RethinkDNS vs NetGuard: Which Firewall Wins?

Your phone's apps talk to the internet far more than you think. A calculator app has no business uploading your data, yet many simple apps quietly send information to advertising and tracking servers. A no-root firewall lets you stop that without rooting your phone — and the two best options are NetGuard and RethinkDNS.

Both apps are free, open source, and work without root. But they take very different approaches. NetGuard is a focused, lightweight firewall: simple switches that turn internet access on or off for each app. RethinkDNS is a bigger toolkit: a firewall plus DNS-based ad-blocking, anti-censorship features, and even WireGuard VPN support in one app. This guide compares them in plain words, with every fact checked on the live Google Play Store on October 8, 2026.

What Is a No-Root Firewall?

Normally, controlling which apps can reach the internet requires root access — deep system privileges most people do not have. No-root firewalls get around this with a clever trick: they use Android's VPN service, but instead of sending your traffic to a remote server, they filter it right on your phone. Your data never leaves the device.

There is one catch you must know: Android allows only one app to use the VPN service at a time. So you cannot run NetGuard and RethinkDNS together, and you cannot run either one alongside a regular VPN app. Whichever you choose becomes your phone's VPN slot. This single fact shapes the whole comparison, because RethinkDNS can partly replace a VPN while NetGuard cannot.

What NetGuard Does

NetGuard, made by FairCode B.V., is the older and more established of the two. It has been around for about a decade and does one job extremely well: it lets you allow or deny internet access per app, separately for Wi-Fi and mobile data. Open the app, and you see a list of your installed apps with simple on/off toggles. That is most of what most people need.

Beyond the basics, NetGuard offers rules for when the screen is on or off (for example, block background data when the screen is off), blocking when roaming, blocking system apps, and notifications when an app accesses the internet. The Pro version, a paid in-app purchase, adds a detailed traffic log, per-address filtering (block specific servers while keeping the rest of the app working), PCAP export for analysis in tools like Wireshark, and extra themes. On the Play Store, NetGuard - no-root firewall holds a 4.26 rating from 29,575 reviews. It is 100% open source with no tracking, no ads, and no calling home.

What RethinkDNS Does

RethinkDNS (the app is called "Rethink: DNS + Firewall + VPN") is the newer, more ambitious option. It is developed by an independent team, and it combines three tools in one: a firewall, a DNS-based ad and tracker blocker with over 190 blocklists, and support for WireGuard VPN connections.

The DNS blocking is the big difference. Instead of only switching whole apps on or off, RethinkDNS can block the advertising and tracking domains apps talk to, while letting the useful parts of the app keep working. It encrypts your DNS queries with DNS-over-HTTPS or DNS-over-TLS, so your internet provider cannot see or tamper with them. It also includes anti-censorship features that help in countries where websites and apps are blocked.

For power users, RethinkDNS offers per-app domain rules (allow or deny specific websites for each app), real-time connection monitoring that shows exactly which servers your apps contact, data usage stats per app, and the ability to route traffic through your own WireGuard VPN — solving the one-VPN-slot problem. On the Play Store, Rethink: DNS + Firewall + VPN holds a 3.93 rating from 3,544 reviews. It is free and open source with no trackers.

Head-to-Head Comparison

Where NetGuard Wins

NetGuard wins on simplicity and efficiency. If your goal is "stop this app from using the internet," nothing beats opening NetGuard and flipping a switch. The interface is clean, the app is tiny, and it is famous for barely touching your battery — blocking background data can even improve battery life.

NetGuard also wins on maturity. A decade of development means the app is stable and predictable. Its screen on/off rules are the best in this category: you can set apps to work only when you are actively using your phone, and stay silent the rest of the time. For a parent limiting a child's app usage, or anyone who wants a set-and-forget firewall, NetGuard is the calmer choice. Users in the RethinkDNS community itself admit NetGuard's developer has served this need alone for years and praise its reliability.

Where RethinkDNS Wins

RethinkDNS wins on power. The DNS-based blocking is a different league from simple on/off switches: instead of killing an app's internet entirely, you can strip out its ads and trackers while the app still works. With over 190 blocklists, it catches far more than a manual approach ever could.

It also wins on privacy depth. Encrypted DNS stops your internet provider from watching and tampering with your browsing. The connection monitor shows you, in near real time, which servers each app talks to — many users say this alone was worth switching for, because it reveals just how chatty their apps are. And the built-in WireGuard support means you can run your own VPN through RethinkDNS, neatly solving the one-VPN-slot limit. Users who switched from NetGuard describe RethinkDNS as "a premium NetGuard for free," with lower battery use than expected, a better interface, and a very handy DNS log.

If you want to compare other privacy tools that skip the phone-number model, our WhatsApp vs Briar guide covers a similar depth-versus-simplicity trade.

Honest Weaknesses of Each

RethinkDNS's weaknesses are about complexity and battery. The app has far more screens and settings, and beginners can feel lost. Blocking lists are huge with little explanation of what each one does. In full DNS plus firewall mode it uses roughly 5 to 10 percent of battery per day — not terrible, but noticeably more than NetGuard. (DNS-only mode drops that to 1 to 2 percent.) Some users also report the app occasionally disconnecting in the background on certain phones, which needs the "always-on VPN" setting and disabled battery optimization to fix.

NetGuard's weaknesses are about scope. It has no DNS blocking, so it cannot strip trackers out of an app you still want to use — your choice is all or nothing per app, unless you pay for Pro filtering. It cannot encrypt your DNS or bypass censorship, and it cannot share its VPN slot with a real VPN. One more honest point raised by privacy-focused users: like every VPN-based firewall, there is a brief window at phone startup before the firewall loads during which a blocked app could theoretically send data. The fix is Android's "always-on VPN" plus "block connections without VPN" setting, which both apps support.

Which One Should You Pick?

Pick NetGuard if you want a simple, light, set-and-forget firewall. You flip switches, apps stop talking to the internet, your battery thanks you. It is ideal for beginners, for parents controlling a child's phone, and for anyone who values stability over features.

Pick RethinkDNS if you want maximum control and privacy. You get ad and tracker blocking across all apps, encrypted DNS, anti-censorship, connection monitoring, and WireGuard VPN support — all free. It is ideal for privacy enthusiasts and anyone curious about what their apps are really doing. If you are also weighing privacy-focused messengers, our SimpleX vs Session comparison follows the same "how deep do you want to go" logic.

One practical note: because Android allows only one VPN app at a time, try one app for a week before deciding. Both are free to start, so the only cost is your time.

Getting Started

NetGuard setup: install NetGuard from the Play Store, accept the VPN permission, and toggle internet access per app. Turn on "block when screen off" and "block when roaming" in settings if you want them, and consider the Pro upgrade only if you need the traffic log.

RethinkDNS setup: install Rethink from the Play Store, accept the VPN permission, and pick a mode — start with DNS plus firewall. Choose your blocklists (the defaults are fine), set per-app rules as needed, and enable "always-on VPN" with "block connections without VPN" in Android settings for the strongest protection.

Frequently Asked Questions

Which is better, RethinkDNS or NetGuard?

It depends on your needs. NetGuard is simpler and lighter — best if you just want per-app internet on/off switches. RethinkDNS does more — firewall plus DNS ad-blocking, anti-censorship, and WireGuard VPN — but uses more battery and takes longer to learn.

Do RethinkDNS and NetGuard need root?

No. Both work without root by using Android's built-in VPN service to filter traffic on your device. Because of this, you cannot run both at the same time — Android allows only one VPN app at once.

Is RethinkDNS free?

Yes. The RethinkDNS Android app is free and open source. NetGuard is also free for its core firewall features; its Pro features like the traffic log and per-address filtering are a paid in-app purchase.

Does NetGuard block ads?

NetGuard can block internet access per app, and with its Pro filtering feature it can block specific addresses, which stops many ads. RethinkDNS blocks ads and trackers more directly with over 190 DNS blocklists.

Which firewall uses less battery?

NetGuard is known for low battery use — blocking access actually saves battery. RethinkDNS uses roughly 5 to 10 percent in DNS plus firewall mode, and only 1 to 2 percent in DNS-only mode.

Can I use a VPN together with these firewalls?

Both apps occupy Android's single VPN slot. RethinkDNS has built-in WireGuard support so you can route traffic through your own VPN inside the app. NetGuard cannot share its VPN slot with another VPN app.