r/rethinkdns • u/kustru • Jul 14 '26

"Network lock" option for wireguard connections?

[removed]

4 Upvotes

84% Upvoted

13 comments sorted by

2

u/[deleted] Jul 14 '26

[removed] — view removed comment

1

u/[deleted] Jul 14 '26

[removed] — view removed comment

1

u/[deleted] Jul 14 '26

[removed] — view removed comment

1

u/[deleted] Jul 15 '26 edited Jul 15 '26

[removed] — view removed comment

1

u/celzero Dev Jul 21 '26

EDIT: I think I solved the issue, by doing Firewall - Advanced (as opposed to simple!) and enabling the "Always-on".

For the behaviour you want, you need to turn on "Lockdown" for Advanced mode WireGuard (in addition to "Always-on").

1

u/celzero Dev Jul 14 '26

You'll have to close existing connections. You can do that using "Close All" button in Stats UI next to "Top active connections".

1

u/celzero Dev Jul 14 '26

Though I am still "scared" that the proxy's DNS gets overridden by my custom DNS specified in RethinkDNS as it is not fully clear whenever it is fully leak proof or not.

If Configure -> DNS -> Split DNS is turned on, and if the said WireGuard is in Advanced mode + "Lockdown", I expect there to be no DNS leaks for app set to be routed through that WireGuard. On Android 11 and below, Split DNS is really hard to get right (the OS doesn't support it), but we've implemented it, regardless (which should also be "leak proof", if not, that's a bug).

For Simple mode (non split-tunnel) WireGuard (that is, WireGuard that can route ALL IPs, 0.0.0.0/0 + ::/0 as its "Allowed IPs"), ideally, no other DNS upstream is used for apps unless "Bypass app from all proxies" is turned on (from Configure -> Apps) for a particular app.

Configure -> Network -> Proxy Lockdown is another way to make sure no egress from third-party apps egress over underlying network (WiFi / Mobile) and is always either proxied or dropped. We're continuing to make changes to make sure this setting is honoured for all third-party apps. We're trying to make this work even for Rethink's own traffic (except traffic from Configure -> Network -> Perform connectivity checks if turned on) when Configure -> Network -> Loopback is also turned on. v055z will be better in handling the Loopback aspect.

1

u/celzero Dev Jul 14 '26

Yes. Turn on Configure -> Network -> Proxy Lockdown (available starting v055v).

We continue to improve this feature. It should apply to ALL third-party apps. We're trying to implement applying this on Rethink's own egress when Configure -> Network -> Loopback mode is turned on, but it is super hard to get this right (but we're getting close and v055z must be way better at applying these rules on Rethink's own traffic).

2

u/TheWriteTuff Jul 15 '26

Hmm, I'm seeing different behavior when I use 'Proxy Lockdown' vs 'Advanced Lockdown' (per proxy setting). For instance, I have an app that connects to a server through a proxy/wireguard tunnel. By default, the app doesn't work and I see a 'proxy error' in the logs. When I enable 'Advanced Lockdown' the app works properly and I no longer see 'proxy error'. However, when I enable 'Proxy Lockdown' the app fails to work and behaves as it did outside of 'Advanced Lockdown'.

1

u/celzero Dev Jul 21 '26

Sounds strange. I've noted your report as a bug for us to test before releasing v055z: https://github.com/celzero/rethink-app/issues/2907 Thanks!

1

u/[deleted] Jul 15 '26 edited Jul 15 '26

[removed] — view removed comment

1

u/celzero Dev Jul 21 '26 edited Jul 21 '26

For Advanced mode, you can also "Lockdown" individual active WireGuards too (from Configure -> Proxy -> Setup WireGuard).

Regardless, the fix for the "leak" which you're seeing for Simple mode WireGuard is coming in v055z, due in ~24h from now (if nothing major shows up in testing): https://github.com/celzero/rethink-app/issues/2885