On-device firewall¶

An on-device firewall controls which apps reach the network and which destinations they can reach. On Android this is done without root by an app that occupies the VPN slot, which also means it cannot run alongside a VPN app.

What it changes¶

• An app with no reason to be online, a torch, a scanner, a game, can be cut off entirely, which removes the route madware uses to report back.

• Traffic to known tracker and advertising domains can be blocked with a hosts file, which reduces what ordinary apps send about a device and its location.

• Some of these apps log connections as they go, which shows what an app talks to and is sometimes the first sign that something installed months ago is still calling home.

What it does not reach¶

• It does not hide the device’s IP address, so anything derived from that address, including a rough location, is unaffected.

• It filters on exact domain names, so a tracker that shifts between subdomains slips past.

• An app that routes requests through its own servers is unaffected, which is the path a weather app already uses for the coordinates it collects.

• It changes nothing about what an app is permitted to collect. That is a permissions question, and auditing app permissions is where it gets answered.

• Protection starts when the app does. Traffic during early boot, before it is running, is not covered.

Anything found this way is a starting point rather than a verdict: an app talking to an unfamiliar domain may be doing its job. Where the concern is a device that someone else has had access to, the stalkerware and spyware pages describe what that looks like instead.

Setup and the comparison between tools, NetGuard, RethinkDNS, TrackerControl, Blokada and AdGuard, sit in the privacy greenhouse’s switching off beats blocking playbook, which also puts a blocker in its place: fourth, after the permissions and the identifier.

Last updated: 13 August 2026