Is the problem caused because GlassWire reports false positives?
You are correct. This question appears to be related to the understanding of OSI Model. NetGuard is based on VPN which makes use of the TUN interface at OSI layer 3, while GlassWire collects data from NetworkStatsManagr which is something within Android's Java runtime e.g. the creation of sockets happens at top layers; Application or Transport. And the UID-based data usage is collected from qtaguid module of iptables which also operates at OSI layers above 3.
Making use of Per-app VPN configuration, NetGuard asks the OS to only send traffic from app XYZ through the TUN interface so that it can be forwarded through a VPN connection (which it never does). When we see apps from the top, it looks like the apps are sending network data which is moving out of the device, but in actuality, it's blocked at layer 3. So IP packets even don't hit the physical layer.
This fact is self-explained by the GlassWire app. It has a built-in firewall which is also based on VPN; no other possible way for non-root apps. When turning on this firewall, it warns that users will still get data usage stats for the blocked app. The reason is as stated above, data is measured on upper OSI layers, and blocking occurs at a lower level:
That's why sniffers work at OSI layer 2, or even better is to watch from outside e.g. using a proxy server or at the router.
Therefore, it seems that users who buy any Android phones are denied full control of the phone, even if they have installed privacy protection apps such as NetGuard.
Well, NetGuard and similar apps have become somewhat privacy protections apps just as a side effect of Android's VPNService API which wasn't intended for this usage. Such apps can do app filtering based on UIDs and/or SOcket_MARKs which Android uses to categorize the network traffic for different purposes. If they wanted to give users freedom of choosing which apps can access the internet and which can't, they could simply set Protection Level of android.permission.INTERNET dangerous, which doesn't favor their business model; consider the fact that Google is the biggest search engine and ads are their prime source of revenue.
Advanced users who want more fine-grained control of privacy usually root their devices and make use of lower-level things like Linux kernel's built-in firewall iptables. Also, some custom ROMs have such features built-in.
RELATED:
