Allow use of default network DNS

[BayLee4]

Hi,
As fas as I know, there is currently no option not to use a custom DNS. It would be great to be able to use the default network DNS, as it complements very well the on-device blocklist feature and give users more control over their setup. Thanks for the great app.

[ignoramous]

Thanks. The Firewall mode would make the VPN use network / os-provided DNS.

I can also see why one'd want to use it even in DNS mode. Shouldn't be too hard to add this, it is only a matter of how do we expose it as a UI setting to the user. May be in a drop-down in the Configure page of the DNS screen as the fourth option (below the first three: DNS over HTTPS, DNSCrypt, DNS Proxy) / as an option within in DNS Proxy screen itself.

[BayLee4]

Thank you !

Not directly related to the issue, so excuse me if this is not the right place to ask, but does the project accept donation (via Paypal for instance) ? I saw on the website that there should be a paid support coming this month, and I probably won't use it but I still want to support the project.

[ignoramous]

We do not accept donations right now (not sure if we ever will). Paid plans are planned for end of this month (may be, it spills over to the next).

[BayLee4]

Oh too bad, is there any specific reason not to ? I mean there's quite a lot of options : Github Sponsor, Paypal, Bitcoin, Monero, each of them having their strength and weakness. Anyway, if by chance you change your mind, I'll happily donate to the project.

[ignoramous]

Donations are known to not sustain FOSS projects. Even the most popular ones barely get a trickle. RethinkDNS + Firewall is a full-time effort, and it is likely donations will never get close to footing the bills of involved engineers. And so, we would like to be able to sell the software and services around it rather than fallback on donations. Given our plans to commercialize this FOSS project, it is also a bit disingenuous to solicit sponsorships in form of donations, I feel.

If the product falters and for one reason or the other, the engineers could not work on it full-time, then it might make sense for whoever takes over the project's maintenance to revisit accepting donations.

Thanks for your support, btw. Appreciate it.

[BayLee4]

This is very understandable. My only concern about using the paid plan was that, depending on the implementation, it could lead to a weakened privacy if storing uniquely identifying information such as licence key or email. After seeing a particular thread, it looks like you take such issue seriously, and that the actual implementation will likely not have that weakness. But I'll really need more detail on the implementation to feel 100% comfortable, on how it effectively does not 'track' users in any way. This is especially true as I'm not sure I'll use any of the features included in the paid plan, so I really don't want to take any 'risk'.

This is also why I was asking if there was a donation option in supplement, as this way I'm sure it would not be linked to the application on my phone, and thus could be used to identify me. But if opting for the paid support is done in such way that it does not leak any information compared to the freemium plan, then a donation option effectively makes little sense and I would happily take the paid plan instead.

Voila, you now have the full reason behind my request for a donation option, hope it does not sound too 'paranoid' :')

[ignoramous]

A user says,

I use VOXI in the UK (www.voxi.co.uk) and get free data on certain websites. I've been told by their support team I need to use their DNS for this feature to work

Also see: blokadaorg/blokada#822

[ignoramous]

Support for this in the network engine (firestack) is a go: celzero/firestack@21ec40e

[ignoramous]

@hussainmohd-a Lets add a new DNS entry in DNS Proxy that always points to Active network's DNS server. When this feature is enabled, we'd need to disable Use all available networks feature (because then, there are more than one "underlying" network that apps can bind to whereas we could possibly only proxy one DNS endpoint due to limitation in the way Android works).

[hussainmohd-a]

Noted

[ghost]

It'd be excellent to be able to use ISP provided DNS and still be able to use tracking feature from this app.

By adding forth option:

1. DNS over HTTPS,
2. DNSCrypt,
3. DNS Proxy,
4. No DNS or ISP provided DNS

Could it be possible? Is there a place for that on roadmap ?

[ignoramous]

Yes, this is do-able, and we will implement this by end of this month / next (Oct).

[ignoramous]

Read: tailscale/tailscale#2116 (comment)

[ignoramous]

Impl done in #380 and celzero/firestack@775d8f0

Releasing in v053i.