Use Rethink DNS to block internet, allow LAN

Probably9857

As the title says, I was hoping to use Rethink to block internet access for an entire profile, while allowing LAN access (specifically, mDNS resolution of .local addresses).

Does anyone know if this is possible?

The problem is, as soon as I start Rethink, .local addresses no longer resolve. This is before even trying to add any firewall rules. Selecting System DNS in Rethink DNS config doesn't help. Nor does experimental setting for allowing LAN access (which seems like it is only relevant to the VPN feature, which I'm not using). Nor does disabling the OS VPN killswitch, although I assume this would be necessary.

Additional info:

I'm not looking to use Rethink for DNS (but that is OK if necessary for some reason)
I don't need a VPN tunnel
I just want to block internet while allowing LAN

ignoramous

rdns dev here

LAN access generally has other problems when used with Rethink.

What Rethink version are you using? The latest on F-Droid is v055t. You can find the version information in the footer of the About UI.

Probably9857 Selecting System DNS in Rethink DNS config doesn't help. Nor does experimental setting for allowing LAN access (which seems like it is only relevant to the VPN feature, which I'm not using).

.local should be auto resolved by Rethink's built-in mDNS service provided Configure -> DNS -> Use System DNS for undelegated domains is turned ON.

What the Configure -> Network -> Do not route Private IPs does is exclude all RFC 1918 IPv4 addresses and ULA IPv6 address space from Rethink's tunnel. That may help if .local is resolved as expected by Rethink in the first place (which it should... but like you say it isn't).

If you are comfortable, you can look through what's going on when .local is recieved by Rethink by going to Configure -> Settings -> App logs.

Use the search bar to filter for the .local domain name you're trying to debug or generally use mdns: as the search term.
Make sure to tap on the "filter" icon in the search bar to change the log level to "Very Verbose" (the default is "Error"). This log level will revert back to "Error" after ~3h or so (to conserve power use).

You can either copy paste the logs to ask any capable LLM chatbot (to help it, point it to this code) to see if it is able to help, or you can share them with me here or over on email (mz at celzero dot com). If you do email, please leave a link to this GrapheneOS discussion thread, so that it is easier for me to search through my inbox.

Probably9857

ignoramous What Rethink version are you using?

I was using 055e from Play Store.

I've uninstalled that, and now trying to install from F-Droid (via Obtainium), but I'm getting an error from Obtainium that says "Incompatible com.celzero.bravedns" error after the prompt for Network permission.

Probably9857

Ok, now that I figured out how to download the right version from F-Droid...

ignoramous Configure -> DNS -> Use System DNS for undelegated domains

Enabled, but still not working.

ignoramous Configure -> Network -> Do not route Private IPs

Tried enabling, but had no effect

From looking at the logs, here is where things go wrong:

1766444449992,I GoLog: I async.go:21>mdns.go:399>mdns.go:463: mdns: listen: ignoring ans [service_name].local. 10 IN CNAME [my_server].local. to [service_name].local.

Looks like a CNAME record is not expected. Is there a reason?

ignoramous

Thanks for testing this.

Probably9857 Looks like a CNAME record is not expected. Is there a reason?

Yeah, the library we were using did not implement support for CNAMEs in mDNS. I've attempted a fix: https://github.com/celzero/firestack/commit/d1dbfe7386f660e15fe246c0a3ffc54454f17ef0

I say "attempted" because I don't use mDNS personally, nor have a test setup handy.

Besides, if you have write access to that domain (zone), remove the cname (or access with the cname) and see if Rethink is able to resolve and/or connect?

Probably9857

ignoramous Besides, if you have write access to that domain (zone), remove the cname (or access with the cname) and see if Rethink is able to resolve and/or connect?

This is not something I know how to do. (I don't really even know what a cname record is.)

However, if you plan to release that fix at some point, I would be glad to test it.

ignoramous

Probably9857 This is not something I know how to do. (I don't really even know what a cname record is.)

Try hitting [my_server].local directly instead of [service_name].local?

Probably9857 if you plan to release that fix at some point

Hopefully, by end of this week as v055v, if tests go through.

Probably9857

ignoramous Try hitting [my_server].local directly instead of [service_name].local?

I can do that in Vanadium (with Rethink), so it does work.

But it doesn't work for me because I need to connect to specific services on server.local. I can find the ports used for different services, but specifying server.local:port (is that even valid???) doesn't work in my apps (with or without Rethink). I assume that is because of how the server is configured, and is why it uses unique .local URLs for each service. Or maybe .local addresses with a port are just not a thing?