rethink-app Documentation

DNS over HTTPS / DNS over Tor / DNSCrypt client, WireGuard proxifier, firewall, and connection tracker for Android.

5,106 stars Kotlin Kotlin 1 file · ~8,483 tokens #android#android-app#android-application#android-firewall#anti-censorship#anti-surveillance#censorship-circumvention#censorship-resistance
RAW Doc

1. Project Overview & Quickstart (celzero/rethink-app)

Rethink DNS + Firewall + VPN for Android

A multi-hop WireGuard client, an OpenSnitch-inspired firewall and network monitor + a pi-hole-inspired DNS over HTTPS (DoH), Oblivious DoH, DNS over TLS (DoT), DNSCrypt client with blocklists.



Release certificate SHA-256 digests:
Prod flavour on the Play Store & Website: 1f32d432e81a1dc5c00aafeb0c6636cd7819965d174420e59db9675dff7a88e9.
Alpha flavour on GitHub: 014da2d3c66439105d1238f3bcf5705d63a7ce2da2f54005f72066cf8717bbbf.

In other words, Rethink DNS + Firewall + VPN has three primary modes, VPN, DNS, and Firewall. The VPN (proxifier) mode supports multiple WireGuard upstreams in a split-tunnel configuration. The DNS mode routes all DNS traffic generated by apps to any user-chosen DNS-over-HTTPS / Oblivious DNS-over-HTTPS / DNS-over-TLS / DNSCrypt resolver, or to WireGuard-configured DNS in a split-tunnel configuration. The Firewall mode lets the user deny internet-access to entire applications based on events like screen-on / screen-off, app-foreground / app-background, unmetered-connection / metered-connection; or based on play-store defined categories like Social, Games, Utility, Productivity; or additionally, based on user-defined domain & IP denylists.

screenshots from v055e.

VPN / Proxifier

Rethink supports forwarding TCP & UDP over SOCKS5, HTTP CONNECT, and WireGuard tunnels. Split-tunneling further helps run multiple such tunnels at the same time and lets users route different apps over different tunnels. For example, one could route Firefox over SOCKS5 connecting to Tor, Netflix over WireGuard connecting through any popular VPN provider, and Telegram or WhatsApp over censorship-resistant HTTP CONNECT endpoints at the same time.

Firewall

The firewall doesn't really care about the connections per se rather what's making those connections. This is different from the traditional firewalls but in-line with Little Snitch, LuLu, Glasswire and others.

Currently, per-app connection mapping is implemented by capturing udp and tcp flows managed by firestack (written in Go) and asking ConnectivityService for the owner, an API available only on Android 10+. procfs (/proc/net/tcp and /proc/net/udp) is read on-demand to track per-app connections like NetGuard or OpenSnitch do, on Android 9 & below.

Network Monitor

A network monitor is a per-app report-card of sorts on when connections were made, how many were made, and to where. Tracking UDP / TCP (and DNS on Android 12+) is straight-forward. DNS requests are trickier to track on Android 11 & below, and so a rough heuristic is used for now, which may not hold good in all cases.

DNS over HTTPS client

Almost all of the network related code (firestack), including DNS over HTTPS split-tunnel, is a hard fork of Jigsaw-Code/outline-go-tun2socks written in golang. The UI is vastly different but borrows minimally from Jigsaw-Code/Intra. A split-tunnel traps requests sent to the VPN's DNS endpoint and relays it to a DNS-over-HTTPS / DNS-over-TLS / DNSCrypt / Oblivious DNS-over-HTTPS endpoint of the user's choosing, logging the end-to-end latency, time of request, the DNS request query itself, and its answer.

The Rethink DNS Resolver

A malware and ad-blocking DNS over HTTPS resolver at https://sky.rethinkdns.com/rs (deployed to 300+ locations world-wide via Cloudflare Workers) is the default DNS endpoint on the app, though the user is free to change that. A configurable DNS resolver that lets users add or remove denylists and allowlists, add rewrites, analyse DNS requests is launching late 2026. Right now, a free-to-use DNS over HTTPS endpoint with custom blocklists can be setup here: rethinkdns.com/configure.

The resolver, sponsored by FLOSS/fund, is deployed to Fly.io at max.rethinkdns.com, and Deno Deploy at rdns.deno.dev too, apart from the default deployment on Cloudflare Workers. The resolver is open source software: serverless-dns.

The Rethink Proxy Network

RPN is a multi-party relay, with packets exiting over serverless proxy (hosted on Cloudflare Workers) hopping over Windscribe. Users are able to self-host serverless proxy or use the ones run by us. RPN starts at $1.75/month for unlimited bandwidth and supports activating 5 locations (out of 80+) in parallel, per-device.

The proxy is open source software: serverless-proxy.

Community

Translation

Help translate Rethink DNS + Firewall + VPN on Weblate:

What Rethink DNS + Firewall + VPN is not

Rethink is not an anonymity tool: It helps users tackle unabated censorship and surveillance but doesn't lay claim to protecting a user's identity at all times, if ever.

Rethink does not aim to be a feature-rich traditional firewall: It is more in-line with Little Snitch than IP tables, say.

Rethink is not an anti-virus: Rethink may stop users from phishing attacks, malware, scareware websites through its DNS-based blocklists, but it doesn't actively mitigate threats or even look for them or act on them, otherwise.

What Rethink DNS + Firewall + VPN aspires to be

To turn Android devices into user-agents: Something that users can control as they please without requiring root-access. A big part of this, for an always-on, always-connected devices, is capturing network traffic and reporting it in a way that makes sense to the end-users who can then take a series of actions to limit their exposure but not necessarily eliminate it. Take DNS for example-- for most if not all connections, apps send out a DNS request first, and by tracking just those one can glean a lot of intelligence about what's happening on their Androids and which app's responsible.

To deliver the promise of open-internet for all: With the inevitable ECH (encrypted client hello) standardization and the imminent adoption of DNS-over-HTTPS and DNS-over-TLS across operating systems and browsers, we're that much closer to an open internet. Of course, Deep Packet Inspection remains a credible threat that can't be mitigated with just encrypted DNS, but it is one example of delivering maximum impact (circumvent internet censorship in most countries) with minimal effort (not requiring use of a VPN or access via IPFS, for example). Rethink would continue to make these technologies accessible in the simplest way possible, especially the ones that get 90% of the way there with 10% effort.

Development

       

  1. Feel free to fork and send a pull request for any reproducible bug fixes.
  2. The codebase is raw and is lacking documentation and comprehensive tests. If you need help, feel free to create a Wikipage to highlight the pain with building, testing, writing, committing code. DeepWiki and Copilot may also help, but they do hallucinate.
  3. Write descriptive commit messages that explain concisely the changes made.
  4. Each commit must reference an open issue on the project to make sure there isn't duplicated effort and prior discussion to refer to.
  5. If you plan to work on a feature, please create a github issue on the project first to kickstart the discussion before committing to doing any work.
  6. Prod releases are usually once every few months, while alpha is released monthly.

Tenets (unless you know better ones)

We aren't there yet, may never will be but these are some tenets for the project for the foreseeable future.

  • Make it right, make it secure, make it resilient, make it fast. In that order.
  • Easy to use, no-root, no-gimmicks features that are anti-censorship and anti-surveillance.
    • Easy to use: Any of the 3B+ Android users must be able to use it. Think WhatsApp / Instagram levels of ease-of-use.
    • no-root: Shouldn't require root-access for any functionality added to it.
    • no-gimmicks: Misleading material bordering on scareware, for example.
  • Anti-censorship: Features focused on helping bring an open internet to everyone, preferably in the most efficient way possible (both monetarily and technically).
  • Anti-surveillance: As above, but features that further limit (may not necessarily eliminate) surveillance by apps.
  • Incremental changes in balance with newer features.
    • For example, work on nagging UI issues or OEM specific bugs, must be taken up on equal weight to newer features, and a release must probably establish a good balance between the two. However; working on only incremental changes for a release is fine.
  • Opinionated. Chip-away complexity. Do not expect users to require a PhD in Computer Science to use the app.
    • No duplicate functionality.
    • A concerted effort to not provide too many tunable knobs and settings. To err on the side of easy over simple.
  • Ignore all tenets.
    • Common sense always takes over when tenets get in the way.
  • Must be distributable on the PlayStore, at least some toned down version of it.
    • This unfortunately means on-device blocklists aren't possible; however, Cloudflare Gateway-esque cloud-based per-user blocklists get us the same functionality.
  • Practice what you preach: Be obsessively private and secure.

Backstory

 
 
 

Internet censorship (sometimes ISP-enforced and often times government-enforced), unabated dragnet surveillance (by pretty much every company and app) stirred us upon this path. The three of us university classmates, Mohammed, Murtaza, Santhosh got together in late 2019 in the sleepy town of Coimbatore, India to do something about it. Our main gripe was there were all these wonderful tools that people could use but couldn't, either due to cost or due to inability to grok Computer-specific jargon. A lot has happened since we started and a lot has changed but our focus has always been on Android and its 3B+ unsuspecting users. The current idea has been in the works since May 2020, with the pandemic derailing a bit of progress, and a bit of snafu with abandoning our previous version in favour of the current fork, which we aren't proud of yet, but it is a start. All is good now that we've won a grant from the Mozilla Builders MVP program to go ahead and build this thing that we wanted to... do so faster... and not simply sleep our way through the execution. I hope you're excited but not as much as us that you quit your jobs for this like we did.

2. Official Technical Reference & Guides (celzero/docs)

File: README.md

RethinkDNS + Firewall Documentation

API, Manual, Tutorial for RethinkDNS + Firewall

Docusaurus

Contributing

Preview contributions

This repository is setup to deploy a preview of changes made in any branch to GitHub pages (except gh-pages branch).

When you make a fork of this repository and make changes on GitHub, you are usually prompted to commit to a new branch patch-* branch, where * is a number. Making such commits allows you to preview your changes before you send a pull request.

To use this functionality:

  1. Head over to Actions tab of your fork repository and Confirm that you want to use Actions, if asked.
  2. Now goto Settings tab of your fork repository and scroll down to find Github Pages. Change the Source from 'None' to 'gh-pages' and click Save.
  3. Now if you make any changes and commit, a GitHub action will be triggered, which you can see in the Actions tab, when it completes successfully, you can see the preview of the changes you made at https://.github.io/docs/ where `` is your GitHub username.

File: docs/firewall/introduction.md

title: Rethink Firewall

slug: /firewall

RethinkDNS comes with a companion Firewall app for Android, that lets you monitor and control Internet access to apps installed on your device.

The app lets you view searchable network log per connection; reveals apps that were blocked and when; Reveals apps that are connected to where and when.

It also lets you block individual IPs.

You would be able to set rules such as, block apps by category, block when app is in the background, block an app when device is locked, or block an app forever.

RethinkDNS Firewall when configured DNS, you can analyse DNS requests in real-time and read through aggregated reports in the App logs. And it also helps evade Internet censorship as enforced in most countries.

Goto RethinkDNS.com to download.

File: docs/firewall/orbot.md

title: Orbot Integration

RethinkDNS comes with an option to configure Orbot (Tor) to be used along with the RethinkDNS as a Proxy server to change the IP address.

Configurations Steps

Manual Method

  1. Start Orbot (do not start it in the VPN mode).
  2. Notice what Orbot says against "SOCKS5" and "HTTP" fields on its home-screen. Those are port numbers.
  3. Open the RethinkDNS app; Start it and goto Settings.
  4. Enable HTTP Proxy and enter the HTTP port number (as seen in Orbot), if you want just the browsers to use Orbot's Tor bridge.
  5. Enable SOCKS5 (TCP) Proxy and enter the port number (from step 2), choose App (as Orbot), optionally enable Block all UDP traffic except DNS to stop leaking UDP (WhatsApp calls, Zoom, Chromecast may stop working; Orbot doesn't support UDP).
  6. Note: The IP address field to be set in RethinkDNS is 127.0.0.1 for both those proxies (for Orbot).
  7. Visit dnsleaktest.com. It shouldn't be able to tell where you're from and not be able to show your actual IP.

Automatic Method

Starting from Version 0.53c, we have introduced one click setup

  1. To use that Open RethinkDNS app and go to Settings Tab by clicking Gear Icon at the bottom menu.

  2. In settings, you will find Setup Orbot in VPN & Proxy section, click on it.

  3. Now, you will be presented with a drawer at bottom, where you will find options to setup Orbot as per your liking (HTTP Proxy, TCP-Only Proxy, TCP + HTTP Proxy and None).

  4. Select the one you like and click on the Orbot icon at top of the drawer to open Orbot app and then start Orbot (tor network). Once you see 100% you are good to go.

File: docs/dns/introduction.md

title: Rethink DNS

slug: /dns

RethinkDNS is DNS Resolver Service with custom rules and blocklists. A DNS resolver is an address book of the internet-- it helps locate IP addresses of the servers given a domain name. For example, dns.google.com (a domain name) is located at 8.8.8.8 (IP address). This mapping is retrieved by a DNS resolver.

You can configure RethinkDNS in the companion firewall app or even in your own device / internet browser that supports Secure DNS (aka DNS over HTTPS). See below on how to configure.

RethinkDNS is private, secure, and fast DNS resolver and has 190+ pre-defined blacklists for you to configure.

With our paid plans (coming soon), you'll also be able to define your own custom blocklists that can be configured with RethinkDNS. The paid plan will also allow you to store you dns logs and view analytics, all in the cloud. You will be able to analyse your DNS requests and read through aggregated reports.

RethinkDNS is highly-available with servers in over 200+ locations across the globe for fast DNS resolution.

How To Configure DNS {#how-to}

A custom DNS resolver can be configured here: rethinkdns.com/configure. This will give a DNS resolver address that looks something like https://basic.bravedns.com/1:YASAAQBwIAA= according to blocklists or rules that you selected. This address can then be used as your DNS resolver in your device or browser.

Configure blocklists on the Companion Firewall App

  1. Open RethinkDNS on your Android Smartphone
  2. Click START to start the RethinkDNS resolver and Firewall, once it starts up properly, you'll see a 'PROTECTED' status below it.
  3. Now tap on 'CONFIGURE' in the DNS section, which will open up a page that will allow you to set your DNS resolver. By default, it is set to RethinkDNS Basic, which blocks a set of few malware and trackers. But, you can add your own custom DNS or choose the pre-defined ones.
  4. To configure blocklists, choose RethinkDNS Plus and tap on 'CONFIGURE' button below it, this will open up the rethinkDNS configuration page. Here, you can select a set of blocklists with 'Simple View' or tap on 'Advanced View' to select Individual blocklists.
  5. After you select your desired blocklists, tap on 'Done' at the bottom bar. This will close the configuration page and the selected blocklists will be automatically configured withe app. You will see an android toast message Configured URL has been updated successfully to confirm this.
  6. You have successfully configured RethinkDNS with blocklists in the companion firewall app.

File: docs/dns/open-source.md

title: Open Source

The free and open source RethinkDNS Resolver is serverless and supports protocols: DNS over HTTPS (DoH) & DNS over TLS (DoT). It can be configured with custom blocklists. And can be hosted on cloudflare, fly.io or deno-deploy. Source code is made available at github.com/serverless-dns/serverless-dns.

Hosting your own DNS Resolver {#hosting}

This serverless DNS can be hosted to three platforms: Cloudflare, Deno-Deploy and Fly.io. Easiest way would be to use Cloudflare. The below table summarizes the platforms available.

Platform Difficulty Resolver Protocol Instructions
⛅ Cloudflare Easy DoH Read Instructions
🦕 Deno Deploy Moderate DoH Read Instructions
🪂 Fly.io Hard DoH and DoT Read Instructions

Using Cloudflare {#cloudflare}

Rethink serverless can be hosted to cloudflare. User will be liable for cloudflare billing. Click the button below to deploy.

  • Configure

    • Once the hosting is successful, lets consider rethink serverless dns is hosted
      to example.com.
    • To configure your dns level blocking visit to example.com/configure which
      will take to configuration page, which currently contains 191 blocklists with
      ~13.5 Million blockable domains in category like notracking, dating, gambling,
      privacy, porn, cryptojacking, security ...
    • Navigate through and select your blocklists.
    • Once selected you can find your domain name example.com followed by
      configuration token on screen like this https://example.com/1:AIAA7g== copy
      it and add to your dns DOH client.
    • Now your own trusted dns resolver with custom blocking is up and running.

  • Change Resolver

    • By default dns request are resolved by cloudflare cloudflare-dns.com.
    • To change resolver login to your cloudflare dash board
      • click on worker
      • click on serverless-dns worker
      • click on Settings tab
      • under Environment Variables click on Edit variables
      • if your new DOH resolver url is example.dns.resolver.com/dns-query/resolve
      • change below variables and click on save button
        CF_DNS_RESOLVER_URL = example.dns.resolver.com/dns-query/resolve
      • alternatively, you can modify your CF_DNS_RESOLVER_URL in your forked serverless-dns repo. Head to src/core/env.js and modify either your CF_DNS_RESOLVER_URL or CF_DNS_RESOLVER_URL_2 DNS server

Using Deno-Deploy {#deno-deploy}

This project can be hosted on deno.com/deploy and supports DoH only. User will be liable for deno.com billing.

  1. Fork the serverless-dns repository (requires a GitHub account).
  2. In the repository you just forked, click on the Actions tab and Confirm that you want to use Actions, if prompted.
  3. Now, navigate to deno.com/deploy and Sign Up for an account.
  4. Create a new project via the deno dashboard by just clicking on the New Project button.
  5. Select your forked repository from the list of repositories that appear. If your GitHub username does not show up, click on + Add GitHub Account and install the Deno Deploy GitHub App with the necessary permissions.
  6. Once you select your forked repository, input boxes for project configuration show up. You need to do two things here; enter deno task prepare in the Build Step, and select src/server-deno.ts in Entrypoint field.
  7. Click on the Deploy Project button.
  8. Once your project is successfully deployed, you will see "Success!" page with a URL to your deployment that looks like https://.deno.dev. If you found any issues, reach out to us over on GitHub.
  9. Optionally, if you need to configure environment variables, you can do so in the project settings page that you can access either by clicking on the Add environment variables link shown in the "Success!" page, or by navigating to https://dash.deno.com/projects//settings#environment-variables.

Using Fly.io {#fly-io}

This project can be hosted on fly.io, and can support both DoT and DoH protocols. User will be liable for fly.io billing.

  1. Install flyctl on your device (ref).
  2. Signup and/or login to fly.io (ref).
  3. Create an empty directory anywhere on your PC. Open you terminal or powershell and navigate to this directory.
  4. Launch a fly app
    bash
    flyctl launch
    • Choose a unique name here or let it auto-generate.
    • Choose a location (the closer to your users, the better).
    • Note down the name of the app and you may delete this directory along with the generated fly.toml.
  5. Now, you would need a SSL or TLS certificate for your domain name. Both getting a domain name and CA certificate generation are beyond the scope of this README. Let's Encrypt and ZeroSSL vend public certs for free, valid for a maximum of 90 days.
  6. Once you have your CA certificate and key files, you need to encode them as base64 with no wrapping. How this can be done in bash terminal is shown below.
    bash
    # Locate your CA certificate & key files
CRT="path/to/full-chain-certificate.pem"
KEY="path/to/key.pem"
    bash
    # Encode them in base64 with no wrappings and store them in variables
B64NOWRAP_KEY="$(base64 -w0 "$KEY")"
B64NOWRAP_CRT="$(base64 -w0 "$CRT")"
  7. As described in .env.example file, this base64 encoded certificate-key pair need to set as a single environment variable called TLS_. Within this variable, the certificate and key encodings needs to be separated by a newline (\n) and described by CRT= and KEY=. On a bash terminal this can be done by following steps continued by by above.
    bash
    # This creates a single file called "FLY_TLS" in the current directory
echo "KEY=$B64NOWRAP_KEY" > FLY_TLS
echo "CRT=$B64NOWRAP_CRT" >> FLY_TLS
# And now, this "FLY_TLS" file contains both certificate and key encoded and
# as required
    • Upload this to fly secrets like so in terminal or powershell:
      bash
      fly secrets set TLS_CERTKEY=- < FLY_TLS -a <app-id>
      where <app-id> is the name of the fly app you had launched in step 4.
    • Other essential environment variables are already present in fly.toml file of this repository, but you may read .env.example for it's use case and configuration.
  8. Fork the serverless-dns repository (you will need a GitHub account).
  9. In your fork, click on the Actions tab and Confirm that you want to use Actions, if asked.
  10. Similarly, click on Settings tab and select Secrets on the left pane. Add a new GitHub secret called FLY_APP_NAME and set it's value as the name of the fly app you had launched in step 4. And add another secret called FLY_API_TOKEN and set's value as what you get from running flyctl auth token in terminal or powershell.
  11. Head back to Actions tab and click on Fly on the left pane. Click on the Run workflow dropdown on the right side, and run the workflow using the Run workflow button.
  12. Once this action workflow finishes, open the terminal or powershell again and type in:
    bash
    flyctl ips list -a <app-id>
    where <app-id> is the name of the fly app you had launched in step 4.
    • Here, you can get the IP address of the application, update the DNS records of your domain name you had used in step 5.
  13. Done. Your application should be available on the said domain name in a few minutes. To configure, for example, the upstream resolver, you can edit the environment variables in the fly.toml file of your fork and re-run the Action workflow.

File: docs/proxy/wireguard.md

title: WireGuard

Adding a WireGuard Configuration to Rethink DNS + Firewall + VPN App

This guide will walk you through the steps to add a WireGuard configuration to the Rethink DNS + Firewall + VPN app.

Step 1: Open the App

  1. Open the Rethink DNS + Firewall + VPN app on your device.

Step 2: Navigate to the WireGuard Section

  1. Tap on the VPN tab at the bottom of the screen.
  2. Select WireGuard from the list of available VPN options.

Step 3: Add a New WireGuard Configuration

  1. Tap on the + (plus) button or the Add Configuration option.
  2. You will see three options:
    • Manual Entry
    • Import Config
    • Scan QR Code

Step 4: Manual Entry

  1. Select Manual Entry to enter the configuration details manually.
  2. Enter a name for the configuration in the Name field.

Enter WireGuard Configuration Details

  1. Public Key: Enter the public key provided by your WireGuard server.
  2. Private Key: Enter your private key. (Ensure this is kept secure and never shared.)
  3. Endpoint: Enter the endpoint URL or IP address of your WireGuard server along with the port (e.g., vpn.example.com:51820).
  4. Allowed IPs: Enter the IP addresses that should be routed through the WireGuard tunnel (e.g., 0.0.0.0/0 to route all traffic).

Optional - Set Additional Parameters

  1. DNS: Enter the DNS server(s) to be used with this WireGuard configuration.

  2. Persistent Keepalive: Enter a value (in seconds) to keep the connection alive, if required by your server configuration (e.g., 25).

  3. Once all the necessary details have been entered, tap on the Save button.

Step 5: Import Configuration

  1. Select Import Config.
  2. Navigate to the location of your WireGuard configuration file (.conf).
  3. Select the configuration file to import the details automatically.
  4. The app will parse the configuration file and fill in the necessary fields for you.
  5. Review and adjust the settings if necessary, then tap on the Save button.

Step 6: Scan QR Code

  1. Select Scan QR Code.
  2. Allow the app to access your camera if prompted.
  3. Scan the QR code provided by your WireGuard server.
  4. The app will automatically fill in the configuration details from the QR code.
  5. Review and adjust the settings if necessary, then tap on the Save button.

Step 7: Enable the WireGuard Configuration

  1. After saving, you will see the newly added WireGuard configuration in the list.
  2. Tap on the configuration name to enable it.
  3. You may be prompted to grant VPN permissions; allow the necessary permissions to proceed.

Step 8: Switch Between Simple and Advanced Modes

  1. By default, the WireGuard configuration is in Simple Mode.
  2. To switch to Advanced Mode, tap on the Advanced option.
  3. In Advanced Mode, you have additional settings available, including the ability to select specific apps to use with the WireGuard VPN.

Selecting Apps in Advanced Mode

  1. In the Advanced Mode settings, tap on Select Apps.
  2. Choose the apps you want to route through the WireGuard VPN.
  3. Save your selection and exit the settings.

Step 9: Verify Connection

  1. Once connected, you should see a status indication that the WireGuard VPN is active.
  2. You can verify the connection by checking your IP address or using any network diagnostic tool to ensure your traffic is being routed through the WireGuard VPN.

Troubleshooting

  • Connection Issues: Ensure that your WireGuard server details are correct and that the server is running.
  • DNS Issues: Verify that the DNS servers specified in the configuration are reachable and correctly configured.
  • Permission Issues: Make sure that the app has the necessary permissions to establish a VPN connection.

Conclusion

You have successfully added a WireGuard configuration to the Rethink DNS + Firewall + VPN app. If you encounter any issues or need further assistance, please refer to the support documentation or contact the support team.

File: docs/interactiveDoc.mdx

id: mdx title: Powered by MDX

You can write JSX and use React components within your Markdown thanks to MDX.

The .mdx extension is not required, but will enable better support from tooling (IDE, Prettier...).

export const Highlight = ({children, color}) => (
alert('Highlight pressed!')}>
{children}

);

Docusaurus green and
Facebook blue
 are my favorite colors.

I can write Markdown alongside my JSX!

File: docs/introdcution.md

id: introduction title: Rethink DNS + Firewall sidebar_label: Welcome slug: /

2B+ Android users deserve access to a safer and open Internet. Rethink DNS and Firewall offer a fast, secure, configurable, private DNS + Firewall for Android.

Explore Related Technologies & Topics

View All 9,111+ Repositories →

Discover similar high-velocity repositories, agent skills, and OpenAPI specifications across the ecosystem.

#android Browse android catalog → #android-app Browse android-app catalog → #android-application Browse android-application catalog → #android-firewall Browse android-firewall catalog → #anti-censorship Browse anti-censorship catalog → #anti-surveillance Browse anti-surveillance catalog → ⚡ MCP Servers Model Context Protocol → 🧠 Agent Skills Prompt & rule files → 🔌 OpenAPI Specs REST & Swagger schemas →