From Newsgroup: comp.mobile.android

PSA: Optimizing NetGuard given the VPN messes with the local network
& the VPN warns the user about disabling the ad blocking DNS

Long ago, Andy Burns turned me on to NetGuard, so it's all his fault! :)
<https://github.com/M66B/NetGuard/blob/master/ADBLOCKING.md>

On my unrooted Samsung, when I turn NetGuard on, I get two warnings:
1. Turn off Private DNS in Android network settings to use NetGuar...
2. Powering down your device with NetGuard enabled, will auto...

The first warning is apparently complaining about Private DNS:
Android13Samsung:Settings > Connections > More connection settings >
PrivateDNS > Private DNS provider hostname > adblock.dns.mullvad.net

From the source code, the real message (which shows up nowhwere!) is
Turn off Private DNS in Android network settings to use NetGuard
in filtering mode

I think the first warning is NetGuard's generic warning that its
DNS/filtering functionality can't be used while Android Private DNS is
enabled.

Did I add a hosts file to NetGuard?
Nope. So I guess it's a warning for people who did.

Searching the source code, the full second warning is apparently:
"Powering down your device with NetGuard enabled, will automatically
start NetGuard on powering up your device"

I think that second warning is saying if NetGuard is enabled when we shut down/reboot the phone, NetGuard will automatically start again when the
phone powers back up. Well, um. OK. The VPN will go back on.

But, notice the IP address?
It's no longer on the 192.158.1.x subnet.

It's 10.1.10.1 instead.
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: comp.mobile.android

Maria Sophia wrote:

But, notice the IP address?
It's no longer on the 192.158.1.x subnet.

It's 10.1.10.1 instead.

This is all Andy Burns' fault since he turned me on to NetGuard long ago!
(jk)

This last problem was that Wireless Debugging seems to have advertised 10.1.10.1 as it's IP address when it should have been 192.168.1.4 instead.

NetGuard's VPN interfered with Wi-Fi ADB because Wireless Debugging was
using the VPN-side 10.1.10.1 address instead of the phone's LAN address.

What happened was I blocked an app from the Internet using NetGuard.
<https://netguard.me/>
<https://github.com/M66B/NetGuard/releases>

The app is Love's Connect, which is a 10-cent-per-gallon credit on gas.
<https://play.google.com/store/apps/details?id=com.loves.finder>
But I only use the 10-cent/gallon barcode it generates when I'm traveling. Otherwise, I want that Love's Connect app to be dead as a doornail.

The problem is NetGuard changed the IP address from 192.168.1.x to
10.1.10.1 but that IP address made connecting to the Windows desktop adb
over Wi-Fi problematic since the desktop is on the 192.168.1.x subnet.

All my adbconnect scripts expect the phone to be on 192.168.1.x instead.

Q: Is there a solution to that problem?
A: Yes.
Toggle this setting from the default of:
Netguard:Settings > Network options > Subnet routing = off
To:
Netguard:Settings > Network options > Subnet routing = on

Voila!

This preserves routing to the local LAN, allowing Wireless ADB to use the phone's normal 192.168.1.x address. .

adb pair 192.168.1.4:12345 543210
adb connect 192.168.1.4:54321

So now I've overcome those problems which I wanted others to benefit from.

1. The warnings about ad blocking DNS is explained.
2. The warning about the VPN getting turned on after reboot is explained.
3. The solution to get the local IP address back is explained

Now, blocked traffic is routed into the local VPN service, which acts as a sinkhole & the private DNS is still working & the firewall survives reboot.

In summary, Mullvad handles DNS-level filtering, NetGuard kills Love's Connect's network access, and subnet routing keeps the LAN/ADB working.

Whew! This is all Andy's fault! :)
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: comp.mobile.android

Maria Sophia wrote:

In summary, Mullvad handles DNS-level filtering, NetGuard kills Love's Connect's network access, and subnet routing keeps the LAN/ADB working.

But... when I turn NetGuard on, I get an Android System notification of:
"Android System. Network has no internet access.
Private DNS server cannot be accessed."

NetGuard === off
adb > Phone Wi-Fi 192.168.1.4 > router 192.168.1.1 > PC Wi-Fi 192.168.1.2
Phone Wi-Fi 192.168.1.4 > router 192.168.1.1 > Internet > adblock.dns.mullvad.net

NetGuard === on
Termux: curl -v https://adblock.dns.mullvad.net/
DNS + Internet works
Termux: curl -v --connect-timeout 5 https://adblock.dns.mullvad.net:853/
phone can reach Mullvad's DNS-over-TLS endpoint.

adb shell dumpsys connectivity | findstr /i "Private DNS"

Android ConnectivityService: PrivateDnsServerName is Mullvad
and ValidatedPrivateDnsAddresses contains 194.242.2.3 .

NetworkAgentInfo{network{133}
...
VPN CONNECTED
...
VALIDATED
...
UsePrivateDns: true
PrivateDnsServerName: adblock.dns.mullvad.net
ValidatedPrivateDnsAddresses: [194.242.2.3]
}

What this means, I think, is that the networking error was transient.
Android issued a validation failure during NetGuard's startup.

Once NetGuard has settled, the transient connectivity-validation
failure went away.

NetGuard OFF
Phone 192.168.1.4
U
aCC router 192.168.1.1
U
aCC PC 192.168.1.2
aCC Internet
U
aCC adblock.dns.mullvad.net

NetGuard ON
Phone
192.168.1.4
U
aCC physical Wi-Fi/LAN
U
aCC NetGuard VPN
10.1.10.1

Andy, this is all your fault!
:)
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: comp.mobile.android

Drat. Netguard caused the phone to be on 10.1.10.1 again today.
Which kills my Wi-Fi adb debugging connectivity.

Dunno why yet.
NetGuard shouldn't be changing the IP address from the LAN to its VPN.

It worked prior so I still have the subnet routing set to "on". Netguard:Settings > Network options > Subnet routing = on

I also changed this just now, but it made no difference:
Netguard:Settings > Network options > Allow LAN access = on
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: comp.mobile.android

Maria Sophia wrote:

Drat. Netguard caused the phone to be on 10.1.10.1 again today.
Which kills my Wi-Fi adb debugging connectivity.

Since the 10.1.10.1 IP isn't actually used, what works as a workaround is
to turn off NetGuard, connect to Wi-Fi debugging using 192.168.1.x and then turn NetGuard back on, but that seems like a kluge just to get it to work.
--- Synchronet 3.22a-Linux NewsLink 1.2