There's many ways to go about this (sorted from easiest to most complicated):
- Use Adhell 3, the Samsung KNOX based content-blocker that doesn't require root and also allows you to use a VPN app at the same time.
- Use AFWall+ (root required) instead of NetGuard. That way you can use a VPN app "normally".
- Install a VPN app and a SOCKS5 proxy server in the Android work profile, and then connect to this SOCKS5 proxy from the main profile using NetGuard.
- Use a VPN provider that already offers a SOCKS5 proxy (like Mullvad), and then connect to this SOCKS5 proxy from NetGuard (Not recommended due to Netguard leaking UDP by not routing it through the SOCKS5 proxy. Also SOCKS5 is not encrypted)
- Self-host a VPN-to-SOCKS5 server (Not recommended due to Netguard leaking UDP by not routing it through the SOCKS5 proxy. Also SOCKS5 is not encrypted)
I've only ever used the highlighted option, so that's what I'll describe here.
- It doesn't require root
- You don't have to pay for a specific VPN (you can use Proton VPN)
- You don't have to run/pay for any servers
- NetGuard leaks the UDP packets to the clearnet. An alternative solution is to use RethinkDNS instead of Netguard, or use only a browser that has HTTP/2 & HTTP/3 disabled through about:config, or use only the Tor Browser (because Tor doesn't use nor support UDP). Any other traffic will be leaked.
- The work profile has to be enabled constantly for the VPN to stay running, and that uses considerable battery
- A work profile uses a about 398.53MB of storage
- The VPN service doesn't fully work on some Android devices: It's known not to work in some LG devices running Android 9, but it does work in a Moto e6 Plus running Android 9
- Install personalDNSfilter
- Install Island or Shelter (Preferibly Shelter, because it's FOSS and has no trackers)
- Setup Island/Shelter
- Setup personalDNSfilter to your liking
- Install "Every Proxy" in the work profile
- Install a VPN app (such as Proton VPN) in the work profile
- Disable battery optimizations for all of the apps you just installed (personalDNSfilter, Every Proxy, Proton VPN, and Island/Shelter)
- Configure "Every Proxy" to run a SOCKS5 proxy on the 10.1.10.1 interface, and set a username and password (Warning: do not make the password 126 characters long, that causes a crash. I recommend making the password 40 characters long.)
- Make sure NetGuard is running
- Start the SOCKS5 proxy in "Every Proxy"
- Set personalDNSfilter in Netguard as "unmanaged" (untick the "apply rules and conditions" box)
- In Netguard set the DNS servers to any WAN servers (for example: 18.104.22.168, and 22.214.171.124) (nothing will be sent to these servers)
- Create TCP and UDP forwarding rules for 127.0.0.1:53 -> 127.0.0.1:5300 to personalDNSfilter in NetGuard. Note that this isn't possible if you downloaded NetGuard from the google playstore. You must download netguard from either Github or from F-Droid
- Configure Netguard to use a SOCKS5 proxy server (10.1.10.1:1088, and input the same username and password as you did in "Every Proxy")
Here's a flow chart of how/why this works:
I made a much more detailed guide on my blog. It's linked below:
How to use NetGuard + personalDNSFilter+ Any VPN, without root, without external self-hosted servers.