How Repel's Firewall Works Without Taking Your VPN Slot

Android has a rule that shapes every privacy app on it: only one app at a time can use the VPN service. If you pay for a privacy VPN, it holds that slot, and most no-root firewalls need the same slot to work. So people end up choosing between their VPN and their firewall. When we started Repel, not having to choose was the first thing we wanted to fix.

This post explains how Repel's firewall does that, and how its DNS filter works, in plain words.

Why do most firewalls need the VPN slot?

On a phone without root, an ordinary app has no say over other apps' network traffic. Android's VPN service is the one door it opens: an app that becomes the VPN gets to see traffic and decide what to do with it. A firewall built that way can drop the traffic of any app you choose. It is a clever design, and it has worked well for years, as we describe in Repel vs NetGuard.

The cost is the slot. While that firewall is the VPN, nothing else can be. Switch on your privacy VPN and the firewall stops, or the other way round.

How does Repel block apps without a VPN?

Android itself has a switch that turns networking off for a single app. It is part of the system's own network controls, and on Android 13 and newer it can be flipped from the phone's shell, the same level of access that developer tools have. Ordinary apps cannot reach it, so Repel needs a way to get that level of access without a computer and without root.

That way is Power mode. Once, during setup, you turn on Wireless debugging and pair Repel with it using the code Android shows on the phone. Repel then starts a small helper of its own with shell access. The helper does a short, fixed list of jobs and nothing else. It does not accept arbitrary commands, and it checks every app name it is given.

When you switch an app off in Repel's Apps tab, the helper asks Android to turn networking off for that app. From then on, the block lives in Android's own network rules, not in a tunnel. That has a few consequences we like:

• Your VPN stays connected. The firewall never touches the VPN service, so a privacy VPN can run alongside it.
• Rules hold with Repel closed. The block is in the system, so it stays in place even if Repel is not running.
• Other firewalls are respected. Some other apps use the same system controls. Repel reads what is already blocked before it changes anything, so it does not switch off rules another app set.

Pro adds smarter rules on top, such as online only on Wi-Fi, only on mobile data, never while roaming, with the screen off or at bedtime, plus profiles for Home, Work and Travel.

What does the DNS filter do?

The firewall decides whether an app can go online at all. The DNS filter works at a finer level: which places an app is allowed to reach.

Before an app connects to a server, it asks for the server's address by name, for example a tracking or analytics domain. That question is a DNS lookup. Repel's filter runs a local VPN on the phone that handles DNS lookups and nothing else. Each lookup is checked against the blocklists you choose, such as HaGeZi, OISD, 1Hosts or StevenBlack, which cover trackers, malware, phishing, scam shops and phone-maker telemetry. A blocked lookup gets no answer, so the app never reaches that domain. An allowed lookup goes out encrypted with DNS over HTTPS to the server you picked.

Your other traffic never passes through the filter, and nothing is sent to us. The activity log, which shows which app looked up which domain and whether it was blocked, stays on the phone.

This is the one layer that does use the VPN slot. Android only lets an app see other apps' DNS lookups if it routes them through itself, and the VPN service is how that is done without root. So if you run a privacy VPN all day, the practical setup is the firewall plus Private DNS, both of which leave the slot free.

Where does Private DNS fit in?

Android has a built-in Private DNS setting that sends every lookup, encrypted, to a provider you choose. Pick a filtering provider such as AdGuard DNS or Quad9 and it blocks tracker and malware domains on its side, for every app, with no VPN involved. Repel can switch that setting for you in one tap, and it keeps working with Repel closed. Our guide to Private DNS on Android explains the setting in more detail.

There is one detail we had to get right. When Private DNS is set to a specific provider, lookups go straight to it and bypass any filter on the phone. So while Repel's filter is on, Repel sets your Private DNS choice aside and puts it back when the filter stops. Any change you make in the meantime waits until then.

What happens when something goes wrong?

A DNS filter sits in the path of every connection, so its failures matter more than most. If the DNS server Repel uses is down, the filter steps aside instead of cutting you off. Repel also tells you when its blocklist fails to download, and retries on its own, and explains what to do when Android does not allow the VPN.

We are also clear about what a DNS filter cannot do. It works on domain names, so it cannot touch anything served from the same place as the content you asked for. On Android TV, for example, it cannot remove ads inside video streams. It blocks trackers and malware domains, and that is what we describe it as.

Which layers should you use?

You can use one layer or all three. Our guide on blocking trackers without a VPN walks through the setups, and Repel vs RethinkDNS compares a different approach to the same problem. Whichever you choose, there is no account, and there are no ads, which we explain in why our apps have no ads.