DNS traffic can leak outside the VPN tunnel on AndroidShowing the 15 most recent of 42 sources. Enable JavaScript to search and browse every indexed mention.