In other words, RethinkDNS has two primary modes, DNS and Firewall. The DNS mode routes all DNS traffic generated by apps to one of two DNS over HTTPS resolvers (Cloudflare and RethinkDNS). The Firewall mode lets the user deny internet-access to entire applications based on events like screen-on / screen-off, app-foreground / app-background, connected to unmetered-connection / metered-connection / always; or based on play-store defined categories like Social, Games, Utility, Productivity; or additionally, based on user-defined blacklists.
The firewall doesn't really care about the connections per se rather what's making those connections. This is different from the traditional firewalls but in-line with Little Snitch, LuLu, Glasswire and others.
Currently, per app connection mapping is implemented by capturing
tcp connections managed by
outline-go-tun2socks-layer (written in golang) and asking ConnectivityService for the owner, an API available only on Android 10 or higher.
/proc/net/udp) is read on-demand to track per-app connections like NetGuard or OpenSnitch do on Android 9 and lower versions. Tracking
tcp connections like this works fine whilst tracking
A network monitor is a per-app report-card of sorts on when connections were made, how many were made, and to where. Tracking TCP has turned out to be so far straight-forward. DNS packets are trickier to track, and so a rough heuristic is used for now, which may not hold good in all cases.
Almost all of the network related code, including DNS over HTTPS split tunnel, is a very minimal fork of the excellent Jigsaw-Code/outline-go-tun2socks written in golang. A majority of work is on the UI with other parts remaining same as on Jigsaw-Code/Intra, and so the implementation underneath is pretty much the same. A split-tunnel traps requests sent to the VPN's DNS endpoint and relays it to a DNS over HTTPS endpoint of the user's choosing and logs the end-to-end latency, time, the request query and its answer.
A malware and ad-blocking DNS over HTTPS resolver at
https://free.bravedns.com/dns-query (deployed to 200+ locations world-wide) is the default DNS endpoint on the app, though the user is free to change that. A configurable DNS resolver that lets users add or remove blacklists and whitelists, add rewrites, analyse DNS requests is launching late October, 2020. Right now, a free-to-use DNS over HTTPS endpoint with custom blocklists can be setup here: bravedns.com/configure.
RethinkDNS is not an anonymity tool: It helps users tackle unabated censorship and surveillance but doesn't lay claim to protecting a user's identity at all times, if ever.
RethinkDNS doesn't aim to be a feature-rich traditional firewall: It is more in-line with Little Snitch than IP tables, say.
RethinkDNS is not an anti-virus: RethinkDNS may stop users from phishing attacks, malware, scareware websites through its DNS-based blocklists, but it doesn't actively mitigate threats or even look for them or act on them, otherwise.
To turn Android devices into user-agents: Something that users can control as they please without requiring root-access. A big part of this, for an always-on, always-connected devices, is capturing network traffic and reporting it in a way that makes sense to the end-users who can then take a series of actions to limit their exposure but not necessarily eliminate it. Take DNS for example-- for most if not all connections, apps send out a DNS request first, and by tracking just those one can glean a lot of intelligence about what's happening with the phone and which app's responsible.
To deliver the promise of open-internet for all: With the inevitable ESNI standardization and the imminent adoption of DNS over HTTPS and DNS over TLS across operating systems, we're that much closer to an open internet. Of course, Deep Packet Inspection remains a credible threat that can't be mitigated with this, but it is one example of delivering maximum impact (circumvents internet censorship in most countries) with minimal effort (not requiring a use of a VPN or IPFS, for example). RethinkDNS would continue to make these technologies accessible in the most simplest way possible, especially the ones that get 90% of the way there with 10% effort.
We aren't there yet, may never will be but these are some tenets for the project for the foreseeable future.
Internet censorship (sometimes ISP-enforced and often times government-enforced), unabated dragnet surveillance (by pretty much every company and app) stirred us upon this path. The three of us university classmates, Mohammed, Murtaza, Santhosh got together in late 2019 in the sleepy town of Coimbatore, India to do something about it. Our main gripe was there were all these wonderful tools that people could use but couldn't, either due to cost or due to inability to grok Computer-specific jargon. A lot has happened since we started and a lot has changed but our focus has always been on Android and its 2B+ unsuspecting users. The current idea is a year old, and has been in the works for about 4 months now, with the pandemic derailing a bit of progress, and a bit of snafu with abandoning our previous version in favour of the current fork, which we aren't proud of yet, but it is a start. All's good now that we've won a grant from the Mozilla Builders MVP program to go ahead and build this thing that we wanted to... do so faster... and not simply sleep our way through the execution. I hope you're excited but not as much as us that you quit your jobs for this like we did.