Rethink: DNS + Firewall + VPN

Rethink, made by Celzero, describes itself as “a multi-hop WireGuard client, an OpenSnitch-inspired firewall and network monitor + a pi-hole-inspired DNS over HTTPS (DoH), Oblivious DoH, DNS over TLS (DoT), DNSCrypt client with blocklists.” It does all of this through Android’s VPN feature, without root. Its FAQ points out that it “isn’t like other VPN apps that relay the entire device’s internet bound traffic”: the VPN runs on the phone, and only your DNS lookups go to the resolver you pick.

What it does

• DNS: by default, encrypted DNS through Rethink’s own resolver (sky.rethinkdns.com), which blocks phishing, malware and similar threats. Dozens of other resolvers are built in, from Cloudflare, Google and Quad9 to DNSCrypt and Oblivious DoH servers, or you can add your own.
• Block lists: “Choose from 195+ blocklists” in three groups (privacy, security and parental control), either applied by Rethink’s DNS service or downloaded to the phone (“around 60MB”) so filtering happens on the device. Nothing is downloaded until you turn this on.
• Firewall: allow or block internet access per app, separately for Wi-Fi and mobile data, plus rules for domains and IP addresses, and logs of what each app connects to. Since v0.5.7 there are also universal allow rules and blocked/allowed statistics grouped by app.
• Proxy and WireGuard: send some or all apps through a SOCKS5 or HTTP proxy or a WireGuard tunnel, several at once if you like, and switch them by Wi-Fi network.
• Modes: DNS only (with a battery-saver variant), firewall only, or DNS and firewall together, the default.

The version hosted here

This is F-Droid’s build, compiled from the source code and signed with F-Droid’s key. The project also publishes Google Play and website versions, signed with its own key, so you can’t switch between them without uninstalling. What differs in this build:

• On-device block lists are available. The Google Play version hides them; the README explains that the Play edition “must be distributable on the PlayStore”, which rules them out.
• No crash reporting. Firebase Crashlytics is limited to the Play build, and F-Droid’s recipe removes it too. Rethink’s privacy page: “The F-Droid flavour of the app is free of any trackers, spyware, ads, or loggers whatsoever.”
• No update check; F-Droid handles updates.
• No paid features. Rethink+, the paid proxy network, shows “coming soon” in this build, and the billing code is replaced by empty stubs. Fetching website icons for the DNS log is also off by default here.

What it connects to

Nothing until you start it: the VPN is off after installing. Once on, your DNS lookups go to the chosen resolver, Rethink’s by default, with one exception since v0.5.8: while Android reports that a network needs a sign-in page, as hotel and airport Wi-Fi often do, lookups go to that network’s own DNS and skip your block lists until the sign-in is done. The switch for this, Use System DNS on captive portals in the DNS settings, is on by default. The privacy page says “Rethink DNS resolvers do not log requests.” Block lists come from Rethink’s download server when you enable them, and checking for block-list updates every few days is an option that is off by default.

The permissions it asks for

Rethink declares 21 permissions. The unusual ones:

• Location, including in the background: only for the Wi-Fi-based switching described in the questions below.
• Camera: the QR code scanner for importing WireGuard configurations.
• Biometrics: an optional lock for the app itself.
• All installed apps: the per-app firewall needs the full list.
• Run at startup: Rethink restarts after a reboot if it was running before.
• Interact across users: a privileged permission Android grants only to apps built into the system, which matters only if a phone maker ships Rethink preinstalled.

About this file

• F-Droid’s build of version v0.5.8, released in October 2026. Its release notes call it a fast-follow to v0.5.7, which redesigned the home screen in September, and report lower power use: “Down from 5% - 10% to 2% to 3% in our tests.”
• The 30.9 MB file is the 64-bit ARM build and needs Android 6.0 or later. Our scan found no trackers.
• The screenshots, from the project’s listing, show an older version of the interface; the first one is a promotional graphic.
• Rethink is licensed under the Apache-2.0.

For blocking ads in particular, see our guide How to block ads on Android without root.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017).

Versions currently kept in the F-Droid repository. We host and check only the newest one. Full changelog.