## 1. Project Overview & Quickstart (celzero/rethink-app) ## Rethink DNS + Firewall + VPN for Android A multi-hop [WireGuard](https://github.com/wireguard/wireguard-go) client, an [OpenSnitch](https://github.com/evilsocket/opensnitch)-inspired firewall and network monitor + a [pi-hole](https://github.com/pi-hole/pi-hole)-inspired DNS over HTTPS (DoH), Oblivious DoH, DNS over TLS (DoT), DNSCrypt client with blocklists. [](https://f-droid.org/packages/com.celzero.bravedns/) [](https://play.google.com/store/apps/details?id=com.celzero.bravedns) [](https://apps.obtainium.imranr.dev/redirect.html?r=obtainium://add/https://github.com/celzero/rethink-app) Release certificate SHA-256 digests: *Prod flavour on the [Play Store](https://play.google.com/store/apps/details?id=com.celzero.bravedns) & [Website](https://rethinkdns.com/download)*: `1f32d432e81a1dc5c00aafeb0c6636cd7819965d174420e59db9675dff7a88e9`. *Alpha flavour on [GitHub](https://github.com/celzero/rethink-app/actions/workflows/nightly.yml)*: `014da2d3c66439105d1238f3bcf5705d63a7ce2da2f54005f72066cf8717bbbf`. In other words, *Rethink DNS + Firewall + VPN* has three primary modes, VPN, DNS, and Firewall. The VPN (proxifier) mode supports multiple WireGuard upstreams in a split-tunnel configuration. The DNS mode routes all DNS traffic generated by apps to _any_ user-chosen DNS-over-HTTPS / Oblivious DNS-over-HTTPS / DNS-over-TLS / DNSCrypt resolver, or to WireGuard-configured DNS in a split-tunnel configuration. The Firewall mode lets the user deny internet-access to entire applications based on events like screen-on / screen-off, app-foreground / app-background, unmetered-connection / metered-connection; or based on play-store defined categories like Social, Games, Utility, Productivity; or additionally, based on user-defined domain & IP denylists. *screenshots from [`v055e`](https://github.com/celzero/rethink-app/releases/tag/v0.5.5e).* ### VPN / Proxifier Rethink supports forwarding TCP & UDP over SOCKS5, HTTP CONNECT, and WireGuard tunnels. Split-tunneling further helps run multiple such tunnels at the same time and lets users route different apps over different tunnels. For example, one could route Firefox over SOCKS5 connecting to Tor, Netflix over WireGuard connecting through any popular VPN provider, and Telegram or WhatsApp over censorship-resistant HTTP CONNECT endpoints at the same time. ### Firewall The firewall doesn't really care about the connections per se rather what's making those connections. This is different from the traditional firewalls but in-line with [Little Snitch](https://www.obdev.at/products/littlesnitch/index.html), [LuLu](https://objective-see.com/products/lulu.html), [Glasswire](https://glasswire.com/) and others. Currently, per-app connection mapping is implemented by capturing `udp` and `tcp` flows managed by [`firestack`](https://github.com/celzero/firestack) (written in Go) and asking [ConnectivityService for the owner](https://developer.android.com/about/versions/10/privacy/changes#proc-net-filesystem), an API available only on Android 10+. `procfs` (`/proc/net/tcp` and `/proc/net/udp`) is read on-demand to track per-app connections like [NetGuard](https://github.com/M66B/NetGuard/) or OpenSnitch do, on Android 9 & below. ### Network Monitor A network monitor is a per-app report-card of sorts on when connections were made, how many were made, and to where. Tracking UDP / TCP (and DNS on Android 12+) is straight-forward. DNS requests are trickier to track on Android 11 & below, and so a rough heuristic is used for now, which may not hold good in all cases. ### DNS over HTTPS client Almost all of the network related code (`firestack`), including DNS over HTTPS split-tunnel, is a hard fork of [Jigsaw-Code/outline-go-tun2socks](https://github.com/Jigsaw-Code/outline-go-tun2socks) written in golang. The UI is vastly different but borrows minimally from [Jigsaw-Code/Intra](https://github.com/Jigsaw-Code/Intra/). A split-tunnel traps requests sent to the VPN's DNS endpoint and relays it to a DNS-over-HTTPS / DNS-over-TLS / DNSCrypt / Oblivious DNS-over-HTTPS endpoint of the user's choosing, logging the end-to-end latency, time of request, the DNS request query itself, and its answer. ### The Rethink DNS Resolver A malware and ad-blocking DNS over HTTPS resolver at `https://sky.rethinkdns.com/rs` (deployed to 300+ locations world-wide via Cloudflare Workers) is the default DNS endpoint on the app, though the user is free to change that. A configurable DNS resolver that lets users add or remove denylists and allowlists, add rewrites, analyse DNS requests is launching late 2026. Right now, a free-to-use DNS over HTTPS endpoint with custom blocklists can be setup here: [rethinkdns.com/configure](https://rethinkdns.com/configure). The resolver, sponsored by [FLOSS/fund](https://floss.fund/), is deployed to [Fly.io](https://fly.io/) at `max.rethinkdns.com`, and [Deno Deploy](https://deno.com/deploy) at `rdns.deno.dev` too, apart from the default deployment on [Cloudflare Workers](https://workers.dev). The resolver is open source software: [serverless-dns](https://github.com/serverless-dns/serverless-dns). ### The Rethink Proxy Network RPN is a multi-party relay, with packets exiting over *serverless* proxy (hosted on Cloudflare Workers) hopping over Windscribe. Users are able to self-host *serverless* proxy or use the ones run by us. RPN starts at $1.75/month for unlimited bandwidth and supports activating 5 locations (out of 80+) in parallel, per-device. The proxy is open source software: [serverless-proxy](https://github.com/serverless-proxy/serverless-proxy). ### Community [](https://github.com/sponsors/serverless-dns) - The telegram community is super active and full of crypto-bros. Kidding. We are generally a welcoming bunch. Feel free to get in touch: [t.me/rethinkdns](https://t.me/rethinkdns). - ~~Or, if you prefer Matrix (which is bridged to Telegram): [`#rethinkdns:matrix.org`](https://matrix.to/#/#rethinkdns:matrix.org) (or: [`!jrTSpJiEkFNNBMhSaE:matrix.org`](https://matrix.to/#/!jrTSpJiEkFNNBMhSaE:matrix.org))~~. - Or, email us: [hello@celzero.com](mailto:hello@celzero.com) (we read all emails immediately and reply once we fix the issues being reported). - We regularly hangout in our subreddit: [r/rethinkdns](https://reddit.com/r/rethinkdns). - We're also kind of active on the bird and toot apps, mostly nerd-sniping other engs or shit-posting about our tech stack: [twitter/rethinkdns](https://twitter.com/rethinkdns), [mastodon/rdns](https://mastodon.social/@rdns). ### Translation Help [translate Rethink DNS + Firewall + VPN](https://hosted.weblate.org/engage/rethink-dns-firewall) on [Weblate](https://weblate.org/): [](https://hosted.weblate.org/engage/rethink-dns-firewall) ### What Rethink DNS + Firewall + VPN is not Rethink is *not* an anonymity tool: It helps users tackle unabated censorship and surveillance but doesn't lay claim to protecting a user's identity at all times, if ever. Rethink does *not* aim to be a feature-rich traditional firewall: It is more in-line with [Little Snitch](https://www.obdev.at/products/littlesnitch/index.html) than IP tables, say. Rethink is *not* an anti-virus: Rethink may stop users from phishing attacks, malware, scareware websites through its DNS-based blocklists, but it doesn't actively mitigate threats or even look for them or act on them, otherwise. ### What Rethink DNS + Firewall + VPN aspires to be To turn Android devices into user-agents: Something that users can control as they please without requiring root-access. A big part of this, for an always-on, always-connected devices, is capturing network traffic and reporting it in a way that makes sense to the end-users who can then take a series of actions to limit their exposure but not necessarily eliminate it. Take DNS for example-- for most if not all connections, apps send out a DNS request first, and by tracking just those one can glean a lot of intelligence about what's happening on their Androids and which app's responsible. To deliver the promise of open-internet for all: With the inevitable ECH (encrypted client hello) standardization and the imminent adoption of DNS-over-HTTPS and DNS-over-TLS across operating systems and browsers, we're that much closer to an open internet. Of course, *Deep Packet Inspection* remains a credible threat that can't be mitigated with just encrypted DNS, but it is one example of delivering maximum impact (circumvent internet censorship in most countries) with minimal effort (not requiring use of a VPN or access via IPFS, for example). Rethink would continue to make these technologies accessible in the simplest way possible, especially the ones that get 90% of the way there with 10% effort. ## Development [](https://github.com/celzero/rethink-app/releases)   [](https://github.com/celzero/rethink-app/actions/workflows/android.yml)   [](https://www.apache.org/licenses/LICENSE-2.0)   [](https://securityscorecards.dev/viewer/?uri=github.com/celzero/rethink-app)   [](https://deepwiki.com/celzero/rethink-app) 1. Feel free to fork and send a pull request for any reproducible bug fixes. 1. The codebase is raw and is lacking documentation and comprehensive tests. If you need help, feel free to create a Wikipage to highlight the pain with building, testing, writing, committing code. [DeepWiki](https://deepwiki.com/celzero/rethink-app) and [Copilot](https://github.com/copilot?prompt=https://github.com/celzero/rethink-app) may also help, but they do hallucinate. 2. Write descriptive commit messages that explain concisely the changes made. 3. Each commit must reference an open issue on the project to make sure there isn't duplicated effort and prior discussion to refer to. 2. If you plan to work on a feature, please create a [github issue on the project](https://github.com/celzero/rethink-app/issues/new) first to kickstart the discussion before committing to doing any work. 3. Prod releases are usually once every few months, while [alpha is released monthly](https://github.com/celzero/rethink-app/actions/workflows/nightly.yml). ## Tenets (unless you know better ones) We aren't there yet, may never will be but these are some tenets for the project for the foreseeable future. - Make it right, make it secure, make it resilient, make it fast. In that order. - Easy to use, no-root, no-gimmicks features that are anti-censorship and anti-surveillance. - Easy to use: Any of the 3B+ Android users must be able to use it. Think WhatsApp / Instagram levels of ease-of-use. - no-root: Shouldn't require root-access for any functionality added to it. - no-gimmicks: Misleading material bordering on scareware, for example. - Anti-censorship: Features focused on helping bring an open internet to everyone, preferably in the most efficient way possible (both monetarily and technically). - Anti-surveillance: As above, but features that further limit (may not necessarily eliminate) surveillance by apps. - Incremental changes in balance with newer features. - For example, work on nagging UI issues or OEM specific bugs, must be taken up on equal weight to newer features, and a release must probably establish a good balance between the two. However; working on only incremental changes for a release is fine. - Opinionated. Chip-away complexity. Do not expect users to require a PhD in Computer Science to use the app. - No duplicate functionality. - A concerted effort to not provide too many tunable knobs and settings. To err on the side of easy over simple. - Ignore all tenets. - Common sense always takes over when tenets get in the way. - Must be distributable on the PlayStore, at least some toned down version of it. - This unfortunately means on-device blocklists aren't possible; however, [Cloudflare Gateway](https://www.cloudflare.com/teams-gateway/)-esque cloud-based per-user blocklists get us the same functionality. - Practice what you preach: Be obsessively private and secure. ## Backstory [](https://fossunited.org/grants)  [](https://builders.mozilla.community/)  [](https://floss.fund/)  Internet censorship (sometimes ISP-enforced and often times government-enforced), unabated dragnet surveillance (by pretty much every company and app) stirred us upon this path. The three of us university classmates, [Mohammed](https://www.linkedin.com/in/hussain-mohammed-2525a626/), [Murtaza](https://www.linkedin.com/in/murtaza-aliakbar/), [Santhosh](https://www.linkedin.com/in/santhosh-ponnusamy-2b781244/) got together in late 2019 in the sleepy town of Coimbatore, India to do something about it. Our main gripe was there were all these wonderful tools that people could use but couldn't, either due to cost or due to inability to grok Computer-specific jargon. A lot has happened since we started and a lot has changed but our focus has always been on Android and its 3B+ unsuspecting users. The current idea has been in the works since May 2020, with the pandemic derailing a bit of progress, and a bit of snafu with abandoning our previous version in favour of the current fork, which we aren't proud of yet, but it is a start. All is good now that we've won a grant from the [Mozilla Builders MVP program](https://builders.mozilla.community/) to go ahead and build this thing that we wanted to... do so faster... and not simply sleep our way through the execution. I hope you're excited but not as much as us that you quit your jobs for this like we did. ## 2. Official Technical Reference & Guides (celzero/docs) ## File: README.md # RethinkDNS + Firewall Documentation API, Manual, Tutorial for RethinkDNS + Firewall ## Docusaurus - Build command: `npm run build` - Output directory: `/build` - [Docusaurus Docs](https://v2.docusaurus.io/docs/) ## Contributing ### Preview contributions This repository is setup to deploy a preview of changes made in any branch to GitHub pages (except `gh-pages` branch). When you make a fork of this repository and make changes on GitHub, you are usually prompted to commit to a new branch `patch-*` branch, where `*` is a number. Making such commits allows you to preview your changes before you send a pull request. To use this functionality: 1. Head over to **Actions** tab of your fork repository and Confirm that you want to use Actions, if asked. 2. Now goto **Settings** tab of your fork repository and scroll down to find _Github Pages_. Change the _Source_ from 'None' to 'gh-pages' and click _Save_. 3. Now if you make any changes and commit, a GitHub action will be triggered, which you can see in the **Actions** tab, when it completes successfully, you can see the preview of the changes you made at `https://.github.io/docs/` where `` is your GitHub username. --- ## File: docs/firewall/introduction.md --- title: Rethink Firewall # sidebar_label: Introduction slug: /firewall --- RethinkDNS comes with a companion [**Firewall**](https://en.wikipedia.org/wiki/Firewall_(computing)) app for Android, that lets you monitor and control Internet access to apps installed on your device. The app lets you view searchable network log per connection; reveals apps that were blocked and when; Reveals apps that are connected to where and when. It also lets you block individual IPs. You would be able to set rules such as, _block apps by category_, _block when app is in the background_, _block an app when device is locked_, or _block an app forever_. RethinkDNS Firewall when configured [DNS](dns), you can analyse DNS requests in real-time and read through aggregated reports in the App logs. And it also helps evade Internet censorship as enforced in most countries. Goto [RethinkDNS.com](https://rethinkdns.com/) to download. --- ## File: docs/firewall/orbot.md --- title: Orbot Integration --- RethinkDNS comes with an option to configure Orbot (Tor) to be used along with the RethinkDNS as a Proxy server to change the IP address. ## Configurations Steps ### Manual Method 1. Start _Orbot_ (do not start it in the VPN mode). 2. Notice what Orbot says against "SOCKS5" and "HTTP" fields on its home-screen. Those are port numbers. 3. Open the RethinkDNS app; Start it and goto _Settings_. 4. Enable HTTP Proxy and enter the HTTP port number (as seen in Orbot), if you want just the browsers to use Orbot's Tor bridge. 5. Enable SOCKS5 (TCP) Proxy and enter the port number (from step 2), choose App (as Orbot), optionally enable Block all UDP traffic except DNS to stop leaking UDP (WhatsApp calls, Zoom, Chromecast may stop working; Orbot doesn't support UDP). 6. Note: The IP address field to be set in RethinkDNS is 127.0.0.1 for both those proxies (for Orbot). 7. Visit [dnsleaktest.com](https://dnsleaktest.com/). It shouldn't be able to tell where you're from and not be able to show your actual IP. ### Automatic Method Starting from Version 0.53c, we have introduced one click setup 1. To use that Open RethinkDNS app and go to Settings Tab by clicking Gear Icon at the bottom menu. 2. In settings, you will find _Setup Orbot_ in _VPN & Proxy_ section, click on it. 3. Now, you will be presented with a drawer at bottom, where you will find options to setup Orbot as per your liking (HTTP Proxy, TCP-Only Proxy, TCP + HTTP Proxy and None). 4. Select the one you like and click on the Orbot icon at top of the drawer to open Orbot app and then start Orbot (tor network). Once you see 100% you are good to go. --- ## File: docs/dns/introduction.md --- title: Rethink DNS # sidebar_label: Introduction slug: /dns --- Rethink**DNS** is [DNS Resolver](https://www.cloudflare.com/learning/dns/what-is-dns/) Service with custom rules and blocklists. A DNS resolver is an address book of the internet-- it helps locate IP addresses of the servers given a domain name. For example, dns.google.com (a domain name) is located at 8.8.8.8 (IP address). This mapping is retrieved by a DNS resolver. You can configure Rethink**DNS** in the companion [firewall app](firewall) or even in your own device / internet browser that supports [Secure DNS](https://wikipedia.org/wiki/DNS_over_HTTPS) (aka DNS over HTTPS). See below on [how to configure](#how-to). RethinkDNS is private, secure, and fast DNS resolver and has 190+ pre-defined blacklists for you to configure. With our paid plans (coming soon), you'll also be able to define your own custom blocklists that can be configured with Rethink**DNS**. The paid plan will also allow you to store you dns logs and view analytics, all in the cloud. You will be able to analyse your DNS requests and read through aggregated reports. RethinkDNS is highly-available with servers in over 200+ locations across the globe for fast DNS resolution. ## How To Configure DNS {#how-to} A custom DNS resolver can be configured here: [rethinkdns.com/configure](https://www.rethinkdns.com/configure). This will give a DNS resolver address that looks something like `https://basic.bravedns.com/1:YASAAQBwIAA=` according to blocklists or rules that you selected. This address can then be used as your DNS resolver in your device or browser. ### Configure blocklists on the Companion Firewall App 1. Open RethinkDNS on your Android Smartphone 2. Click **START** to start the RethinkDNS resolver and Firewall, once it starts up properly, you'll see a 'PROTECTED' status below it. 3. Now tap on 'CONFIGURE' in the DNS section, which will open up a page that will allow you to set your DNS resolver. By default, it is set to _RethinkDNS Basic_, which blocks a set of few malware and trackers. But, you can add your own custom DNS or choose the pre-defined ones. 4. To configure blocklists, choose _RethinkDNS Plus_ and tap on 'CONFIGURE' button below it, this will open up the rethinkDNS configuration page. Here, you can select a set of blocklists with 'Simple View' or tap on 'Advanced View' to select Individual blocklists. 5. After you select your desired blocklists, tap on 'Done' at the bottom bar. This will close the configuration page and the selected blocklists will be automatically configured withe app. You will see an android toast message _Configured URL has been updated successfully_ to confirm this. 6. You have successfully configured RethinkDNS with blocklists in the companion firewall app. --- ## File: docs/dns/open-source.md --- title: Open Source --- The free and open source RethinkDNS Resolver is serverless and supports protocols: DNS over HTTPS (DoH) & DNS over TLS (DoT). It can be configured with custom blocklists. And can be hosted on cloudflare, fly.io or deno-deploy. Source code is made available at [github.com/serverless-dns/serverless-dns](https://github.com/serverless-dns/serverless-dns). ## Hosting your own DNS Resolver {#hosting} This serverless DNS can be hosted to three platforms: Cloudflare, Deno-Deploy and Fly.io. Easiest way would be to use Cloudflare. The below table summarizes the platforms available. | Platform | Difficulty | Resolver Protocol | Instructions | | ------------- | ---------- | ----------------- | --------------------------------- | | ⛅ Cloudflare | Easy | DoH | [Read Instructions](#cloudflare) | | 🦕 Deno Deploy | Moderate | DoH | [Read Instructions](#deno-deploy) | | 🪂 Fly.io | Hard | DoH and DoT | [Read Instructions](#fly-io) | ### Using Cloudflare {#cloudflare} Rethink serverless can be hosted to cloudflare. User will be liable for cloudflare billing. Click the button below to deploy. [](https://deploy.workers.cloudflare.com/?url=https://github.com/serverless-dns/serverless-dns/) - Configure - Once the hosting is successful, lets consider rethink serverless dns is hosted to `example.com`. - To configure your dns level blocking visit to `example.com/configure` which will take to configuration page, which currently contains 191 blocklists with ~13.5 Million blockable domains in category like notracking, dating, gambling, privacy, porn, cryptojacking, security ... - Navigate through and select your blocklists. - Once selected you can find your domain name `example.com` followed by configuration token on screen like this `https://example.com/1:AIAA7g==` copy it and add to your dns DOH client. - Now your own trusted dns resolver with custom blocking is up and running. - Change Resolver - By default dns request are resolved by cloudflare `cloudflare-dns.com`. - To change resolver login to your cloudflare dash board - click on `worker` - click on `serverless-dns` worker - click on `Settings` tab - under `Environment Variables` click on `Edit variables` - if your new DOH resolver url is `example.dns.resolver.com/dns-query/resolve` - change below variables and click on save button `CF_DNS_RESOLVER_URL = example.dns.resolver.com/dns-query/resolve` - alternatively, you can modify your `CF_DNS_RESOLVER_URL` in your forked serverless-dns repo. Head to src/core/env.js and modify either your `CF_DNS_RESOLVER_URL` or `CF_DNS_RESOLVER_URL_2` DNS server ### Using Deno-Deploy {#deno-deploy} This project can be hosted on [deno.com/deploy](https://deno.com/deploy) and supports DoH only. User will be liable for deno.com billing. 1. Fork the [serverless-dns repository](https://github.com/serverless-dns/serverless-dns) (requires a GitHub account). 2. In the repository you just forked, click on the _Actions_ tab and _Confirm_ that you want to use _Actions_, if prompted. 3. Now, navigate to [deno.com/deploy](https://deno.com/deploy) and _Sign Up_ for an account. 4. Create a new project via the [deno dashboard](https://dash.deno.com) by just clicking on the `New Project` button. 5. Select your forked repository from the list of repositories that appear. If your GitHub username does not show up, click on `+ Add GitHub Account` and install the `Deno Deploy` GitHub App with the necessary permissions. 6. Once you select your forked repository, input boxes for project configuration show up. You need to do two things here; enter `deno task prepare` in the `Build Step`, and select `src/server-deno.ts` in `Entrypoint` field. 7. Click on the `Deploy Project` button. 8. Once your project is successfully deployed, you will see "Success!" page with a URL to your deployment that looks like `https://.deno.dev`. If you found any issues, [reach out to us over on GitHub](https://github.com/serverless-dns/serverless-dns/discussions). 9. Optionally, if you need to configure environment variables, you can do so in the project settings page that you can access either by clicking on the `Add environment variables` link shown in the "Success!" page, or by navigating to `https://dash.deno.com/projects//settings#environment-variables`. ### Using Fly.io {#fly-io} This project can be hosted on [fly.io](https://fly.io), and can support both DoT and DoH protocols. User will be liable for fly.io billing. 1. Install `flyctl` on your device ([ref](https://fly.io/docs/getting-started/installing-flyctl/)). 2. Signup and/or login to fly.io ([ref](https://fly.io/docs/getting-started/login-to-fly/)). 3. Create an empty directory anywhere on your PC. Open you terminal or powershell and navigate to this directory. 4. Launch a fly app ```bash flyctl launch ``` - Choose a unique name here or let it auto-generate. - Choose a location (the closer to your users, the better). - Note down the name of the app and you may delete this directory along with the generated `fly.toml`. 5. Now, you would need a SSL or TLS certificate for your domain name. Both getting a domain name and CA certificate generation are beyond the scope of this README. [_Let's Encrypt_](https://certbot.eff.org/) and [_ZeroSSL_](https://www.frankindev.com/2021/10/14/free-wildcard-ssl-by-zerossl-with-acme.sh/) vend public certs for free, valid for a maximum of 90 days. 6. Once you have your CA certificate and key files, you need to encode them as base64 with no wrapping. How this can be done in bash terminal is shown below. ```bash # Locate your CA certificate & key files CRT="path/to/full-chain-certificate.pem" KEY="path/to/key.pem" ``` ```bash # Encode them in base64 with no wrappings and store them in variables B64NOWRAP_KEY="$(base64 -w0 "$KEY")" B64NOWRAP_CRT="$(base64 -w0 "$CRT")" ``` 7. As described in [`.env.example`](https://github.com/serverless-dns/serverless-dns/blob/main/.env.example) file, this base64 encoded certificate-key pair need to set as a single environment variable called `TLS_`. Within this variable, the certificate and key encodings needs to be separated by a newline (`\n`) and described by `CRT=` and `KEY=`. On a bash terminal this can be done by following steps continued by by above. ```bash # This creates a single file called "FLY_TLS" in the current directory echo "KEY=$B64NOWRAP_KEY" > FLY_TLS echo "CRT=$B64NOWRAP_CRT" >> FLY_TLS # And now, this "FLY_TLS" file contains both certificate and key encoded and # as required ``` - Upload this to fly secrets like so in terminal or powershell: ```bash fly secrets set TLS_CERTKEY=- < FLY_TLS -a ``` where `` is the name of the fly app you had launched in step 4. - Other essential environment variables are already present in [`fly.toml`](https://github.com/serverless-dns/serverless-dns/blob/main/fly.toml) file of this repository, but you may read [`.env.example`](https://github.com/serverless-dns/serverless-dns/blob/main/.env.example) for it's use case and configuration. 8. Fork the [serverless-dns repository](https://github.com/serverless-dns/serverless-dns) (you will need a GitHub account). 9. In your fork, click on the _Actions_ tab and Confirm that you want to use Actions, if asked. 10. Similarly, click on _Settings_ tab and select _Secrets_ on the left pane. Add a new GitHub secret called **FLY_APP_NAME** and set it's value as the name of the fly app you had launched in step 4. And add another secret called **FLY_API_TOKEN** and set's value as what you get from running `flyctl auth token` in terminal or powershell. 11. Head back to _Actions_ tab and click on _Fly_ on the left pane. Click on the _Run workflow_ dropdown on the right side, and run the workflow using the Run workflow button. 12. Once this action workflow finishes, open the terminal or powershell again and type in: ```bash flyctl ips list -a ``` where `` is the name of the fly app you had launched in step 4. - Here, you can get the IP address of the application, update the DNS records of your domain name you had used in step 5. 13. Done. Your application should be available on the said domain name in a few minutes. To configure, for example, the upstream resolver, you can edit the environment variables in the `fly.toml` file of your fork and re-run the Action workflow. --- ## File: docs/proxy/wireguard.md --- title: WireGuard --- ### Adding a WireGuard Configuration to Rethink DNS + Firewall + VPN App This guide will walk you through the steps to add a WireGuard configuration to the Rethink DNS + Firewall + VPN app. ### Step 1: Open the App 1. Open the **Rethink DNS + Firewall + VPN** app on your device. ### Step 2: Navigate to the WireGuard Section 1. Tap on the **VPN** tab at the bottom of the screen. 2. Select **WireGuard** from the list of available VPN options. ### Step 3: Add a New WireGuard Configuration 1. Tap on the **+** (plus) button or the **Add Configuration** option. 2. You will see three options: - **Manual Entry** - **Import Config** - **Scan QR Code** ### Step 4: Manual Entry 1. Select **Manual Entry** to enter the configuration details manually. 2. Enter a name for the configuration in the **Name** field. #### Enter WireGuard Configuration Details 1. **Public Key**: Enter the public key provided by your WireGuard server. 2. **Private Key**: Enter your private key. (Ensure this is kept secure and never shared.) 3. **Endpoint**: Enter the endpoint URL or IP address of your WireGuard server along with the port (e.g., `vpn.example.com:51820`). 4. **Allowed IPs**: Enter the IP addresses that should be routed through the WireGuard tunnel (e.g., `0.0.0.0/0` to route all traffic). #### Optional - Set Additional Parameters 1. **DNS**: Enter the DNS server(s) to be used with this WireGuard configuration. 2. **Persistent Keepalive**: Enter a value (in seconds) to keep the connection alive, if required by your server configuration (e.g., `25`). 3. Once all the necessary details have been entered, tap on the **Save** button. ### Step 5: Import Configuration 1. Select **Import Config**. 2. Navigate to the location of your WireGuard configuration file (`.conf`). 3. Select the configuration file to import the details automatically. 4. The app will parse the configuration file and fill in the necessary fields for you. 5. Review and adjust the settings if necessary, then tap on the **Save** button. ### Step 6: Scan QR Code 1. Select **Scan QR Code**. 2. Allow the app to access your camera if prompted. 3. Scan the QR code provided by your WireGuard server. 4. The app will automatically fill in the configuration details from the QR code. 5. Review and adjust the settings if necessary, then tap on the **Save** button. ### Step 7: Enable the WireGuard Configuration 1. After saving, you will see the newly added WireGuard configuration in the list. 2. Tap on the configuration name to enable it. 3. You may be prompted to grant VPN permissions; allow the necessary permissions to proceed. ### Step 8: Switch Between Simple and Advanced Modes 1. By default, the WireGuard configuration is in **Simple Mode**. 2. To switch to **Advanced Mode**, tap on the **Advanced** option. 3. In **Advanced Mode**, you have additional settings available, including the ability to select specific apps to use with the WireGuard VPN. #### Selecting Apps in Advanced Mode 1. In the **Advanced Mode** settings, tap on **Select Apps**. 2. Choose the apps you want to route through the WireGuard VPN. 3. Save your selection and exit the settings. ### Step 9: Verify Connection 1. Once connected, you should see a status indication that the WireGuard VPN is active. 2. You can verify the connection by checking your IP address or using any network diagnostic tool to ensure your traffic is being routed through the WireGuard VPN. ### Troubleshooting - **Connection Issues**: Ensure that your WireGuard server details are correct and that the server is running. - **DNS Issues**: Verify that the DNS servers specified in the configuration are reachable and correctly configured. - **Permission Issues**: Make sure that the app has the necessary permissions to establish a VPN connection. ### Conclusion You have successfully added a WireGuard configuration to the Rethink DNS + Firewall + VPN app. If you encounter any issues or need further assistance, please refer to the support documentation or contact the support team. --- ## File: docs/interactiveDoc.mdx --- id: mdx title: Powered by MDX --- You can write JSX and use React components within your Markdown thanks to [MDX](https://mdxjs.com/). The `.mdx` extension is not required, but will enable better support from tooling (IDE, Prettier...). export const Highlight = ({children, color}) => ( alert('Highlight pressed!')}> {children} ); Docusaurus green and Facebook blue are my favorite colors. I can write **Markdown** alongside my _JSX_! --- ## File: docs/introdcution.md --- id: introduction title: Rethink DNS + Firewall sidebar_label: Welcome slug: / --- 2B+ Android users deserve access to a safer and open Internet. Rethink [DNS](dns) and [Firewall](firewall) offer a fast, secure, configurable, private DNS + Firewall for Android.