Integration with other VPNService apps

[emanuele-f]

In #379 came out the discussion about features which are currently spread across different firewall/network monitor apps. Since such apps often do not communicate (e.g. it's currently not possible to use both PCAPdroid and RethinkDNS at the same time), it's impossible for users to use them at the same time (because of the one VPNService limitation of Android).

This is meant to be an open discussion, allowing users expressing their needs and developers their point of view. To focus the objective, it will be useful to list which features PCAPdroid/other apps can provide to complement other apps/PCAPdroid functions.

• A solution that users can already use is work profiles and EveryProxy, as explained in Add port forwarding #274 (comment) . However, this is not very convenient
• An initial proposal for integration was provided in Add port forwarding #274 (comment) (read more on that task for more insights), to implement a new mode in PCAPdroid to expose a SOCKS5 server interface which other apps like RethinkDNS can use. That would be similar to the VPN-mode (e.g. it can block the traffic) but instead of reading/writing the packets from the VPNService fd, it would read/write them from the SOCKS5 server sockets. From a first analysis, this seems quite complex to implement. NOTE: this does not provide PCAPdroid the ability to use Wireguard/DNS over TLS, because PCAPdroid would be the last element in the chain. Instead, for this to work, RethinkDNS should provide the SOCKS5 server interface

Features that could complement PCAPdroid:

• DNS over HTTPS: Implement DNS-over-TLS client #211 (provided by InviZible, RethinkDNS, dnscrypt-proxy/android) . Update: it's now possible to integrate with InviZible Pro, see https://emanuele-f.github.io/PCAPdroid/advanced_features#42-doh-support
• Connect to Tor (provided by InviZible, Orbot, integrated in RethinkDNS), Update: See https://emanuele-f.github.io/PCAPdroid/advanced_features#47-tor for integration instructions
• Connect to Wireguard (provided by Wireguard, integrated in RethinkDNS) - see Wireguard integration #397
• Connect to OpenVPN (provided by ics-openvpn)

[anpic]

Thanks for understanding :)

Since such apps often do not communicate

There is also a variant to participate in proxy chains and work in local proxy server mode. Although independent features doesn't interfere with this :)

This is meant to be an open discussion, allowing users expressing their needs and developers their point of view. To focus the objective, it will be useful to list which features PCAPdroid/other apps can provide to complement other apps/PCAPdroid functions.

So we can discuss features here not only in the context of VpnService?

DNS over TLS

It seems to me that the implementation of DnsCrypt (https://github.com/DNSCrypt/dnscrypt-proxy, https://github.com/quindecim/dnscrypt-proxy-android) can be no less useful ;)

Connect to Wireguard (provided by Wireguard, integrated in RethinkDNS)

Wireguard is already implemented in Rethink, so it would be more interesting to think about integration with OpenVPN (https://github.com/lawtancool/ics-openvpn-xor, https://github.com/IngoZenz/ics-openvpn, https://github.com/schwabe/ics-openvpn) ;)

However, to provide a nice user experience, it's better to think like a dumb user than a tech savvy

We can discuss about that. But you've already come up with a working version yourself but you don't want to admit it in any way ;)
Let there be the simplest UI features for some users. But for smart users create a powerful system based on intents. When all functions can be controlled through intents. And even for those for whom you don't want to make UI elements ;)
It doesn't require any changes in UI. But it will attract the maximum number of users :)

[emanuele-f]

There is also a variant to participate in proxy chains and work in local proxy server mode. Although independent features doesn't interfere with this :)

You mean to expose the SOCKS5 server interface, or is this something different? If so, do you have references for this other integration method?

So we can discuss features here not only in the context of VpnService?

Yes. The objective is to discuss ways to remove barriers to let the users access all the features that they need, regardless of the app, either via inter-app communication or by direct integration

It seems to me that the implementation of DnsCrypt (https://github.com/DNSCrypt/dnscrypt-proxy, https://github.com/quindecim/dnscrypt-proxy-android) can be no less useful ;)
Wireguard is already implemented in Rethink, so it would be more interesting to think about integration with OpenVPN (https://github.com/lawtancool/ics-openvpn-xor, https://github.com/IngoZenz/ics-openvpn, https://github.com/schwabe/ics-openvpn) ;)

Thanks for pointing to them, added to the description above

When all functions can be controlled through intents

The Intent API is meant to allow third-party apps to interface with PCAPdroid, mainly for traffic dump purposes. It's not meant to replace the UI, so making everything configurable via it does not make sense to me

[anpic]

You mean to expose the SOCKS5 server interface

yeah

mainly for traffic dump purposes

This doesn't mean that the purposes aren't extensible :)

It's not meant to replace the UI

It's not only about replacing, it's about being a basic variant. Especially if the developer can't spend time developing ;)

so making everything configurable via it does not make sense to me

Well, then how do you think to automate the work with android apps? Including PCAPdroid
Android Intents are a universal and the only correct means for this.
The userspace system is based on intents, and any really smart android project should be able to use their power and versatility.

[emanuele-f]

Without a real use-case, this would only take development time and increase code complexity

[anpic]

this would only take development time and increase code complexity

You can say that about anything at all :)
Let's not develop anything else at all, because this would only take time and increase code complexity :))
It seemed to me that this topic appeared specifically so that it would be impossible to use this argument here ;)
It's clear that you're alone, and you don't owe anyone anything.
But this topic seems to be for user suggestions, and not for monosyllabic attempts to convince everyone that no one needs a full-fledged firewall.
You don't have any serious technical arguments against intents. Only a lack of time and desire ;)

[anpic]

Yes. The objective is to discuss ways to remove barriers to let the users access all the features that they need, regardless of the app, either via inter-app communication or by direct integration

Okay, then I'll continue for future generations of developers ;)
I will gradually compare the missing features with the current android firewalls.
Let AFWall (https://github.com/ukanth/afwall) be the first.

• apps can be viewed, searched, sorted and log viewed by UIDs

pics

• multiple profiles to quickly change the set of connection rules

pics

• filtering connections by network interface

pics

• the ability to hide app icons to speed up the loading of the app list

pics

• protection against arbitrary access and uninstalling

pics

• backup and restore all settings

pics

[anpic]

Fiwalld non-root firewall (https://play.google.com/store/apps/details?id=com.lazybean.vfiwalld)
DoH Guard (https://play.google.com/store/apps/details?id=com.lazybean.doh)

• per app and ip:port settings

pics

• per country settings and statistics

pics

• summary statistics

pics

• choosing DNS servers

pics

[anpic]

VProxid (https://play.google.com/store/apps/details?id=com.lazybean.vpnperapp)
RProxid (https://play.google.com/store/apps/details?id=com.lazybean.socksperapp)

• per app proxification with json import and export

pics

[anpic]

NoRoot Firewall (https://play.google.com/store/apps/details?id=app.greyshirts.firewall)

• per app and [ip|domain]:port settings

pics

• per app log

pics

• globbing

pics

• full backup and restore in json

pics

[anpic]

NetPatch Firewall (https://github.com/netpatch/firewall)

• per app rules

pics

• domain and ip groups

pics

• per app statistics

pics

• Shadowsocks proxy

pics

• DNS through proxy, leak prevention, cache time

pics

• globbing

pics

• backup and restore all settings