NetGuard
by Marcel Bokhorst (M66B) · GPL-3.0-only · open source
Decide which apps may go online, separately for Wi-Fi and mobile data, without rooting your phone. Blocked traffic is dropped by a local VPN on the device.
Needs:No root · Android 6.0+
2113 Apps is independent, not affiliated with or endorsed by Marcel Bokhorst (M66B). Official sources: netguard.me · source code on GitHub.
- Version
- 2.337
- Size
- 3.2 MB
- Requires
- Android 6.0+
- Updated
- 2026-08-02
Screenshots
Introduction
NetGuard is a firewall you can run without root. Its developer calls it the first free and open-source no-root firewall for Android. You choose, app by app, whether it may use Wi-Fi or mobile data, and NetGuard routes blocked traffic into a local VPN that simply drops it. Nothing is sent to an outside VPN server.
What it can do
- Block apps per network type, and optionally allow an app only while the screen is on, or block it while roaming. System apps can be blocked too.
- In builds from GitHub, such as this one: block ads with a hosts file, and port forwarding. Google doesn’t allow ad-blocking apps on Play, so the Play version can’t do either.
- Pro features: logging outgoing traffic and exporting it as PCAP, rules for individual addresses per app, notifications when a new app is installed, a network speed graph and extra themes. For GitHub and F-Droid builds, the developer’s site explains how to unlock them with a donation.
Limits
From the FAQ and README:
- Android allows only one VPN app at a time. NetGuard can pass traffic on to another app through a SOCKS5 proxy, but it can’t run next to another VPN.
- It doesn’t encrypt your traffic or hide your IP address; that isn’t what it’s for.
- It offers no protection during early boot, and isn’t supported in work profiles, Samsung’s Secure Folder or dual apps.
- To show which organisations IP addresses belong to, it looks them up online. You can turn that off.
About this file
This is the developer’s own GitHub release, delivered through IzzyOnDroid. Its signing certificate matches the fingerprint the developer publishes in the README, which matters here: the README warns that an app in the Samsung Galaxy Store uses NetGuard’s package name and is probably malicious. The GitHub build checks GitHub for updates twice a day unless you switch that off. IzzyOnDroid flags it because it contains Google’s billing library and can contact Google’s servers for billing; our scan found no tracking SDKs. F-Droid’s build of NetGuard is signed differently, so the two don’t update each other.
What’s inside the APK
Trackers
No code matching the Exodus Privacy tracker signatures.
Native code
Runs on 64-bit and older 32-bit ARM phones.
Android versions
Built for Android 16 (target API 36).
Permissions
2 of them need your approval first.
Flagged by IzzyOnDroid:
- NonFreeComp: Contains non-free components or libraries.
- NonFreeNet: Relies on or promotes a proprietary network service.
CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).
Asks you first (2)
Android shows a prompt before the app can use these.
- Show notifications (Android 13+) · POST_NOTIFICATIONS
- Read phone status and identity · READ_PHONE_STATE
Granted at install (9)
Low-risk permissions Android grants automatically, plus any we have not classified.
- ACCESS_NETWORK_STATE
- ACCESS_WIFI_STATE
- FOREGROUND_SERVICE
- FOREGROUND_SERVICE_SPECIAL_USE
- INTERNET
- QUERY_ALL_PACKAGES
- RECEIVE_BOOT_COMPLETED
- VIBRATE
- WAKE_LOCK
Defined by other apps (3)
Permissions that belong to another app or to this app itself.
- com.android.vending.BILLING
- eu.faircode.netguard.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
- eu.faircode.netguard.permission.ADMIN
More Information
- Package name
- eu.faircode.netguard
- Version
- 2.337 (build 2026080101)
- File size
- 3.2 MB (3,222,200 bytes)
- Requires
- Android 6.0 or later
- Category
- Network & Privacy
- License
- GPL-3.0-only
- Developer
- Marcel Bokhorst (M66B)
- Source code
- github.com/M66B/NetGuard
- Released
- Aug 2, 2026
- Signer SHA-256
- e4a260a2dce7b7af23ee919c489e15fd0102b93f9e7c9d82b09c0b395000e4d4
- File SHA-256
- 150a0362f04408c2d3cc7fb38d7e126445019d523489c8d82df6fb456c4e6ad2
- Checked
- , against the IzzyOnDroid index · how we check · verify it yourself
Common questions
Is this APK the official NetGuard release?
Yes. It is the developer’s own release of NetGuard 2.337, byte for byte as IzzyOnDroid distributes it. Its SHA-256 matches IzzyOnDroid’s signed index, and it is signed with the certificate IzzyOnDroid records for the app (SHA-256 e4a260a2dce7b7af23ee919c489e15fd0102b93f9e7c9d82b09c0b395000e4d4).
What Android version does NetGuard need?
Android 6.0 or later (API level 23). Version 2.337 is built for Android 16 (target API 36). Runs on 64-bit and older 32-bit ARM phones.
Can NetGuard access the internet?
Yes. The APK requests Android’s internet permission. In total it declares 14 permissions, and 2 of them need your approval first.
Does NetGuard contain trackers?
No known trackers: our scan of version 2.337 found no code matching the Exodus Privacy tracker signatures. The scan covers known tracker libraries; it doesn’t show what data the app itself sends.
Is NetGuard open source?
Yes. NetGuard is released under the GPL-3.0-only licence, and its source code is published at https://github.com/M66B/NetGuard.
Recent releases
| Version | Released | Size | Requires |
|---|---|---|---|
| v2.337 · this download | Aug 2, 2026 | 3.2 MB | Android 6.0+ |
| v2.336 | Jul 31, 2026 | 3.2 MB | Android 6.0+ |
| v2.335 | May 23, 2026 | 3.2 MB | Android 5.1+ |
Versions currently kept in the IzzyOnDroid repository. We host and check only the newest one. Full changelog.
Alternatives and related apps
-
FireWall Blocks Another per-app firewall, which can apply its rules through Shizuku instead of the VPN slot.Download -
AdAway Blocks ads system-wide, through the hosts file with root or a local VPN without it.Download