3

I'm using the only open source firewall for Android: NetGuard and would like to use a VPN in addition. Is this possible? If so: how?

Both types of apps typically use virtual VPN tunnels. NetGuard has network settings too. Many adblockers use such as well which is why I'm only using a Firefox AddOn.

Improve this question
3
  • 1
    It appears to me that AFWall+ be open source as well. It does need root as it uses iptables instead of a VPN, though.
    – Grimoire
    Commented Aug 30, 2017 at 16:39
  • If you have a recent Samsung device feature a recent version of Knox, you can use AdHell (or similar apps) that are so-called "content blockers" which utilize Knox and still allow a VPN connection.
    – GiantTree
    Commented Aug 30, 2017 at 20:09
  • If all you need from firewall is to block internet access for selected apps, you may try this android.stackexchange.com/a/206602/32571
    – janot
    Commented Jan 17, 2019 at 23:32

4 Answers 4

Reset to default
4

There's many ways to go about this (sorted from easiest to most complicated):

  • Use Adhell 3, the Samsung KNOX based content-blocker that doesn't require root and also allows you to use a VPN app at the same time.
  • Use AFWall+ (root required) instead of NetGuard. That way you can use a VPN app "normally".
  • Install a VPN app and a SOCKS5 proxy server in the Android work profile, and then connect to this SOCKS5 proxy from the main profile using NetGuard.
  • Use a VPN provider that already offers a SOCKS5 proxy (like Mullvad), and then connect to this SOCKS5 proxy from NetGuard (Not recommended due to Netguard leaking UDP by not routing it through the SOCKS5 proxy. Also SOCKS5 is not encrypted)
  • Self-host a VPN-to-SOCKS5 server (Not recommended due to Netguard leaking UDP by not routing it through the SOCKS5 proxy. Also SOCKS5 is not encrypted)

I've only ever used the highlighted option, so that's what I'll describe here.

Pros:

  • It doesn't require root
  • You don't have to pay for a specific VPN (you can use Proton VPN)
  • You don't have to run/pay for any servers

Cons:

  • NetGuard leaks the UDP packets to the clearnet. An alternative solution is to use RethinkDNS instead of Netguard, or use only a browser that has HTTP/2 & HTTP/3 disabled through about:config, or use only the Tor Browser (because Tor doesn't use nor support UDP). Any other traffic will be leaked.
  • The work profile has to be enabled constantly for the VPN to stay running, and that uses considerable battery
  • A work profile uses a about 398.53MB of storage
  • The VPN service doesn't fully work on some Android devices: It's known not to work in some LG devices running Android 9, but it does work in a Moto e6 Plus running Android 9

Steps:

  1. Install personalDNSfilter
  2. Install Island or Shelter (Preferibly Shelter, because it's FOSS and has no trackers)
  3. Setup Island/Shelter
  4. Setup personalDNSfilter to your liking
  5. Install "Every Proxy" in the work profile
  6. Install a VPN app (such as Proton VPN) in the work profile
  7. Disable battery optimizations for all of the apps you just installed (personalDNSfilter, Every Proxy, Proton VPN, and Island/Shelter)
  8. Configure "Every Proxy" to run a SOCKS5 proxy on the 10.1.10.1 interface, and set a username and password (Warning: do not make the password 126 characters long, that causes a crash. I recommend making the password 40 characters long.)
  9. Make sure NetGuard is running
  10. Start the SOCKS5 proxy in "Every Proxy"
  11. Set personalDNSfilter in Netguard as "unmanaged" (untick the "apply rules and conditions" box)
  12. In Netguard set the DNS servers to any WAN servers (for example: 94.140.14.14, and 94.149.14.15) (nothing will be sent to these servers)
  13. Create TCP and UDP forwarding rules for 127.0.0.1:53 -> 127.0.0.1:5300 to personalDNSfilter in NetGuard. Note that this isn't possible if you downloaded NetGuard from the google playstore. You must download netguard from either Github or from F-Droid
  14. Configure Netguard to use a SOCKS5 proxy server (10.1.10.1:1088, and input the same username and password as you did in "Every Proxy")

Done!

Here's a flow chart of how/why this works: enter image description here

I made a much more detailed guide on my blog. It's linked below:

How to use NetGuard + personalDNSFilter+ Any VPN, without root, without external self-hosted servers.

https://itsignacioportal.github.io/netguard-pdnsf-any-vpn-combo/

Improve this answer
0
3

Quoting the NetGuard FAQ on that topic (emphasis added):

(2) Can I use another VPN application while using NetGuard?

If the VPN application is using the VPN service, then no, because NetGuard needs to use this service. Android allows only one application at a time to use this service.

NetGuard is a firewall application, so there is no intention to add VPN support. However, NetGuard supports a SOCKS5 proxy to chain VPN applications. You can find one possible community contributed solution here.

So the answer is: Yes you can!

Improve this answer
0

If you have no-root like me, the only way to tunnel traffic with NetGuard for me was using it with Orbot. You can also route your DNS traffic through the Tor network. I also would be interested to know other ways to get NetGuard to work with VPN-alike applications.

Improve this answer
0

One way might be to use two devices, your main device running the firewall (eg.NetGuard) & tethered to another Android device acting as a router which is running the VPN.

One downside is many Android devices won't let another device tether to use their WiFi Internet connection, but only allow tethering to access a Mobile Data connection.

I don't know if the tethered traffic would get routed via the VPN running on the routing device ? Will need to try it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .