App functionality get blocked when set to DNS+Firewall even when manually allowing the domains and IP's.

[TriMoon]

• The app in question: "World of Tanks BLITZ".
• RethinkDNS version: v054a

When you set "DNS+Firewall" and try to watch adverts, you don't get the rewards.
I manually checked the accessed domains and IP's after this happens, and manually make them "Trusted".
I repeated this over and over.
I currently have 71 domains and 314 IP rules for this app, but it still doesn't work.

The functionality works when using only DNS block mode though...

Oh PS: The app is set to "Bypass DNS+Firewall"...

[ignoramous]

That's a strange one, as the app is set to bypass both DNS and Firewall. Do you see any domains / IPs being blocked against "World of Tanks Blitz" in Network Log? You can use the search box to search for the app + the "Blocked" filter to find blocked connections.

[TriMoon]

Well they obviously ARE blocked by the firewall because it works when I use DNS only mode 😉

PS: I unblock/trust the domains+IP's manually by going through the logs you get when you inspect a particular app...

So somehow the firewall isn't respecting the trust list and just blocks everything I guess.

[ignoramous]

Can you please look at the network log to see if the connections are indeed blocked?

Well they obviously ARE blocked by the firewall because it works when I use DNS only mode

The DNS-only mode is vastly different than DNS + Firewall mode. So, these assumptions don't hold as you may think.

[ignoramous]

Also, for Bypass DNS + Firewall to work, the upstream DNS must be set to one of the RDNS+ resolvers.

[TriMoon]

@ignoramous
Ok i just checked the normal logs (with Blocked filter" to show only blocked entries.)

1. App set the "Bypass DNS &Firewall"
2. RethinkDNS set to "DNS and Firewall"
   • RethinkDNS using RDNS Plus, with 25 blocklists in use.
3. The app now has:
   • 328 IP rules set to "Trusted"
   • 71 Domains set to "Trusted"
4. No blocked entries shown in normal logs, but rewards not granted.

PS: As said before it works properly when using DNS only...
(You can check yourself by just trying out the app i mentioned in OP, on android Phone)

[ignoramous]

Ah, thanks. This very much seems to be an application-specific issue. Because if nothing is blocked then things should work, but clearly isn't. I'll take a look at this once #52 is out the door.

[TomRepper]

... seems not to be application specific. Same issue with Ecosia Browser. Once having set fw rules always Rethink DNS blocks loading websites when fw is active. Only Deactivation of fw helped me.
BTW: There were no rules set for Firefox so fw activation, as expected, has no effect on Firefox.

[ignoramous]

Thanks. What do you see against Ecosia in the Network Logs UI? Any blocked connections (blocked entries appear with a red left-hand side border, tapping on which should show you the reason why the connection was blocked)?

[TomRepper]

Forgot to tell you which blocking reasons were arising. They were mostly "DNS blocked", only two times "Unused app".
As I told you, I have deactivated "Block every unused app" and then Ecosia could load web pages completely and internal navigation links worked again.
The question is: Why was Ecosia blocked by the FW even while I was using it?
Is there any more detailed docs than these I found on https://docs.rethinkdns.com ?
Many config points need some explanations.

[NickVeld]

To the original question. When I updated to v54a, all my "isolated" apps become blocked. So I have put them to something else and then back to "Isolate".
If you are not blocking something in the app you can choose "Exclude" for the app so you do not need to disable the firewall at all.

[ignoramous]

To the original question. When I updated to v54a, all my "isolated" apps become blocked. So I have put them to something else and then back to "Isolate".

Yikes! Looks like a database migration bug. Did the UI reflect that change, or did it continue to show Isolate despite the previously isolated app being blocked completely?

[ignoramous]

Many config points need some explanations.

True. Folks who understand this should contribute to the docs: https://github.com/celzero/docs (:

I have deactivated "Block every unused app" and then Ecosia could load web pages completely and internal navigation links worked again.

Not sure, but seems like an Android bug. Are you on a different ROM? What version of Android?

[NickVeld]

Did the UI reflect that change, or did it continue to show Isolate despite the previously isolated app being blocked completely?

[Diclaimer after updating from v54a to v54c the issue seems fixed]
If you open an app in the Network logs you see that the "Isolate" is selected in the dropdown but the status of the log is "App Blocked". I have not checked it anywhere else.

[michaelblyons]

I am not sure what specifically changed, but I've had a much better experience with v54c, where v54a got stuck blocking all traffic.

[NickVeld]

@michaelblyons looks like the same thing that I had too

[hussainmohd-a]

Kindly inform us if you continue to encounter this problem. The v055 release (currently available on the website, with the versions for the Play Store and F-Droid pending) includes several additional enhancements aimed at resolving this issue.

[TriMoon]

@hussainmohd-a i personally have moved away from this topic so far due to other stuff im doing that i don't remember nor use the setup in the topic anymore...
Over my head with Linux stuff hehehe

But if i encounter similar problems ill remember to get back 😉

[hussainmohd-a]

Thank you, @TriMoon. Closing this issue for now. Please feel free to reopen it if you encounter this problem again.