RethinkDNS

GlytchMeister

Ok I’m really sorry to seemingly ask the same question over and over but I am straight up microwaving my frontal cortex trying to comprehend this galaxy brain app

I’m trying to set up an internet connection that uses mullvad vpn and DNS to minimize fingerprint uniqueness, and use something to locally control what traffic is allowed in and out of my GOS phone

From what I can understand so far… I do not need the mullvad app.

I only need the RDNS app to actually manage everything, right?

I am trying to enter an unused wire guard key in Mullvad’s website into RDNS, but I must be getting my key from the wrong place because RDNS is asking for a public key (or will generate one?) and a private key and addresses, and I don’t even know if this key I’m looking at is public or private, and I only have the one, and it’s erroring because I don’t have anything in addresses. What do I put in addresses? Do I need to put the custom port provided my mullvad into the listen port or let it be random? Do I need to worry about the MTU, too?

ignoramous

GlytchMeister I am trying to enter an unused wire guard key in Mullvad’s website into RDNS,

Those fields (public key, private key, endpoint etc) are almost never setup "manually". You need to download / scan the QR code of your Mullvad profile's WireGuard configuration (I believe, from here: https://mullvad.net/en/download/wireguard-config/).

In Rethink, go to Configure -> Proxy -> Setup WireGuard
Tap on the + floating button near the footer.
Tap on QR CODE if you're scanning a QR code, or on Import if you've downloaded the WireGuard configuration.

GlytchMeister

ignoramous

Maybe its because I'm using my old iPhone to look at mullvad's website. I'll try again on my laptop later.

ignoramous

mmmm So what DNS does rethink use in this case?

In case of Advanced WireGuard, Rethink uses user-preferred DNS upstream as set in Configure -> DNS, but this upstream is tunneled over any one of the Always-on WireGuard (if setup) AND if Never proxy DNS is turned OFF (in Configure -> DNS).

mmmm For example, is it simply and literally on device? So bears no privacy implications?

Yes, these DNS blocklists must be downloaded from Rethink's servers. These help Rethink make decision on what domains to block locally on-device.

One privacy implication I can think of right now is one has to trust Rethink (to keep those blocklists untouched and updated).

GlytchMeister

ignoramous

But RDNS is open source, so people can check for themselves and raise the alarm if, hypothetically, RDNS started misbehaving or was compromised, right?

mmmm

ignoramous In case of Advanced WireGuard, Rethink uses user-preferred DNS upstream as set in Configure -> DNS, but this upstream is tunneled over any one of the Always-on WireGuard (if setup) AND if Never proxy DNS is turned OFF (in Configure -> DNS).

So just to be clear, advanced mode will use the DNS of say proton or mullvad setting the config as you directed?

Also a quick side question. On another thread a user claimed (and until I did a cursory check I also presumed) that on simple mode there is no such thing as a true always on mode, like the rethink app would 'take over' that function from android and be always on, but if I disconnected the wireguard VPN connection within the app it wouldn't hold true in the same sense. Can you please verify this? It seems it does sever connections but I'm worried as I have heard multiple claims to the contrary

Thanks for all the help, the app is powerful but quite complicated for the uninitiated. To clarify, the app probably isn't but the actual concepts are.

ignoramous

mmmm So just to be clear, advanced mode will use the DNS of say proton or mullvad setting the config as you directed?

No, but the exact opposite: Only Simple mode will.

A "preferred" DNS upstream is whatever upstream the user has set from Configure -> DNS in Rethink (or Android's Private DNS, if that is set).

mmmm Can you please verify this?

Sorry, will you please reword your query? I couldn't understand it fully.

mmmm o clarify, the app probably isn't but the actual concepts are.

Yep. We plan to use the open-source Gemma 2 2B model on-device to let users talk to the app's database and our documentation in natural language in a bid to help ease this. We've applied for a grant to work on this from Mozilla. Let's see how that goes.

mmmm

ignoramous Sorry, will you please reword your query? I couldn't understand it fully.

Sorry. I suppose the question can be: asked of the of simple mode, how is the the additional vpn 'always on' VPN used? Is it the first vpn as such? If,say proton is it, is it that? Or merely the connecrion to Rethink?

mmmm

mmmm sorry I don't know how to put that in workable English!

ignoramous

mmmm asked of the of simple mode, how is the the additional vpn 'always on' VPN used? Is it the first vpn as such? If,say proton is it, is it that? Or merely the connection to Rethink?

If you mean Android's Always-on VPN setting, then it is Android that enforces it, as in Android makes sure the "always on" VPN is always up and running. If not, the user is shown a notification.

If you mean Rethink's Always-on WireGuard, then that's a different concept.

An Always-on WireGuard cannot be turned OFF.
An Always-on WireGuard is used by any app that isn't proxied by any other WireGuard configuration.
If multiple WireGuards are set Always-on, then any one (that is connected / working) among them is selected.
If ALL Always-on WireGuards don't work (aren't connected / working) then Rethink does not bypass it. This manifests as connection timeouts / connectivity loss for apps.

Rethink's Simple mode WireGuard configurations are by default Always-on.

mmmm

ignoramous sorry for being confusing. I'm referring to the fact that androids always on VPN ensures that rethink is always on. Does rethink mitigate that by ensuring it itself has an always on VPN connection. I wouldn't want rethink to accidentally trick android (and me) into thinking I'm protected via a VPN service, when really I'm just connected to rethink.

I think from your previous response that rethink's always on connection (in simple mode) does work as intended.

ignoramous

mmmm previous response that rethink's always on connection (in simple mode) does work as intended

Yes. You got it.

nandohyphen1

Now that I use GrapheneOS, I've been hearing a lot about RethinkDNS and I have some questions. First of all, what exactly does it do? Can Proton VPN be used with it? And should I use RethinkDNS? Thanks.

chinook

nandohyphen1
1) what does it do

https://rethinkdns.com/ - it's prominently in the main the page

2) Can Proton VPN be used with it?

not the app (you can only have only VPN app like this enabled at any time) but you can add Proton VPN wireguard connection and ask RethinkDNS to use it

3) should I use RethinkDNS?

Should you? I think you should consider it ;^)

nandohyphen1

chinook it does seem really cool. I am going to check it out. :)

becomeparmesan

nandohyphen1 Just to warn you: the latest versions are quite unstable and are pre-releases. Go for version 055n I would say.

And for its functions: take your time and read here and on reddit (/r/rethinkdns) about its capabilities. It is by far the most capable app I know to allow, block and regulate phone connections (for specific apps but also for the whole system) - including VPN connections (which can also be activated only for specific apps). A starting point would be to activate some DNS blocklists and see if they work for you. From there, just increase the control over the apps and connections (blocking some specific IPs/domains of closed source apps to reduce tracking+traffic and see if they still work) by using the activated protocol. Have fun 8)