Is RethinkDNS recommended by GOS?

kebab_definite

If so, how can i make sure Rethink don't allow connections with out VPN?

UndercoverBozo

kebab_definite use the proxy setting and upload a wireguard config file from your vpn.

fid02

Is RethinkDNS recommended by GOS?

From using Ctrl + F on grapheneos.org, I found the following texts:

If you're using a VPN, we recommended against having a Private DNS server configured. If you want to filter traffic while using a VPN, use a VPN service app able to do both such as RethinkDNS.

RethinkDNS combines local filtering via DNS with the ability to directly use a WireGuard VPN without another app. It also has other features such as connection monitoring. This is a much better approach than most of the apps in this space which force choosing between them and a VPN, recommend problematic TLS interception (AdGuard), etc.

I interpret this as the site informing users of the downsides of various DNS and filtering apps, while highlighting how a better approach can be achieved. I wouldn't go as far as saying that GrapheneOS is specifically "recommending" RethinkDNS over other apps – just using some of its features as an illustration.

mmmm

fid02 I wouldn't go as far as saying that GrapheneOS is specifically "recommending" RethinkDNS over other apps – just using some of its features as an illustration

The fact they mention it in the first place counts as something. I would say its a recommendation in the specific context.

ignoramous

rdns dev here

Rethink is NOT recommended by GrapheneOS. It is mentioned in the FAQ for now, and that's all there's to it.

Someone asked a related question elsewhere (mirror) and I wrote:

If it is any helpful signal, Orbot's lead developers use Rethink (ref / mirror), as do DNS66's (ref). Security researcher and blogger, Mike Kuketz, occasionally writes about Rethink (ref), oft times, critically enough.

Privacy Guides, and lead developers of CalyxOS and DivestOS publicly recommend (or have recommended) using Rethink. GrapheneOS mentions (not a recommendation) Rethink in their FAQ (though, the community is savvy enough to know the limitations of an app like Rethink, its shortcomings and bugs).

kebab_definite

ignoramous

There are problems listet why he donst make a tutorial just jet. Are they fixt by now?

https://www.kuketz-blog.de/rethinkdns-tutorial-auf-unbestimmte-zeit-verschoben/

And i saw an issue on github with Orbot and RethinkDNS. RethinkDNS is connecting without Orbot some times. That can be bad.

CyberOtter

kebab_definite Mike has since said that the tutorial will be published in autumn. Since the post you linked, Rdns has released 11 new versions, addressing many issues pointed out by Mike.

kebab_definite

CyberOtter so its possible now to use it without the danger to be connected to the internet without vpn?

GlytchMeister

kebab_definite

Yes, it is. If you look through Ignoramus's post history you'll find a fair amount of posts relating to this risk and how to mitigate it... A few of them in threads I started because I'm a bit of an idiot sometimes :P

IIRC, using the always-on VPN setting in the OS settings in conjunction with RDNS's "simple" mode will ensure that nothing leaks through RDNS without going through the VPN.

Here's a good post that sums it up, I think

I'm pretty sure you can also specify what DNS you use... For purposes of reducing one's online fingerprint, the general recommendation is to use the DNS provided by the same entity that provides your VPN. Using something else will either expose you to a privacy-hostile DNS host or make you more unique.

kebab_definite

GlytchMeister thanks that is help full.

If i understand it right, it is possible to have a one device DNS (offline dns) so you can use the vpns dns with one device block list?

Onlyfun

can someone elaborate in few words on benefits of using rdns vs using a vpn provider's app?

Dumdum

Onlyfun
RDNS has a firewall that allows more fine grained control over network access, at the same time as using a VPN. As opposed to just a VPN via a provider's app.

https://github.com/celzero/rethink-app

Rethink DNS + Firewall has three primary modes, VPN, DNS, and Firewall. The VPN (proxifier) mode supports multiple WireGuard upstreams in a split-tunnel configuration. The DNS mode routes all DNS traffic generated by apps to any user chosen DNS-over-HTTPS or DNSCrypt resolver. The Firewall mode lets the user deny internet-access to entire applications based on events like screen-on / screen-off, app-foreground / app-background, unmetered-connection / metered-connection; or based on play-store defined categories like Social, Games, Utility, Productivity; or additionally, based on user-defined denylists.

GlytchMeister

kebab_definite

That's getting a bit deeper than my knowledge goes... But that sounds like you're trying to layer DNS's and I'm not sure that's how they work.

DNS translates Human-readable URL's into machine-readable IP addresses.

I don't think you can use your own special DNS and the VPN's DNS.

I've never heard of offline, one-device DNS, but that sounds like a good way to make your online fingerprint extremely unique.

VPN DNS's often have block lists, and RDNS has its own implementation of blocklists, which you can customize without (to the best of my knowledge) making your fingerprint any more unique.

Onlyfun

Dumdum got you thx

kebab_definite

GlytchMeister

I thinking about rethinkdns with vpn and that so i use the vps dns. I hope its possible with set the dns to "system dns".

In rethinkdns ther is a feature thats aloud to use " on-device block lists"

My expertains are that i can use my vpn and its dns and block sides whiteout being more unique.

ignoramous

kebab_definite I thinking about rethinkdns with vpn and that so i use the vps dns.

Rethink will use DNS as set in WireGuard's configuration when it is ran in "Simple" mode (which runs a single WireGuard).

In "Advanced" WireGuard mode (which runs multiple WireGuard upstreams), Rethink would use user-preferred DNS as set in Configure -> DNS (either System DNS, Other DNS, or Rethink DNS). This is due a limitation in Android where per-app split-tunneling of DNS requests isn't possible, but we're working on a workaround (at least for A or IPv4 / AAAA or IPv6 queries) that we intend to ship soon-ish: https://github.com/celzero/rethink-app/issues/1510

kebab_definite

@ignoramous if u can clarify, it would be helpful.

kebab_definite

@GrapheneOS wrote:
"You should read our FAQ sections on these topics where we mention apps like RethinkDNS able to do local filtering which also using a VPN. We don't specifically recommend RethinkDNS but unfortunately there aren't other examples without bigger issues."

https://discuss.grapheneos.org/d/8330-app-compatibility-with-grapheneos/67