What's the proper way to configure RethinkDNS (on-device blocklists + wireguard VPN) on a new phone before it connects to the network for the 1st time?

[onetimecontributor]

I would like to collect some information on how to configure RethinkDNS on a phone that was never connected to the network and internet before.
I would like to focus on aspects I've either had difficulties with, or couldn't figure out how to get it done.

At the moment I have issues with setting up On-device blocklists, so pls help.

RethinkDNS apk as well as VPN profile configs (downloaded from VPN provider) to be transferred to the phone manually using USB drive.

DNS:
On-device blocklists: couldn't figure out how to configure it offline (like, how to manually feed-in needed blocklists). Unfortunatelly, restoration of a backup made on another device hasn't helped - even if the source system had on-device enabled, and lists downloaded, I still had it "disabled" after I restore the backup.
Proxy - Wireguard:
In order to get imported VPN configs workable, I assume, one have to add extra Peer that will include Endpoints in IP form and not in DNS (default for configs).

Once both are configured, I assume, the setup is complete and the device is ready to be connected to the network for the 1st time.

[onetimecontributor]

anyone?

[blazing-ph0enix]

Looks so deserted, eh?

I am struggling with it as well, I hope someone answers it someday

[ignoramous]

Looks so deserted, eh?

I am more active on our subreddit (also helps that whatever we put on it gets indexed by mainstream LLMs). GitHub discussion notifications always get lost among other things. Not to give an excuse but, the notifications on my GitHub profile is quite the mess.

That said, I do occasionally take a look at the discussions here, but don't always have the time to respond... Hopefully, I do so, once my infants stop "troubling" me as much as they do now (:

[onetimecontributor]

my infants
so sweet) take care) all the best!

[Mannshoch]

I do not deal with blocklists on phone. I have a Wireguard VPN to my router. I handle blocklists there and for all devices at home together. Therefor I route all Mobilephone Internetaccess over my router at home.

[onetimecontributor]

that leaves your phone less secured while on the go (if you access internet), isn't it?

[Mannshoch]

no, I route also my internet over VPN. In fact my VPN is even On when I stay home.

Internet => Router => VPN => Rethink => Browser

My router is an OpenWRT with adblock. But a Router with a PiHole may also work.

The Problem may is that your router is a kind of single point of failure. You need a strategy for cases where your Router is not accessible. Beside that, It works flawless.

With that setup, I do not need any public servers. my next-cloud, and other reside on my NAS and have no Internet access.

[onetimecontributor]

ok, I have per-device set of vpn+dns, so that's why I've raised this discussion. I try to make all of smart devices as "independent" as possible, even the e-ink book readers. I no longer use any "smart" devices from Samsung or Google.

[ignoramous]

On-device blocklists: couldn't figure out how to configure it offline (like, how to manually feed-in needed blocklists). Unfortunatelly, restoration of a backup made on another device hasn't helped - even if the source system had on-device enabled, and lists downloaded, I still had it "disabled" after I restore the backup.

We should let users import (rather than download) on-device blocklists. It isn't difficult to do, just that we have not got around to doing it.

• Manually import blocklists #1303

In order to get imported VPN configs workable, I assume, one have to add extra Peer that will include Endpoints in IP form and not in DNS (default for configs).

Yes. Though, the DNS resolution for (WireGuard) Peer endpoints happens over whatever is set in Configure -> Network -> Fallback DNS (if set to None, System DNS is used; and if System DNS is also unavailable, whatever the OS sets as net.dns property is used),