Compare
Repel vs RethinkDNS: Which Android Firewall and DNS Filter?
By the llcloud team 5 min read
The short answer
Pick RethinkDNS if you want a free, open source app that does DNS, firewall and WireGuard in one tunnel and you are happy to give it the VPN slot. Pick Repel if you need a per-app firewall that runs next to the VPN you already use, with tracker filtering and one-tap Private DNS in the same app.
Both filter tracker and malware domains and block chosen apps from the internet without root. RethinkDNS is free and open source and does everything through Android's VPN service, including connecting to WireGuard VPNs. Repel's firewall does not use the VPN slot, so a separate VPN app can stay connected, and it adds one-tap Private DNS. RethinkDNS has more network features. Repel is simpler to run alongside other apps.
RethinkDNS and Repel overlap more than most privacy apps do. Both filter DNS lookups for trackers and malware, both can cut an app off the internet without root, and both show you which app contacted what. The real differences are price, openness and how each one uses Android's single VPN slot. This comparison is as of October 2026 and uses Rethink's Play listing, website and GitHub page for its facts.
Repel vs RethinkDNS at a glance
| Repel | RethinkDNS | |
|---|---|---|
| Tracker and malware DNS blocklists | ✓ | ✓ |
| Block apps from the internet, no root | ✓ | ✓ |
| Firewall works alongside a separate VPN app | ✓ | ✗ |
| Connects to WireGuard VPNs itself | ✗ | ✓ |
| One-tap Android Private DNS | ✓ | ✗ (not listed) |
| Per-app connection log | ✓ (DNS lookups) | ✓ (connections and data use) |
| Rules by Wi-Fi, mobile data, roaming, screen off | ✓ (Pro) | ✓ (screen, foreground, metered) |
| Per-app domain rules | ✓ (Pro) | ✓ (domain and IP lists) |
| Family mode with a PIN | ✓ (Pro) | Parental blocklists |
| Android TV | ✓ | Not stated |
| Open source | ✗ | ✓ (Apache 2.0) |
| Price | Free, Pro once for life | Free |
Where does RethinkDNS win?
It is free and open source, and that deserves to come first. Rethink's website says the app "is free and open source and will remain so", and anyone can read the code on GitHub. For a tool that sees every connection your phone makes, being able to audit it is a real advantage. Repel has no account and no ads and its filter runs on the phone, but you are trusting a promise rather than reading code.
Rethink also packs more networking into one app. Per its Play listing and README, it supports DNS over HTTPS, DNS over TLS, DNSCrypt and Oblivious DoH, it can forward traffic through SOCKS5 and HTTP proxies, and it can connect to multiple WireGuard VPNs of your choice. Its monitor tracks data use per app and per connection. If you like to tune your network by hand, Rethink gives you more dials.
What is the biggest difference?
The VPN slot. Android lets one app at a time use its VPN service. Rethink's FAQ explains that it uses Android's VPN APIs to route DNS requests and to build its firewall. So while Rethink is on, a separate VPN app cannot be connected. Rethink solves this its own way by being the WireGuard client, which works well if your VPN provider hands out WireGuard configs.
Repel splits the job differently. Its app firewall does not use the VPN at all. It sets up a small helper once through Wireless debugging, on the phone, with no computer and no root, and then blocks chosen apps while your usual VPN app stays connected. That needs Android 13 or newer.
Repel's DNS filter does use the VPN slot. So if you keep a VPN app on all day, the Repel setup is the firewall plus one-tap Private DNS, which leaves the slot free. Our guide to blocking trackers without a VPN walks through it.
How do the firewalls compare?
Rethink's firewall can block whole apps based on triggers such as screen on or off, the app being in the foreground or background, and metered connections, and it can use domain and IP denylists. Its Play listing notes that the background firewall uses an Accessibility Service to detect background apps.
Repel's free firewall blocks any app with one switch. Pro adds smart rules: online only on Wi-Fi, only on mobile data, never while roaming, with the screen off or at bedtime. Profiles for Home, Work and Travel keep separate rule sets, and per-app domain rules let an app reach only the domains you list, with wildcard and regex support.
Both are capable. Rethink has more trigger types and is free. Repel's rules are grouped around everyday situations and keep working with the app closed.
How does tracker and malware blocking compare?
Both are DNS filters at heart. Rethink's website lists more than 190 blocklists in parental, security and privacy groups, and its default resolver blocks malware and ads. Repel's filter checks every lookup on the phone against the lists you choose, such as HaGeZi, OISD, 1Hosts and StevenBlack, and sends allowed lookups out with DNS over HTTPS. Pro adds the larger HaGeZi lists, threat intelligence lists, your own lists and your own DNS server.
Repel also offers one-tap Private DNS: it switches Android's own Private DNS setting to a filtering provider such as AdGuard DNS, NextDNS, Quad9 or Cloudflare. That keeps working with Repel closed and uses no VPN. Our Private DNS guide explains the setting.
Neither DNS filter can remove ads that are served from the same domain as the content, and neither can strip ads inside video streams.
What about logs and insight?
Rethink logs connections per app in near real time and can flag connections to known spyware networks. It also tracks Wi-Fi and mobile data use per app.
Repel's activity log works at the DNS level. It shows which app looked up which domain and whether it was blocked, and you can tap an entry to block or allow it, or cut the app off. Free keeps weekly stats, and Pro keeps 30 days and adds CSV export. It is narrower than Rethink's log but quicker to act on.
Which should you choose?
Choose RethinkDNS if:
- You want a free app with open source code you can audit.
- You are happy for one app to hold the VPN slot, or your VPN provider offers WireGuard configs.
- You want proxies, DNSCrypt or Oblivious DoH.
- You want per-connection data use, not just DNS lookups.
Choose Repel if:
- You want to block apps while a separate VPN app stays connected.
- You want Private DNS set up in one tap, working with the app closed.
- You want family mode with a PIN.
- You also want the same filter on Android TV.
If you are still deciding between no-root firewalls, our Repel vs NetGuard comparison covers the other big open source option, and Repel vs NextDNS covers the cloud approach. Whichever app you pick, aggressive battery savers can stop a filter running in the background, so read why Android kills background apps if yours keeps switching off.
Sources
Questions
Is RethinkDNS really free?
Yes. Rethink's website says the app is free and open source and will remain so, and its code is published on GitHub under the Apache 2.0 licence. The project also runs paid network services, but the app itself costs nothing. That makes it one of the strongest free options for Android, and a fair benchmark for any paid privacy app.
Can RethinkDNS run at the same time as another VPN app?
Not as a separate app. Rethink uses Android's VPN service for its DNS and firewall, and Android lets only one app hold that service at a time. Rethink's answer is to connect to WireGuard VPNs itself, so you can route traffic through your provider inside Rethink if the provider offers WireGuard configs. Repel's firewall avoids the VPN service entirely.
Does Repel's firewall need root or a computer?
Neither. It needs Android 13 or newer and a one-time pairing through Wireless debugging, using the code Android shows on the phone. After that, rules stay in place with Repel closed. The DNS filter and one-tap Private DNS work on Android 11 and newer.
Which one has better blocklists?
Both use well-known community lists. Rethink's website lists more than 190 blocklists across parental, security and privacy categories. Repel offers HaGeZi, OISD, 1Hosts and StevenBlack lists covering trackers, malware, phishing, scam shops and phone-maker telemetry, with the larger HaGeZi lists and your own lists in Pro. For most people, one good list matters more than the count.
Can I use RethinkDNS and Repel together?
Partly. Repel's firewall and one-tap Private DNS do not use the VPN slot, so they can run while Rethink holds it. Running two firewalls at once makes it hard to tell which one blocked something, though, so pick one firewall and one DNS filter.
