Allow only certain domains/subnets/port ranges

[dca00]

The application firewall works well and restricts certain apps.
Next step is to further restrict app access to only a certain domain or IP subnet and only over certain port ranges.
I tried to create a subnet rule, but there seems to be no way to enter multiples of the same, for different ports, needless to say for ranges. When I enter one subnet for one port and try to add another port for the same, it overwrites the first.
How is this supposed to work?

[ignoramous]

Next step is to further restrict app access to only a certain domain or IP subnet and only over certain port ranges.

You can "Isolate" apps from Configure -> Apps. For "Isolated" apps, only "trusted" / allowed IPs & domains for that app are allowed to connect.

When I enter one subnet for one port and try to add another port for the same, it overwrites the first. How is this supposed to work?

It shouldn't. Can you provide example of subnet range for which this issue happens? I assume you're trying to add an IP rule from Configure -> Firewall -> IP & Port rules.

What Rethink version are you on? Check the footer of the "About" UI.

[dca00]

If you're comfortable testing, can you see if the May 27 Alpha release fixes it (scroll to "Artifacts" and click on the label that goes rdns-alpha-... which should then download a zip file that contains the Alpha apk)?

I am all for it, but the rdns-alpha... does not seem to be clickable. Tried in Chrome and FF on both the Android and PC.
I can click the squares on the right, and that copies the SHA digest onto the clipboard, but that's about it.

[ignoramous]

Direct link (will expire in ~2mo & only accessible if logged into GitHub): https://github.com/celzero/rethink-app/actions/runs/26542257614/artifacts/7253389416

We'll make Alpha available through our own download servers once we get v055 series done with.

[dca00]

Finally, got my hands on the device and installed the May 27 alpha release. It fixed the issue completely: the rules can be created from the log, and the isolated apps with either IP or domain rules now get access to the respective addresses/ports. This made my day!

[ignoramous]

Thanks for the confirmation. Note that, the latest Alpha is June 27.

I don't recommend using Alphas for regular use. It is only meant for testing new features and/or reporting whether fixes have worked.

[dca00]

Are the changes that I've tested included in any release by now?

Was also testing Conversatons, and it does not seem to be able to talk to the server, as long as its rule includes the port number. The error is "server not found". No idea whether it means it can't resolve the FQDN or it is just a generic error though.
This is not the case for Yaxim or FairEmail, which connect fine when the port is specified.

I also distinctly remember my having blocked all apps first and then allowed only the three mentioned above plus the browser, but now that I am typing this up and checking things, I see that 'Android' is allowed through. This is weird. I re-blocked it and will keep an eye on it.