Whitepaper
How Firewall is built and tested
Why Firewall is built the way it is, what sets it apart, how it was tested and where its limits are. Facts as of 1 November 2026, Firewall 1.33.
Why it is good
Your apps look up names all day
Their own servers, ad networks and analytics. Firewall sees each of those lookups and decides, app by app, which apps go online and which trackers they reach, on an Android phone with no root and without carrying what you do.
No root
A local VPN that exists only on the phone. Android asks you once before it starts.
Names, not traffic
The tunnel claims one small reserved range of addresses. Your photos, video and downloads never enter the app and leave the phone at full speed, so nothing keeps the processor awake.
Your call, app by app
Each app is Not filtered, Filtered or Blocked. A change applies to its very next lookup, with nothing to restart.
Safe from the first tap
A new install starts with apps Filtered and tracker blocking and encrypted lookups on, so turning it on does not cut your apps off. An update never changes what you had set.
Free, with an optional Pro
Pro is one payment on Google Play, not a subscription. Everyone who used the app before Pro existed has Pro for free.
Your data stays yours
Rules and activity are kept on the device. The app goes online only to pass lookups on and to download the tracker lists you add.
- No ads
- No tracking
- No analytics
- No crash reports
- No error reports
- No account
- No AI
Every permission, and why it is there, is in the privacy policy.
Why it is great
One name at a time, not one switch per app
A switch per app for Wi-Fi and mobile data, as Firewall itself had before 1.11, says nothing about which sites an app reaches. Firewall works one name at a time instead.
A blocked domain is gone in every app
Including the apps you allowed. A rule covers the domain and everything under it, and the more specific rule wins, so you can block a domain and allow one name inside it.
Lookups that try to skip it are caught
Apps that reach for public resolvers directly are answered by the firewall, over IPv4 and IPv6. When Android's Private DNS names a provider, Activity says so and offers a fix.
Watch before you block
Watch only, in Pro, lets every lookup through and logs which rule would have stopped it, so you can see what an app talks to and what would break. Your rules stay untouched.
Who each app talks to
App insights name around 45 tracker companies an app reached in the last week. An app's own maker is never counted against it.
Honest about weight
Before you add a big tracker list, a card shows the names it adds, the memory it takes and how long it loads. Past 500,000 names it asks first.
Phone, tablet and TV
One app for all three. Since 1.33 every screen works with a TV remote, on Android TV and Google TV.
How it was tested
What was checked, and how
Most of the work below happened between 27 October and 1 November 2026, from version 1.24 to 1.33, on Android emulators: a phone at 1080 by 2220, a tablet, and Google TV at 1080p and 4K.
- 25unit tests in 4 suites
- 1.1 sto load 655,125 tracker names, was 6.3 s
- 109 MBapp memory on Apps with 244 apps, was 163 MB
- 7:1text contrast or more, in every look
Checks in the code
The unit tests run on the computer. A script measures every colour pair in every look: words need 7:1, marks 3:1. Android lint reported no errors for 1.30.
| Area | Tests | What they check |
|---|---|---|
| The packet code | 9 | They read IPv4 and IPv6 packets, check the checksums of the answers and resets the firewall writes, and make sure the DNS reader refuses anything that is not a plain query. |
| Tracker companies | 7 | They match a name and everything under it to its tracker company but never a lookalike, never count an app's own maker against it, and count each company once across apps. |
| Wildcard rules | 5 | They check how a rule with a star such as ads.* is read and matched, with dots taken as dots. |
| Tracker list reader | 4 | They read hosts, plain and adblock lists and take only web links for your own lists, and one makes sure the faster reader agrees with the old one on every line. |
Checks on the emulators
Blocking, end to end
The shell set to Filtered, then a lookup of a name nobody had looked up yet: a blocked name answers in the sinkhole range 198.18.0.0/15, an allowed one with its real address. The same check under Watch only gives the real address.
Updates
A 1.25 install with the Strict preset applied, then 1.26 installed over it: the rules and the old log rows survived the database upgrade. An install over a running firewall checks that the tunnel comes back.
Restart before unlock
A PIN set on the emulator, then a reboot: the firewall waits for the first unlock instead of reading storage that is still locked.
Large text and TalkBack
The main screens at 200% text on a 360 dp wide phone, and the labels TalkBack reads.
Tablet and TV
Settings in two columns on a 1280 dp tablet. On the Google TV emulator: the first run, the VPN consent and every screen with the remote, at 1080p and 4K.
Stress
A monkey run of random taps, and the presets on a fresh install with 243 apps.
Speed and memory
Each pair was measured before and after the change that fixed it.
| Measure | Before | After |
|---|---|---|
| Loading every tracker list, 655,125 names | 6.3 s | 1.1 s |
| Heap peak for that load | 139 MB | 75 MB |
| App memory on Apps, 244 apps | 163 MB | 109 MB |
| Slowest tenth of scroll frames | 23 ms | 17 ms |
Bugs found and fixed
: Screens stacked up
A monkey run stacked 16 copies of the main screen, 393 MB, when notifications opened it. A tap now brings back the one screen.
: Protected, with no tunnel
After an update Android can forget which app owns the VPN, and the app said Protected with nothing running. It now asks Android again and turns itself off if the tunnel still fails.
: A slow tracker list load
Loading every community list took 6.3 seconds and 139 MB. A hand written reader made it 1.1 seconds and 75 MB.
: Strict blocked every app
On a fresh install, switching new apps to Blocked blocked all 243 apps that had no rule yet. Strict now gives every installed app its own rule first.
: TalkBack said it twice
The help button read "What does What these three mean mean?". It now reads "Explain", then the question.
: Any app could turn the firewall off
The widget's switch went through a broadcast other apps could send. It now goes to a private receiver, and two permissions the app never used were removed.
: Block connections without VPN cut the phone off
With that Android setting on, no app could go online, because this tunnel only carries lookups. Activity now says so and opens the VPN settings.
: A crash on Android 7
Moving an app's mode called a method Android 7 does not have. Lint found it with three other errors, all fixed.
: Gaps in the tunnel
A rebuild left a moment with no tunnel, a stop during a rebuild could leave one nobody read, and lookups sent over IPv6 straight to public resolvers walked past the firewall. All three are fixed.
: Work in the background
A two second tick read the database all day while the screen was off. It runs only while you look at it.
: Big text cut things off
At 200% text labels broke one letter a line and the log had no room, and the Pro sheet pushed Get Pro off a 392 dp phone even at normal text. Both now stack and scroll.
What it does not do
Limits, said plainly
Names only
It decides on the names your apps look up. It cannot see an app that connects straight to an address without looking a name up, or one set to Not filtered.
Apps with their own encrypted lookups
They take those lookups away from the firewall, and a firewall without root cannot change that.
Connections already open
An app that is already running can keep connections it opened before a change. Close it fully and open it again.
One VPN at a time
Android runs one VPN at a time, so Firewall stops while another VPN runs.
Tracker lists made by others
Their own authors make them, so they can miss a tracker or block a name an app needs. An allow rule undoes a wrong block.
Questions about this page? Write to marko@zanoski.com.