Is RethinkDNS necessary on a GOS phone?

sappy_junior728

Would you download and install it on a GOS phone? Any advantages to using it with GOS since it's supposed to have its own firewall within the OS?

thmf

sappy_junior728 What's necessary for GrapheneOS phone is already there right on first boot. The rest is up to the user.
GrapheneOS has a built-in firewall.

chinook

sappy_junior728 RethinkDNS is not a firewall (per se), GoS has no built-in ad blocking.

I think you can go on the RethinkDNS project page and decide for yourself :)

Novalissoide

sappy_junior728
RethinkDNS has network logging better than anything I've seen.

nologo

sappy_junior728 Is RethinkDNS necessary on a GOS phone?

Well, I'd say it's more necessary on a non GOS phone than on a GOS phone, because of all the security features GOS already has on board. I used RDNS for a while on stock Android before my GOS-days, but for me it doesn't add value on GOS so I don't use it now. But your goals may differ from mine.

I also found working with RDNS a bit difficult, to be honest. I'm no expert on DNS and networking and stuff, and found some of RDNS's features and settings quite hard to understand and wasn't always sure I understood the logs correctly.

vqrmbkog

Rethink: DNS + Firewall + VPN

Rethink has 3 main features let's see if gos has anything similar

DNS - You can leverage the graphene os private dns feature ( you can use mullvad dns contains adblocking filter lists)
Firewall - GOS firewall is powerful than rethink dns firewall. rethink dns firewall uses vpn based that's why gos is better
VPN - If i want any vpn app like mullvad or proton i can directly download the official app because all these major providers support wireguard so no need for rethink dns vpn

so i don't see any value of relying on third party app.

sappy_junior728

vqrmbkog

That's good to know. So GOS' firewall doesn't take up Android's VPN slot, and I can use Mullvad's app at the same time?

Stewart

I'm completely lost now; I thought I read that RethinkDNS was preferred over private DNS in GOS. But GOS was recommending using RethinkDNS.
With RethinkDNS you can:

Use different DNS (Quad9 for each app)
Block ads and trackers in every app using a blocklist like Hagezi
Use a VPN via WireGuard, which I use for Vanadium

I'm not really sure anymore, I just want to understand what the best thing to do is in terms of security and privacy.

nologo

Stewart GOS recommends not using Private DNS if you are using a VPN. RethinkDNS is advised IF you want to use DNS for filering AND a VPN:

If you're using a VPN, we recommended against having a Private DNS server configured. If you want to filter traffic while using a VPN, use a VPN service app able to do both such as RethinkDNS. Private DNS also interacts strangely with multiple profiles since each profile has their own VPN configuration but Private DNS is global. We strongly recommend fully disabling Private DNS when using a VPN on any secondary profile until it's overhauled.

Stewart I just want to understand what the best thing to do is in terms of security and privacy.

There is not one 'best' thing. All depends on threat model, goals, set-up of your phone, and personal preferences.

littlerack

Stewart . But GOS was recommending using RethinkDNS.

I don't recall GOS team specifically recommending rethinkdns. It's very unlikely. It's a part of community here that uses RDNS, including me.

sappy_junior728

nologo

That's in the context of using multiple profiles. What if I'm using one profile with GOS?

Stewart

Right, I get it now, thanks for the clarification, I'll keep using RethinkDNS then.

Revliss

Rethink is purely DNS, it doesn't block ports as far as I know.

littlerack

Revliss Rethink is purely DNS, it doesn't block ports as far as I know

Not exactly (though I don't know how it's done under the hood), it allows you to:
a. block UDP except for DNS and NTP
b. block insecure HTTP (port 80)
c. block attempts to bypass specified DNS

Stewart

I have several profiles:

The owner profile, which I only use to access the other profiles (there's nothing on it)
The main profile, where all my apps are
The work profile for professional use

If I've understood correctly, if you're only using one profile, it's better to use Android's (GOS) private DNS, but if you're using several profiles, it's better to use RethinkDNS to manage the DNS for a specific profile, because enabling private DNS on the owner profile will enable it on all the others, which can cause issues.

Is that right?

sappy_junior728

Stewart

That's how I'm reading it. Hopefully, the GOS experts can clarify this.

Eagle_Owl

sappy_junior728
RethinkDNS is a very good service, but you do not need to install their app!

If you like a little bit confusing UI, then use their browser version (DNS/Firewall).
If you want less battery times, then install their app, too.

I prefer long battery times and a UI, which is simple to understand and easy to handle.
That's why I use NextDNS as additional protection and block harmful and annoying apps and websites with the block lists activated there.
This is all working on DNS-level, no app needed.
You control it via dashboard in your browser.

littlerack

Eagle_Owl That's why I use NextDNS as additional protection and block harmful and annoying apps and websites with the block lists activated there

What's missing in your setup with cloud-only DNS resolver is the ability to set individual rules on per-app basis. I may want to allow access to subset of map domains of Google for apps that absolutely need it (mainly taxi apps) and block for others.
In cloud-based it's all or none.

nologo

sappy_junior728 That's in the context of using multiple profiles.

No. Note the word 'also' in the quote. The first part of the quote is a general statement. After that, it is pointed out Private DNS + VPN is also problematic if multiple profiles are used.

So the advise is the same for single and multiple profile configurations: do not use Private DNS in combination with a VPN. If you want to filter/block by DNS and use a VPN, then you need RethinkDNS. And if you want to do this on multiple profiles, then RethinkDNS must be installed on all those profiles.

DohnJoe

littlerack

As a (partial) fix, one can use a VPN with DNS service + split tunneling.

Using RDNS would take the vpn slot anyway, with the split tunneling you could have exceptions per app and have two main groups: restricted dns apps and regular apps.

I don't know if this adds anything to your setup.

If RDNS already has split tunneling I would say this doesn;t actually add anything.

littlerack

sappy_junior728 GOS since it's supposed to have its own firewall within the OS

Inbuilt fw isn't really configurable by the end user oob.