rdns dev here
Onlyfun What is the lockdown option in wireguard proxy in advanced mode
In Lockdown mode, Rethink will always use the WireGuard configuration for apps that are routed through it, regardless of whether WireGuard is turned on or turned off or connected or not. This means, among other things, if the Lockdown WireGuard configuration isn't connected or is turned OFF, all apps routed through it will lose connectivity.
If a non-Lockdown WireGuard is turned OFF, the apps setup to route through it will start using the underlying network (wifi or mobile) unless at least one Always-on WireGuard is setup, in which case, those apps should then be routed through Always-on. If there are multiple Always-on WireGuards, any healthy/active one is used among them at random.
Onlyfun And what is the always on?
An Always-on WireGuard configuration will route ALL apps NOT routed by any other active (turned OFF) or Lockdown WireGuard. Think of it like the base/underlying/catch-all WireGuard.
Onlyfun And what happens if they are both on?
For WireGuards in Advanced mode, you can NOT turn OFF an Always-on WireGuard, so turning both Lockdown and Always-on ON will have the same effect as just Always-on. There's some changes with respect to how WireGuard's Allowed IPs portion will behave in Rethink when both of these are turned ON, but I don't remember exactly what changes.
Onlyfun The only way i found to not leak dns is stick to simple mode proxy
Split-tunnel DNS is coming in v055o. It will be turned ON by default on Android 12+. On Android 11 and below, folks can turn it ON from Configure -> DNS -> Split-tunnel DNS, but on Android 11 and below, doing so requires folks to turn ON Configure -> DNS -> Advanced DNS filtering, too.
Onlyfun and toggle on 'never proxy dns'. I've read many times that rdns is designed to route dns through the wireguard proxy. So what is the 'never proxy dns' thing?
Turning ON Configure -> DNS -> Never proxy DNS will do exactly what it says? It will not proxy user-set DNS (DoH/DoT/ODoH/DNSCrypt/DNS53 except System DNS and mDNS) over any proxies that may have been setup (for instance, SOCKS5, Orbot, HTTP, Simple mode / Always-on WireGuards). Note that, this is different from using a proxy-provided DNS (like WireGuard configurations do). To route both an app's TCP+UDP traffic and an app's DNS queries, v055o will support Split-tunneling DNS as mentioned above, on Android 12+ by default (and on Android 11 and below, if Advanced DNS filtering is turned ON).