Block internet for unwanted apps — firewalls without root

Part of the max-degoogle any Android phone series.

Debloating removes what you don’t need. A firewall handles the rest: unwanted network access from apps you keep but that have no reason to be online (gallery, calculator, keyboard, file manager, offline games) and system apps you couldn’t safely remove. Blocked from the network, they can’t upload analytics, crash reports or anything else.

How a no-root firewall works

Stock Android has no “Network” permission you can switch off per app (GrapheneOS adds a real one — see its Network permission toggle). The only way to build a firewall without root is Android’s VPN service: the firewall app creates a local VPN on the phone, every app’s traffic flows through it, and it drops the traffic of apps you’ve blocked. Nothing is sent to a remote VPN server unless you configure one.

That design has one big consequence:

Option 1: NetGuard — simplest

NetGuard is the original open-source no-root firewall; install NetGuard from F-Droid for automatic updates. The app list has two icons per app — Wi-Fi and mobile data — tap to block either.

Useful settings:

• Manage system apps (Settings → Advanced options), then Show system apps in the list menu — so you can block system apps too. Go carefully: block one at a time and keep anything related to phone calls, SMS, Wi-Fi calling and the Play Store you rely on.
• Allow when screen is on — per-app rule (enable Apply ‘when screen on’ rules in settings); handy for apps you only want online while you’re using them.
• Block roaming — per app, with options to ignore national or EU roaming.
• The paid Pro features add traffic logging and per-address rules — useful to see where an app tries to connect.

Things to know, from NetGuard’s own documentation:

• Samsung users: the Galaxy Store has carried an unrelated app using NetGuard’s package name that can install itself as an “update”. Install NetGuard from F-Droid or GitHub and keep an eye on it.
• Don’t disable com.android.vpndialogs while debloating — NetGuard (and every VPN app) needs it.
• Wi-Fi calling may stop working if your carrier encrypts calls with IPsec, unless NetGuard has an exception for your carrier.
• NetGuard doesn’t cover apps inside a work profile or Samsung’s Secure Folder.

Option 2: RethinkDNS — firewall, DNS and VPN in one

RethinkDNS (also packaged on F-Droid) combines three things in the single VPN slot: a per-app firewall, an encrypted DNS client with blocklists, and an optional WireGuard client.

• Per-app firewall — block apps entirely, or only on metered (mobile) or unmetered (Wi-Fi) networks.
• Network log — see which apps connect where, and when. Watching this for a day is the fastest way to find out what your phone actually does.
• DNS blocklists — block ad and tracker domains for every app, like Private DNS but with per-app visibility.
• WireGuard — add your VPN provider’s WireGuard config and route traffic through it while still firewalling, solving the one-slot problem.

If you only want the firewall, NetGuard is lighter. If you want logging, DNS filtering and a VPN together, RethinkDNS is the one app that does all three.

Option 3: InviZible Pro — for Tor and DNSCrypt users

InviZible Pro (the stable F-Droid build) bundles a firewall with Tor, DNSCrypt and I2P. It’s powerful and more complex; pick it only if you specifically want Tor routing on a per-app basis.

Make the firewall stick: Always-on VPN

A firewall that isn’t running protects nothing. Turn on Android’s built-in safeguards:

1. Settings → Network & internet → VPN (search Settings for “VPN” if your phone differs).
2. Tap the gear next to NetGuard or RethinkDNS.
3. Turn on Always-on VPN and Block connections without VPN.

Now, if the firewall stops for any reason, apps lose the network instead of silently bypassing it. Also exempt the firewall from battery optimization (App info → Battery → Unrestricted), or aggressive OEM battery savers may kill it.

Your phone’s built-in switches

Even without a firewall, check App info → Mobile data & Wi-Fi (wording varies) for each app: most phones let you turn off Background data per app, which stops mobile-data use while the app isn’t open. Some manufacturer skins go further with per-app Wi-Fi and mobile toggles in their data-usage settings. These are weaker than a firewall (Wi-Fi usually stays open), but they cost nothing.

What to block

Block outright — apps that work offline:

• Gallery, calculator, notes (local), file manager, offline maps once downloaded, voice recorder, keyboard (a keyboard never needs the internet — unless you rely on its cloud dictation)
• Preinstalled OEM apps you couldn’t uninstall: tips, feedback, “device help”, game launchers
• Games you play offline (most ads and analytics stop with them)

Allow on Wi-Fi only — apps that sync big data:

• Photo backup, podcast downloads, app updates

Leave alone — unless you know exactly what you’re doing:

• Phone/dialer, messaging (SMS/MMS), carrier services, Wi-Fi calling components
• Your firewall’s own DNS, the Play Store / Play Services if you depend on push notifications
• Your launcher’s widgets that need data (weather), if you use them

What breaks (and how to tell)

• Push notifications for blocked apps — expected.
• App updates fail for blocked app stores.
• Login or license checks in some paid apps.
• Wi-Fi calling on IPsec carriers (see above).

Debugging tip: open the firewall’s log, reproduce the problem, and look for blocked connections from the app or from a system component it depends on.

Next step

Firewalls and DNS work best together: Private DNS, permissions and settings lockdown →