Blokada: I want to block apps from Internet access (Firewall)

[MrHeating]

I'd like to completely block internet access for certain apps. Would that work?

[kar]

Not as of now, but it's a good feature request.

[jeroen7s]

:+1: for this request

[kar]

Hi there, amazing app you got here. I was wondering if you could add an option to block a specific app from accessing the internet. Sometimes some apps request access to certain things on my device, that it doesn't need. I am on Android 5.1.1. so I can't deny specific permissions, so having an option on your app to block it from accessing the internet would be great. In case you already have this option, my bad, I'm new to this app. Let me know how to activate it. Thanks :)

[jerryn70]

+1👍

[GambaJo]

This would be great. But I would like to add a single app to the blacklist or all. All would be very useful, because I want to black all apps and only give some of them a permission to access the internet. Also for the system apps.

[maverick74]

I would like the same as @GambaJo !!!

All apps access to internet blocked by default and only allow the ones I really need!!!

Naturally, the ones allowed should still have their ads blocked!!!

[peterroth]

You are an advanced user. Most of the users aren't. If we would block every internet access, the users would remove the app within 5 sec.
So, what about allowing a few and you can decide what should be blocked?

[maverick74]

@rpeter85 I really don't care what the defaults are as long as one can change them in the configs!

In fact it would indeed be better if it would just block ads by default and then, if the user wants, be able to block the apps.

Ideally to block apps I think the user should first decide if it wants to work with a white list (where by default all apps are allowed to access internet except the ones in the list) or with a black list (where by default all apps are blocked from access internet except the ones in the list).

Again, as long as one can easily configure it, defaults as not important for advanced users :)

[GambaJo]

@rpeter85 It depends on how you implement this. If it's transparent, what's happening, then I think, it will be ok. Some system apps shouldn't be blocked, but you can show a hint.
I know this feature from NetGuard. You can configure the app, that every app is blocked, even the new installed. And then the user can decide, if the app should have access.

[maverick74]

Yes, NetGuard has this and i think it's well implemented (unfortunately some features are pay-for only...)

[androidacybot]

This would be a handy feature for those who only or mostly use mobile data. If I can say "only apps x, y, z get internet" or "x app gets no internet" that would be great.
Also, if an app has the internet permissions but doesn't use it in a beneficial way(such as ones that only report your info to a server) you could blacklist it. This way you could also integrate with existing blacklists

_Sent from my TETRA using FastHub_

[MrHeating]

The last one is the main reason I'd like this feature to be implemented.

On January 10, 2019 12:54:24 PM UTC, colbycdev [e-mail] wrote:

This would be a handy feature for those who only or mostly use mobile
data. If I can say "only apps x, y, z get internet" or " hog> app gets no internet" that would be great.
Also, if an app has the internet permissions but doesn't use it in a
beneficial way(such as ones that only report your info to a server) you
could blacklist it. This way you could also integrate with existing
blacklists

--
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub:
https://github.com/blokadaorg/blokada/issues/49#issuecomment-453086191

--
Sent from my Android device with K-9 Mail. Please excuse my brevity.

[maverick74]

I, personally, would like to set that no apps get internet access except the ones I say so.
From the ones that are allowed, I would like those to get their ads blocked (while retaining Internet access to the useful features that really need it)

[RichyHBM]

My view would be that by default all apps are under the Blokada filter, then you would have a drop-down that lets you set between allow all (already in the app I believe), filter network (i.e. use Blokada filtering), and Deny all (i.e. block all internet access)

[Esokrates]

I want to outline though, that it would be desirable to implement this feature like in Netguard: Being able to whitelist/blacklist internet access for wifi / mobile data connection separately, so I can block apps wasting my data plan while allowing everything on wifi.

Use case: For example most children have tablets/phones today and it would be desirable to only whitelist mobile data for select applications, like messaging apps. So they can safely use apps without wasting money due to them not understanding / forgetting they are not on wifi.

Maybe you could borrow some code from Netguard? The Netguard Dev btw has no intentions to allow automatic filter updates and the like, so partly redoing Netguard is really appreciated due to the dev of Netguard having a different vision.

[okan35]

Hello, is anyone working on this as I could definitely check this and try to implement it as I have been using blokada for a long time and want to block some apps internet access,so I don't want to use another app for this.

[gkrishnaks]

Netguard already has this feature. Currently blokada is lightweight , low on ram and battery. I wonder if this feature will increase ram and battery consumption. Maybe a way to have it default ON, but toggle OFF feature button to switch it off completely if user wants to save her battery or ram. Although I am not sure if that will save memory or battery either. Just thinking about it!

[Esokrates]

Netguard already has this feature. Currently blokada is lightweight , low on ram and battery. I wonder if this feature will increase ram and battery consumption. Maybe a way to have it default ON, but toggle OFF feature button to switch it off completely if user wants to save her battery or ram. Although I am not sure if that will save memory or battery either. Just thinking about it!

While Netguard has that feature, Netguard is not a superset of blokada in terms of functionality, especially not regarding filter lists / adblocking. In Netguard you need to manage everything about your filters manually (and you can only specify one filter list), while in blokada you can have multiple preconfigured lists that are updated automatically by the app.

[gkrishnaks]

Yes, I'm aware of the differences.
I had been a long time user of netguard app, recently switched to Blokada 5 months ago.

[androidacybot]

The battery usage on netguard is pretty limited from my use, so that feature integration should be relatively lightweight
On the black/whitelist choice, I think it should be blacklist by default and switchable to whitelisting

_Sent from my moto g(6) using FastHub_

[ka223]

The firewall options (block, mobile, wifi, screen on ...) are unique on netguard.
Maybe something similar can be implemented here too?

[beerisgood]

LineageOS users can already config that app-based

[maverick74]

@okan35 and @kar is there any news in this issue???

Is okan35 (https://github.com/blokadaorg/blokada/issues/49#issuecomment-466792093) working on any front in this?

[okan35]

I haven't worked on it because code is kind of hard to understand and the feature is not easy to implement also.

[infinitytec]

It would also be nice to set data limits for apps.

[ikanakova]

I've tried to switch to Netguard because Blokada doesn't allow completely block internet access for certain apps but Blokada is more user-friendly, so I came back, but I miss this option very much!

[Tobias-B-Besemer]

Just want to mention that if someone have a rooted device, he can use AFWall+ as a very good workaround...

[kojid0]

Really miss this feature too! +1 for this 👍

[English106]

I would love to block internet access per app or at least while the screen is off.

[alexanderadam]

Just a hint for people who are using their phone with a Google Account:

If you didn't change it you can see what apps are currently tracked under google.com/myactivity.
So when the feature is added you might get some inspiration what apps you might want to add.

I'm curious though why the responsible URL isn't tracked by the default lists.
@kar do you know why this might be?

[kar]

We don't manage the lists, you'd need to ask the maintainers.

[ovz93br43v7]

Is there any chance to get priority on this feature e.g. with a feature bounty donation?

[Ansem93]

I would love this feature too!
Since Netguard work the same way as blokada, shouldn't be possible to use their code to add this feature to blokada?

[MrHeating]

@Ansem93 I'm not a programmer, but, as far as I am aware, Netguard is very different in its codebase. It's pretty much as if you'd try to take a phone camera sensor and replace its lens with one grom a professional camera. You might get it working somehow, but it's unnecessarily complicated and manufacturing a new fitting lens eould be 10¹¹ times more efficient, even if it takes longer.

[MrHeating]

@ovz93br43v7 I second this, I would also be willing to 'invest' to help this feature manifest.

[ps100000]

This feature is being worked on but there are a lot of changes on critical pieces of code that have to be done so it might still take quite some time to implement this.

[ps100000]

Bad news. Starting with Android 10 access to the info which app created a connection is blocked so until we find a new way to get this information its pointless to implement this feature as it would only support Android < 10.

[MrHeating]

Oh… that's very unfortunate. Maybe it would be possible to utilize the work profile to isolate apps and create address profiles or something like that?

[animeking9901]

Ah I've seen apps use the work profile for isolation before,maybe that
would be a thing. IDK myself but perhaps it could be possible

[ovz93br43v7]

According to some Google Play comments this firewall app https://play.google.com/store/apps/details?id=app.greyshirts.firewall.beta should work with Android 10.
This app work also via VPN but is not FOSS :-(
Probably the developer of this app can give you a hint how this is possible....

Am 25. Februar 2020 11:11:45 MEZ schrieb animeking9901 [e-mail]:

Ah I've seen apps use the work profile for isolation before,maybe that
would be a thing. IDK myself but perhaps it could be possible

--
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub:
https://github.com/blokadaorg/blokada/issues/49#issuecomment-590788733

[ps100000]

Oh… that's very unfortunate. Maybe it would be possible to utilize the work profile to isolate apps and create address profiles or something like that?

Might have look at this option someday. For now I spend enough time trying to implement this feature just to realize it won't work this way. I'll come back to it. Just not sure when and how.

[MrHeating]

@ovz93br43v7 Do you (guys) think that decompilint that app would help? I've seen recently some news about a decompiler for Android apps being released, but ignored it because I don't know Java.

[ps100000]

@ovz93br43v7 Do you (guys) think that decompilint that app would help? I've seen recently some news about a decompiler for Android apps being released, but ignored it because I don't know Java.

I'll have a look at it. Didn't do reversing Java for a bit so it should be a nice exercise. ^^

[jawz101]

How does NetGuard do it then? Or AdGuard?

[MrHeating]

@jawz101 I'd suppose they are using the Android 9- way as well.

[MrHeating]

@jawz101 I'd suppose they are using the Android 9- way as well.

[jawz101]

I'm using Android 11 Developer Preview right now

[jeroen7s]

Bad news. Starting with Android 10 access to the info which app created a connection is blocked

Wouldn't this also break the functionality to whitelist urls for a specific app?

Ex. I block all socialmedia urls for all apps except for the "frost for facebook" app

[ps100000]

@OffifialMITX @jawz101
I might have found the new way how other apps do it. So maybe this feature is still doable but it means even more work as it conflicts with Blokadas minSdkVersion. So I would have to implement the old and the new way.

[ps100000]

Wouldn't this also break the functionality to whitelist urls for a specific app?

Whitelisting the hole app is still possible as this uses the normal VPN API.

[MrHeating]

@ps100000 I think they mean specific urls and not just whitelist apps in general?

[MrHeating]

@ps100000

means even more work

Again, is there some way we can support you? At least monetarily, or something. I, for one, don't have much, but would like to donate to a good cause.

[rugk]

To reiterate the scope of this issue here and to focus, here is what is said in the OP:

I'd like to completely block internet access for certain apps. [highlighting by myself]

So this is _not_ about:

• whitelisting (i.e. allowing all traffic)
• or about specific URLs (for an app)

This is just about blocking all access to the internet for one app.

IMHO, we should open other issues for other topics/feature requests.

[ps100000]

@OffifialMITX
I'm not the main developer and I can only do this stuff in my freetime and I guess you can't donate me more freetime. ^^
But if you want to donate a few bugs to the main dev I'm sure he'll appreciate it. :)

[ps100000]

@rugk
Sure but tbh it's all one pool of features connected to the same core functionality. If this part is finished the rest is relatively simple to do. :)

[jaypatelani]

Simple interface like this can be useful:

[AB1908]

Hi folks. Sorry to bump everyone but what's the status on this? From what I can gather from the history, Android 10 changes how this is handled so Blokada would need two features, one for the old OS and one for the new. Presumably, that's a major deterrent and this is on the backburner?

[erison15]

Just do it, please <3

[c933103]

Just like the app can already whitelist some apps and let all traffic from the app bypass blokada filter, it would be nice to be able to blacklist some app using a similar interface option and principle to block all internet access from those apps.

[abruenin]

Any news about this? Blokada has the best filtering. Other Firewalls like NetGuard can completely block apps, but their filtering is limited. Hopefully one of these will catch up where the other is better. I had no problem if this would become a paid feature and it does not have to be cheap. Just hoping
someone will do it.

[alekksander]

if it solves anyone problem — tracker control (f-droid repo as well) has ability to deny internet access for chosen apps

[szaimen]

if it solves anyone problem — tracker control (f-droid repo as well) has ability to deny internet access for chosen apps

Thanks but unfortunately you cannot use two apps that both use the android vpn service at the same time.

[ln-12]

Hey guys, I would also really want to see this feature as part of Blokada. Recently, I discovered the app BraveDNS which both provides custom DNS and a firewall. It is open source, so it should be easy to port this funtion to Blokada.

[AB1908]

It is open source, so it should be easy to port this funtion to Blokada.

First off, please understand that I mean no hostility and am simply expressing my displeasure. It is not a personal attack in any shape or form and I apologise if it comes off as such.

That is a vastly oversimplified take of how FOSS development works. I say this as someone who has tried to dive into _simple_ codebases and failed. It is a known trope in the software dev world where "Why don't you do XYZ? It's so easy!" and it really grinds people's gears. It is understandable that a lot of people are unfamiliar with dev work but I must respectfully ask that you refrain from saying something similar in circles like these. Thanks for understanding!

[ln-12]

I am not unfamiliar with dev work at all. For me it is always a big relief to find some project containing code that I can reuse or at least use parts of. I took a quick look into BraveDNS and found some snippets which might be useful. Here they are collecting information about every app. The UID (which is assigned at install time) is used as unique identifier. An internal variable is used to determine if an app should be blocked or not. Here they check if an app should be blocked or not. Finally, they find the UID of a connection by asking the ConnectivityManager (only API >=29, I know...).

While digging into Blokada, I found that a firewall feature seems to be on the TODO list as stated by this comment. Blokada also already makes use of the ConnectivityManager. The only thing I found not (by now) is where the firewall check should be implemented. But I think the developers of Blokada maybe can answer this question, so this feature could make it into the app in the near future, I would be really happy to see it. Maybe my comment can help.

[AB1908]

I apologise for making assumptions and I'm sure the devs would find your investigation useful. I have clearly misunderstood your intentions.

Indeed, it would be neat if this feature makes its way into the app. I would love to have it.

[ps100000]

Thanks for sharing your findings. In fact there are a few things happening in the background right now to get this feature into Blokada somewhere in the near future. :)

[ignoramous]

I took a quick look into BraveDNS and found some snippets which might be useful. Here they are collecting information about every app. The UID (which is assigned at install time) is used as unique identifier.

Implementing a firewall the way RethinkDNS / BraveDNS does isn't ground breaking in anyway, the big issue is the UX (and follow-up customer support) around it, because it tends to breaks a lot of things, including wifi-calling and some video conferencing apps. That aside, most Chinese OEMs (which is like 60% of the Android phone market) like the Oppo companies (w/ Realme, OnePlus, Vivo), Xiaomi, the Lenovo companies (w/ Motorola) already come with a built-in, battery-efficient firewall.

RethinkDNS / BraveDNS doesn't implement a firewall for the sake of it. It is a security tool, first and foremost, and that warrants a "TCP/UDP network manager" of which firewall is _one_ part. Very different use-case to ad-blocking and/or privacy app that Blokada aims to be. Besides, Google is allegedly implementing a firewall in AOSP themselves in Android 12.

[UstedLoco]

+1 on this feature request.