critbit VS rethink-app

> Good use-case: routing. Say you have a list of 1 million IPs that are [deny listed].

Apparently, bloom filters make for lousy IP membership checks, read: https://blog.cloudflare.com/when-bloom-filters-dont-bloom/

CritBit Trie [0] and possibly Allotment Routing Table (ART) are better suited for IPs.

[0] https://github.com/agl/critbit

[1] https://web.archive.org/web/20210720162224/https://www.harig...

developer here

I'd imagine the app should work over IPv6-only networks thanks to 464xlat. I may be wrong, because I've never tested it on a IPv6-only network.

The reason for IPv6 is two fold:

1. Firewall today simply stores classless IP address rules as strings in a sqlite table fronted by a lfu cache backed by a typical hash-map. With IPv6, I'd imagine, this won't scale. So, we need a more economical in-memory data-structure (like a crit-bit trie [0] or art tree).

2. Apparently LwIP has problems with HappyEyeballs (I personally never saw it, but got a couple of reports from users about it that it was an unrecoverable error once the connectivity was lost, and the firewall had to be restarted). We're in the process of replacing LwIP with gvisor/netstack now [2], just to get IPv6 support back on track.

[0] https://github.com/agl/critbit

[1] http://www.hariguchi.org/art/art.pdf

[2] https://github.com/celzero/firestack/issues/3

We are aware of connectivity issues with WireGuard (ref) that we've fixed in yet-to-release version v055b. Please wait until that's out (2 days? 3?) (:

Noted. Thanks.

Also, crafting nice UI isn't our strong suit. One look at our github issue tracker (ex) and you'd know. We try our best, though (:

sky is a stub resolver, which after stripping out all request information, forwards the dns query to both Cloudflare and Google DoH servers (code), and replies from which ever responds back the fastest. Both the client app and the resolver (server) are open source, so if you find any leaks and know what's up, we're open to changes.

Could, but it'd clutter the Settings screen? Probably, Rethink could let expert users enter arbitrary IP subnets to exclude / not route? This setting will be a footgun, though! Regardless, I've noted it: https://github.com/celzero/rethink-app/issues/899

I believe it is a bug with okhttp, a library we use internally for blocklist updates: https://github.com/celzero/rethink-app/issues/875

NetGuard can block tracker and ad (albeit very basic), so you can use it on its own without Blokada. Or you can use the AdGuard app instead which has both firewall and (complete) adblocking feature. If you prefer open source app then check Rethink https://github.com/celzero/rethink-app

First one is Rethink DNS: https://github.com/celzero/rethink-app to manage and block domains when apps connecting to internet (similar to Blokada, Adguard...). Here that calculator app connects to googletagmanager after installing and opening.

In v054b, we're planning to switch back to the old behaviour -- of domain names blocked during DNS name resolution instead of (translating it to IP rules) at TCP / UDP connection time -- if the user has not set any per-app domain name rules and if the user is not using Bypass DNS and Firewall setting for any app: https://github.com/celzero/rethink-app/issues/817