Profiles, and bugs

[Opening-Button-8988]

Profiles

Suppose I connect to the internet in one of two ways;

1. Home internet
2. Mobile broadband, away from home

I propose separate network profiles. Each profile can be used for different threat models or use cases. One of those use cases would be when away from home using a mobile provider - here I would personally keep a proxy active at all times (if possible, see note below) and have some settings adjusted, including but not limited to;

• Block on metered (mobile) network disable
• Block port 80 traffic enable
• Block all apps when device is locked enable
• Maybe block certain apps that I wouldn't normally block when at home

Honestly, I'm more burdened by the inability to connect to the internet on a mobile service than I am about doing so with certain privacy protections. So switching to profile B when I leave the house would just save me valuable time if nothing else.

Side note, at the moment I cannot connect to my mobile provider if I'm connected to Wireguard. Connecting to that VPN with the standalone app works, possibly because Rethink prevents DNS leakage while the VPN app doesn't?

Universal firewall settings, but for individual apps

I know you can adjust certain settings for specific apps, but for example, I don't think you can block a specific app when device is locked or when app is not in use, or block that specific app when it tries to bypass DNS. In other words, most of the settings under Universal firewall rules, except port 80 which I know you can block on a per app basis already. I'd like to have a universal firewall rule enabled, but disabled for a specific app, or vice versa.

Bugs and other problems

v055a, installed via F-Droid. Always-On enabled, Block connections without VPN disabled.
OS: GrapheneOS (Android)

• VPN crashes sometimes when starting/stopping. I'm usually connected to a wireguard proxy.
• Some (blocked) connections don't get logged. Access to a website will fail but I have no way to identify the problem. Example is assets.adobedtm.com, I believe I needed to disable Rethink to access a certain site that depended on having a connection to this domain, but it would never get logged in Rethink. I recall mentioning this problem around a year ago, it still seems to be a problem.
• Not an issue specific to Rethink but even after nearly 2 years of using Rethink I'm still left scratching my head as to what DNS provider and what protocol to use, such as doh, dnscrypt, or use the same dns as my vpn. I cycle between dnscrypt Quad9 Secure, sometimes with or without relay (lately I've avoided the relays because I discovered they use cryptostorm.is, whose integrity should be put into question), and various RethinkDNS endpoints. As far as I'm aware, the only difference between the different RDNS endpoints is their blocklists, but I can customize my own on-device blocklist, they seem redundant.

Questions

• When using Orbot through Rethink, I normally select all apps to be included in the tunnel (including system). Is there any reason why this might be a bad thing, why I should only select the app that I intend to use? A lot of the system apps for example, might not work if included in the tunnel, or traffic coming from the app that was included in the tunnel might leak to other system apps.
• How does Orbot setup differ from SOCKS5 Proxy?

[ignoramous]

Thanks.

Universal firewall settings, but for individual apps

Planned, see: #720

VPN crashes sometimes when starting/stopping. I'm usually connected to a wireguard proxy.

If you're technical enough, turn log-level to verbose (Configure -> Settings -> Log Level -> Verbose), then capture the output from adb logcat as and when the crash happens and email it to me mz at celzero dot com (mention this discussion)?

Some (blocked) connections don't get logged. Access to a website will fail but I have no way to identify the problem. Example is assets.adobedtm.com

As in, these don't show up on both DNS and Network logs even when you use the search bar? That's concerning.

Not an issue specific to Rethink but even after nearly 2 years of using Rethink I'm still left scratching my head as to what DNS provider and what protocol to use

Yeah, we need to simplify the UI. You'd find too many open issues on that: #1177, #666, #1050 etc

The variety of choice for various DNS protocols is because Rethink is primarily an anti-censorship tool. We're adding 2 new protocols in v054b (the upcoming version).

I can customize my own on-device blocklist, they seem redundant.

Yeah, redundant, but an additional layer of control, nevertheless. On-device blocking was one of the top asks from users back then, btw.

Is there any reason why this might be a bad thing, why I should only select the app that I intend to use?

Depends on your usecase; and as long as apps play fine with Orbot, you can opt to route them through Orbot.

How does Orbot setup differ from SOCKS5 Proxy?

It is the same thing but just wrapped in a fancy UI that tries to auto-configure a few setup related things with the Orbot app.

[ignoramous]

I propose separate network profiles.

Many vriant of these requests exist (#1130), but we believe it is best done through something like Tasker (#63), for which we're waiting for someone from the community to contribute (as Tasker users tend to be fairly technical to be able to do so). As for us, we see creating "use profile" within Rethink a niche feature.

[pawlosck]

Maybe you should ask community if profiles are needed or not? I need it, because I have to change settings every time when I am at home network or at mobile connection.
When I am in home network, I have to disable wireguard tunnel (wireguard gate is in my local network), because all traffic are blocked, so I would like to switch profiles based on network.
I describe my case.

When I am at home network:

• Wireguard disabled
• most apps, except specified (mainly connected to local servers and apps which doesn't work when connected to tor) should go through the tor.

When I am using mobile connection:

• Wireguard enabled - traffic through the wireguard (local connection and to Internet)
• most apps (except specified) should go through the tor. Specified apps -> 1. apps which doesn't work when connected to tor. If app doesn't work when connected to tor, should go through the wireguard. 2. Apps which connect to servers from LAN.

[ignoramous]

Maybe you should ask community if profiles are needed or not?

It isn't that the community needs it or not, it is that they also need many other things and we prioritize (however imperfect our judgement may be) based on what we see in our inboxes and other online forums and depending on the complexity of the said feature.

I need it, because I have to change settings every time when I am at home network or at mobile connection.

tbh, seems like a power-user usecase. Going from the support requests we see, a majority existing user-base can barely understand the simplest of settings in the app. Until we figure out a UX that works for both power-users and regular users alike, we're holding off adding more knobs while we can avoid them.

That said, I welcome pull requests from technically adept power-users, if they so choose to augment Rethink with this feature.

[pawlosck]

So maybe you should add option like in vlc, or josm? You could add one question at the beginning -> "newbie user" and "advanced user". Newbie user should have less options with default options and advanced user should have more options.

In OsmAnd there is profiles support and is simple. For example, you can add one default profile and most user could use this profile. Advanced users could add/clone new profile and switch it based on current connection.

What do you think about that?

[ignoramous]

What do you think about that?

I think it adds too much complexity when there are other important bug fixes and features to be implemented (for ex: Android TV support).

Folks not familiar with the codebase tend to underestimate the complexity. For example, to include WireGuard support, we had to replace the underlying network engine (started in Jan 2022; re-written once again in June 2023 which is still on-going), support IPv6 (on-going), support WireGuard split-tunnels (on-going). May be us developers are slow, but that's over 2 years of work alright.