## 1. Project Overview & Quickstart (celzero/firewall) # firewall Open-source repository celzero/firewall ### Repository Details - **Repository:** [celzero/firewall](https://github.com/celzero/firewall) - **Primary Language:** Code *Note: High-volume repository documentation is actively indexed and synchronized by YakaAI.* ## 2. Official Technical Reference & Guides (celzero/docs) ## File: README.md # RethinkDNS + Firewall Documentation API, Manual, Tutorial for RethinkDNS + Firewall ## Docusaurus - Build command: `npm run build` - Output directory: `/build` - [Docusaurus Docs](https://v2.docusaurus.io/docs/) ## Contributing ### Preview contributions This repository is setup to deploy a preview of changes made in any branch to GitHub pages (except `gh-pages` branch). When you make a fork of this repository and make changes on GitHub, you are usually prompted to commit to a new branch `patch-*` branch, where `*` is a number. Making such commits allows you to preview your changes before you send a pull request. To use this functionality: 1. Head over to **Actions** tab of your fork repository and Confirm that you want to use Actions, if asked. 2. Now goto **Settings** tab of your fork repository and scroll down to find _Github Pages_. Change the _Source_ from 'None' to 'gh-pages' and click _Save_. 3. Now if you make any changes and commit, a GitHub action will be triggered, which you can see in the **Actions** tab, when it completes successfully, you can see the preview of the changes you made at `https://.github.io/docs/` where `` is your GitHub username. --- ## File: docs/firewall/introduction.md --- title: Rethink Firewall # sidebar_label: Introduction slug: /firewall --- RethinkDNS comes with a companion [**Firewall**](https://en.wikipedia.org/wiki/Firewall_(computing)) app for Android, that lets you monitor and control Internet access to apps installed on your device. The app lets you view searchable network log per connection; reveals apps that were blocked and when; Reveals apps that are connected to where and when. It also lets you block individual IPs. You would be able to set rules such as, _block apps by category_, _block when app is in the background_, _block an app when device is locked_, or _block an app forever_. RethinkDNS Firewall when configured [DNS](dns), you can analyse DNS requests in real-time and read through aggregated reports in the App logs. And it also helps evade Internet censorship as enforced in most countries. Goto [RethinkDNS.com](https://rethinkdns.com/) to download. --- ## File: docs/firewall/orbot.md --- title: Orbot Integration --- RethinkDNS comes with an option to configure Orbot (Tor) to be used along with the RethinkDNS as a Proxy server to change the IP address. ## Configurations Steps ### Manual Method 1. Start _Orbot_ (do not start it in the VPN mode). 2. Notice what Orbot says against "SOCKS5" and "HTTP" fields on its home-screen. Those are port numbers. 3. Open the RethinkDNS app; Start it and goto _Settings_. 4. Enable HTTP Proxy and enter the HTTP port number (as seen in Orbot), if you want just the browsers to use Orbot's Tor bridge. 5. Enable SOCKS5 (TCP) Proxy and enter the port number (from step 2), choose App (as Orbot), optionally enable Block all UDP traffic except DNS to stop leaking UDP (WhatsApp calls, Zoom, Chromecast may stop working; Orbot doesn't support UDP). 6. Note: The IP address field to be set in RethinkDNS is 127.0.0.1 for both those proxies (for Orbot). 7. Visit [dnsleaktest.com](https://dnsleaktest.com/). It shouldn't be able to tell where you're from and not be able to show your actual IP. ### Automatic Method Starting from Version 0.53c, we have introduced one click setup 1. To use that Open RethinkDNS app and go to Settings Tab by clicking Gear Icon at the bottom menu. 2. In settings, you will find _Setup Orbot_ in _VPN & Proxy_ section, click on it. 3. Now, you will be presented with a drawer at bottom, where you will find options to setup Orbot as per your liking (HTTP Proxy, TCP-Only Proxy, TCP + HTTP Proxy and None). 4. Select the one you like and click on the Orbot icon at top of the drawer to open Orbot app and then start Orbot (tor network). Once you see 100% you are good to go. --- ## File: docs/dns/introduction.md --- title: Rethink DNS # sidebar_label: Introduction slug: /dns --- Rethink**DNS** is [DNS Resolver](https://www.cloudflare.com/learning/dns/what-is-dns/) Service with custom rules and blocklists. A DNS resolver is an address book of the internet-- it helps locate IP addresses of the servers given a domain name. For example, dns.google.com (a domain name) is located at 8.8.8.8 (IP address). This mapping is retrieved by a DNS resolver. You can configure Rethink**DNS** in the companion [firewall app](firewall) or even in your own device / internet browser that supports [Secure DNS](https://wikipedia.org/wiki/DNS_over_HTTPS) (aka DNS over HTTPS). See below on [how to configure](#how-to). RethinkDNS is private, secure, and fast DNS resolver and has 190+ pre-defined blacklists for you to configure. With our paid plans (coming soon), you'll also be able to define your own custom blocklists that can be configured with Rethink**DNS**. The paid plan will also allow you to store you dns logs and view analytics, all in the cloud. You will be able to analyse your DNS requests and read through aggregated reports. RethinkDNS is highly-available with servers in over 200+ locations across the globe for fast DNS resolution. ## How To Configure DNS {#how-to} A custom DNS resolver can be configured here: [rethinkdns.com/configure](https://www.rethinkdns.com/configure). This will give a DNS resolver address that looks something like `https://basic.bravedns.com/1:YASAAQBwIAA=` according to blocklists or rules that you selected. This address can then be used as your DNS resolver in your device or browser. ### Configure blocklists on the Companion Firewall App 1. Open RethinkDNS on your Android Smartphone 2. Click **START** to start the RethinkDNS resolver and Firewall, once it starts up properly, you'll see a 'PROTECTED' status below it. 3. Now tap on 'CONFIGURE' in the DNS section, which will open up a page that will allow you to set your DNS resolver. By default, it is set to _RethinkDNS Basic_, which blocks a set of few malware and trackers. But, you can add your own custom DNS or choose the pre-defined ones. 4. To configure blocklists, choose _RethinkDNS Plus_ and tap on 'CONFIGURE' button below it, this will open up the rethinkDNS configuration page. Here, you can select a set of blocklists with 'Simple View' or tap on 'Advanced View' to select Individual blocklists. 5. After you select your desired blocklists, tap on 'Done' at the bottom bar. This will close the configuration page and the selected blocklists will be automatically configured withe app. You will see an android toast message _Configured URL has been updated successfully_ to confirm this. 6. You have successfully configured RethinkDNS with blocklists in the companion firewall app. --- ## File: docs/dns/open-source.md --- title: Open Source --- The free and open source RethinkDNS Resolver is serverless and supports protocols: DNS over HTTPS (DoH) & DNS over TLS (DoT). It can be configured with custom blocklists. And can be hosted on cloudflare, fly.io or deno-deploy. Source code is made available at [github.com/serverless-dns/serverless-dns](https://github.com/serverless-dns/serverless-dns). ## Hosting your own DNS Resolver {#hosting} This serverless DNS can be hosted to three platforms: Cloudflare, Deno-Deploy and Fly.io. Easiest way would be to use Cloudflare. The below table summarizes the platforms available. | Platform | Difficulty | Resolver Protocol | Instructions | | ------------- | ---------- | ----------------- | --------------------------------- | | ⛅ Cloudflare | Easy | DoH | [Read Instructions](#cloudflare) | | 🦕 Deno Deploy | Moderate | DoH | [Read Instructions](#deno-deploy) | | 🪂 Fly.io | Hard | DoH and DoT | [Read Instructions](#fly-io) | ### Using Cloudflare {#cloudflare} Rethink serverless can be hosted to cloudflare. User will be liable for cloudflare billing. Click the button below to deploy. [](https://deploy.workers.cloudflare.com/?url=https://github.com/serverless-dns/serverless-dns/) - Configure - Once the hosting is successful, lets consider rethink serverless dns is hosted to `example.com`. - To configure your dns level blocking visit to `example.com/configure` which will take to configuration page, which currently contains 191 blocklists with ~13.5 Million blockable domains in category like notracking, dating, gambling, privacy, porn, cryptojacking, security ... - Navigate through and select your blocklists. - Once selected you can find your domain name `example.com` followed by configuration token on screen like this `https://example.com/1:AIAA7g==` copy it and add to your dns DOH client. - Now your own trusted dns resolver with custom blocking is up and running. - Change Resolver - By default dns request are resolved by cloudflare `cloudflare-dns.com`. - To change resolver login to your cloudflare dash board - click on `worker` - click on `serverless-dns` worker - click on `Settings` tab - under `Environment Variables` click on `Edit variables` - if your new DOH resolver url is `example.dns.resolver.com/dns-query/resolve` - change below variables and click on save button `CF_DNS_RESOLVER_URL = example.dns.resolver.com/dns-query/resolve` - alternatively, you can modify your `CF_DNS_RESOLVER_URL` in your forked serverless-dns repo. Head to src/core/env.js and modify either your `CF_DNS_RESOLVER_URL` or `CF_DNS_RESOLVER_URL_2` DNS server ### Using Deno-Deploy {#deno-deploy} This project can be hosted on [deno.com/deploy](https://deno.com/deploy) and supports DoH only. User will be liable for deno.com billing. 1. Fork the [serverless-dns repository](https://github.com/serverless-dns/serverless-dns) (requires a GitHub account). 2. In the repository you just forked, click on the _Actions_ tab and _Confirm_ that you want to use _Actions_, if prompted. 3. Now, navigate to [deno.com/deploy](https://deno.com/deploy) and _Sign Up_ for an account. 4. Create a new project via the [deno dashboard](https://dash.deno.com) by just clicking on the `New Project` button. 5. Select your forked repository from the list of repositories that appear. If your GitHub username does not show up, click on `+ Add GitHub Account` and install the `Deno Deploy` GitHub App with the necessary permissions. 6. Once you select your forked repository, input boxes for project configuration show up. You need to do two things here; enter `deno task prepare` in the `Build Step`, and select `src/server-deno.ts` in `Entrypoint` field. 7. Click on the `Deploy Project` button. 8. Once your project is successfully deployed, you will see "Success!" page with a URL to your deployment that looks like `https://.deno.dev`. If you found any issues, [reach out to us over on GitHub](https://github.com/serverless-dns/serverless-dns/discussions). 9. Optionally, if you need to configure environment variables, you can do so in the project settings page that you can access either by clicking on the `Add environment variables` link shown in the "Success!" page, or by navigating to `https://dash.deno.com/projects//settings#environment-variables`. ### Using Fly.io {#fly-io} This project can be hosted on [fly.io](https://fly.io), and can support both DoT and DoH protocols. User will be liable for fly.io billing. 1. Install `flyctl` on your device ([ref](https://fly.io/docs/getting-started/installing-flyctl/)). 2. Signup and/or login to fly.io ([ref](https://fly.io/docs/getting-started/login-to-fly/)). 3. Create an empty directory anywhere on your PC. Open you terminal or powershell and navigate to this directory. 4. Launch a fly app ```bash flyctl launch ``` - Choose a unique name here or let it auto-generate. - Choose a location (the closer to your users, the better). - Note down the name of the app and you may delete this directory along with the generated `fly.toml`. 5. Now, you would need a SSL or TLS certificate for your domain name. Both getting a domain name and CA certificate generation are beyond the scope of this README. [_Let's Encrypt_](https://certbot.eff.org/) and [_ZeroSSL_](https://www.frankindev.com/2021/10/14/free-wildcard-ssl-by-zerossl-with-acme.sh/) vend public certs for free, valid for a maximum of 90 days. 6. Once you have your CA certificate and key files, you need to encode them as base64 with no wrapping. How this can be done in bash terminal is shown below. ```bash # Locate your CA certificate & key files CRT="path/to/full-chain-certificate.pem" KEY="path/to/key.pem" ``` ```bash # Encode them in base64 with no wrappings and store them in variables B64NOWRAP_KEY="$(base64 -w0 "$KEY")" B64NOWRAP_CRT="$(base64 -w0 "$CRT")" ``` 7. As described in [`.env.example`](https://github.com/serverless-dns/serverless-dns/blob/main/.env.example) file, this base64 encoded certificate-key pair need to set as a single environment variable called `TLS_`. Within this variable, the certificate and key encodings needs to be separated by a newline (`\n`) and described by `CRT=` and `KEY=`. On a bash terminal this can be done by following steps continued by by above. ```bash # This creates a single file called "FLY_TLS" in the current directory echo "KEY=$B64NOWRAP_KEY" > FLY_TLS echo "CRT=$B64NOWRAP_CRT" >> FLY_TLS # And now, this "FLY_TLS" file contains both certificate and key encoded and # as required ``` - Upload this to fly secrets like so in terminal or powershell: ```bash fly secrets set TLS_CERTKEY=- < FLY_TLS -a ``` where `` is the name of the fly app you had launched in step 4. - Other essential environment variables are already present in [`fly.toml`](https://github.com/serverless-dns/serverless-dns/blob/main/fly.toml) file of this repository, but you may read [`.env.example`](https://github.com/serverless-dns/serverless-dns/blob/main/.env.example) for it's use case and configuration. 8. Fork the [serverless-dns repository](https://github.com/serverless-dns/serverless-dns) (you will need a GitHub account). 9. In your fork, click on the _Actions_ tab and Confirm that you want to use Actions, if asked. 10. Similarly, click on _Settings_ tab and select _Secrets_ on the left pane. Add a new GitHub secret called **FLY_APP_NAME** and set it's value as the name of the fly app you had launched in step 4. And add another secret called **FLY_API_TOKEN** and set's value as what you get from running `flyctl auth token` in terminal or powershell. 11. Head back to _Actions_ tab and click on _Fly_ on the left pane. Click on the _Run workflow_ dropdown on the right side, and run the workflow using the Run workflow button. 12. Once this action workflow finishes, open the terminal or powershell again and type in: ```bash flyctl ips list -a ``` where `` is the name of the fly app you had launched in step 4. - Here, you can get the IP address of the application, update the DNS records of your domain name you had used in step 5. 13. Done. Your application should be available on the said domain name in a few minutes. To configure, for example, the upstream resolver, you can edit the environment variables in the `fly.toml` file of your fork and re-run the Action workflow. --- ## File: docs/proxy/wireguard.md --- title: WireGuard --- ### Adding a WireGuard Configuration to Rethink DNS + Firewall + VPN App This guide will walk you through the steps to add a WireGuard configuration to the Rethink DNS + Firewall + VPN app. ### Step 1: Open the App 1. Open the **Rethink DNS + Firewall + VPN** app on your device. ### Step 2: Navigate to the WireGuard Section 1. Tap on the **VPN** tab at the bottom of the screen. 2. Select **WireGuard** from the list of available VPN options. ### Step 3: Add a New WireGuard Configuration 1. Tap on the **+** (plus) button or the **Add Configuration** option. 2. You will see three options: - **Manual Entry** - **Import Config** - **Scan QR Code** ### Step 4: Manual Entry 1. Select **Manual Entry** to enter the configuration details manually. 2. Enter a name for the configuration in the **Name** field. #### Enter WireGuard Configuration Details 1. **Public Key**: Enter the public key provided by your WireGuard server. 2. **Private Key**: Enter your private key. (Ensure this is kept secure and never shared.) 3. **Endpoint**: Enter the endpoint URL or IP address of your WireGuard server along with the port (e.g., `vpn.example.com:51820`). 4. **Allowed IPs**: Enter the IP addresses that should be routed through the WireGuard tunnel (e.g., `0.0.0.0/0` to route all traffic). #### Optional - Set Additional Parameters 1. **DNS**: Enter the DNS server(s) to be used with this WireGuard configuration. 2. **Persistent Keepalive**: Enter a value (in seconds) to keep the connection alive, if required by your server configuration (e.g., `25`). 3. Once all the necessary details have been entered, tap on the **Save** button. ### Step 5: Import Configuration 1. Select **Import Config**. 2. Navigate to the location of your WireGuard configuration file (`.conf`). 3. Select the configuration file to import the details automatically. 4. The app will parse the configuration file and fill in the necessary fields for you. 5. Review and adjust the settings if necessary, then tap on the **Save** button. ### Step 6: Scan QR Code 1. Select **Scan QR Code**. 2. Allow the app to access your camera if prompted. 3. Scan the QR code provided by your WireGuard server. 4. The app will automatically fill in the configuration details from the QR code. 5. Review and adjust the settings if necessary, then tap on the **Save** button. ### Step 7: Enable the WireGuard Configuration 1. After saving, you will see the newly added WireGuard configuration in the list. 2. Tap on the configuration name to enable it. 3. You may be prompted to grant VPN permissions; allow the necessary permissions to proceed. ### Step 8: Switch Between Simple and Advanced Modes 1. By default, the WireGuard configuration is in **Simple Mode**. 2. To switch to **Advanced Mode**, tap on the **Advanced** option. 3. In **Advanced Mode**, you have additional settings available, including the ability to select specific apps to use with the WireGuard VPN. #### Selecting Apps in Advanced Mode 1. In the **Advanced Mode** settings, tap on **Select Apps**. 2. Choose the apps you want to route through the WireGuard VPN. 3. Save your selection and exit the settings. ### Step 9: Verify Connection 1. Once connected, you should see a status indication that the WireGuard VPN is active. 2. You can verify the connection by checking your IP address or using any network diagnostic tool to ensure your traffic is being routed through the WireGuard VPN. ### Troubleshooting - **Connection Issues**: Ensure that your WireGuard server details are correct and that the server is running. - **DNS Issues**: Verify that the DNS servers specified in the configuration are reachable and correctly configured. - **Permission Issues**: Make sure that the app has the necessary permissions to establish a VPN connection. ### Conclusion You have successfully added a WireGuard configuration to the Rethink DNS + Firewall + VPN app. If you encounter any issues or need further assistance, please refer to the support documentation or contact the support team. --- ## File: docs/interactiveDoc.mdx --- id: mdx title: Powered by MDX --- You can write JSX and use React components within your Markdown thanks to [MDX](https://mdxjs.com/). The `.mdx` extension is not required, but will enable better support from tooling (IDE, Prettier...). export const Highlight = ({children, color}) => ( alert('Highlight pressed!')}> {children} ); Docusaurus green and Facebook blue are my favorite colors. I can write **Markdown** alongside my _JSX_! --- ## File: docs/introdcution.md --- id: introduction title: Rethink DNS + Firewall sidebar_label: Welcome slug: / --- 2B+ Android users deserve access to a safer and open Internet. Rethink [DNS](dns) and [Firewall](firewall) offer a fast, secure, configurable, private DNS + Firewall for Android.