drive2droad said:

Seems too good to be true & so many complaints on desktop browsers . Lets try this on my MOTO G & see the results .

I've been using AdGuard Blocker and AdGuard VPN both, on mine, and my family's rooted & non-rooted Android devices (3 rooted, and 3 non-rooted) as well as on Windows for more than 2 years and I can attest that the opposite of your statement is true.

FYI: I have no affiliation whatsoever with AdGuard. I speak from my own experience and I highly recommended the AdGuard blocker + AdGuard VPN combo over any other alternatives - it just works and personally, I don't know of any other solution that seamlessly integrates a VPN with a blocker. Moreover, unlike all other popular VPNs, AdGuard is Open Source and the company is not affiliated with any one of the 3 corporations that own and control most other popular VPNs.

Note: AdGuard just released the stable AdGuard v.4.0 for Android as well as AdGuard VPN v.2.3 and, in addition to stability and performance improvements, the new version comes with some notable features for rooted Android devices.

Below is an excerpt from the article published a couple of days ago:

"But now, with root access, you can switch AdGuard to the Automatic proxy mode. Just navigate to Settings → Filtering → Network → Routing mode and switch to Automatic proxy. This action takes local VPN out of the picture and instead configures iptables to accomplish the same goals. And there are several benefits to this change.

Firstly, AdGuard is now able to apply DNS filtering to IPv6 requests, something that was not possible before. Secondly, we've ironed out a few issues that hampered AdGuard from accurately associating web requests with their respective apps. This fine-tuning will enhance the performance of Firewall, Filtering log, and so forth. For those of you with rooted devices, this AdGuard update takes your control and customization to a whole new level!"

@Daria Adguard Team

Could you please specify the recommend low-level settings when default routing mode is changed from Local VPN to Automatic Proxy (root)?

This page merely reviews all available options without providing specific choices. Specifically, what are the recommended choices when fallback upstreams are disabled? Which custom IPv4 / IPv6 addresses should be used under Blocking Rules for hosts rules, or should I use REFUSED/NXDOMAIN?

Thanks!

@nacos

Most important, if fallback is set to "none", your requests will not be resolved if the DNS server specified in the DNS protection module fails to respond for some reason.

For blocking rules, the most common and also my personal choice is NXDOMAIN.

Daria Adguard Team said:

@nacos

Most important, if fallback is set to "none", your requests will not be resolved if the DNS server specified in the DNS protection module fails to respond for some reason.

For blocking rules, the most common and also my personal choice is NXDOMAIN.

Thank you for getting back to me. I did just that, except I chose REFUSE for blocking rules, instead of NXDOMAIN however, I've been struggling to make it stabil. As reported here, AdGuard keeps restarting and in some instances it never starts back up. As soon as I went back to Local VPN, with all other settings kept the same, the problem does go away. Unless there are some other settings (either somewhere in the main app, or under low-level) that negatively impact AdGuard's stability when in Automatic Proxy, this, otherwise tremendous, advantage is pretty much voided. For the time being I went back to Local VPN. Kindly revise this whole configuration with the team and get back to us here, on Xda, as soon as you have some resolutions. My entire configuration was detailed in the GitHub issue report however, I'm more than willing to work with you to help solve this. Thanks and looking forward to your feedback.

Suggestions:

1. There are two possible configurations that MUST be covered for Automatic Proxy mode: (a) stand-alone AdGuard Blocker AND (b) AdGuard VPN integrated with AdGuard Blocker. Since the VPN integration is used by a relatively small number of users (myself included), I have a feeling that AdGuard's technical team conceptualized the whole implementation under the stand-alone assumption. Thus, the incompatibility might just have been internally created, either by the two working together or,
2. by a combination of incompatible settings resulted from the switch: Local VPN to Automatic Proxy.

Daria Adguard Team said:

@nacos

Most important, if fallback is set to "none", your requests will not be resolved if the DNS server specified in the DNS protection module fails to respond for some reason.

For blocking rules, the most common and also my personal choice is NXDOMAIN.

On a second though, I'm not sure how should I interpret your statement. Should fallback be set to "none" or not?
What are the recommended HTTPS filtering rules when using DNS-over-HTTPS? I would think that all HTTPS requests should be redirected through the encrypted DNS however, if you do that, the fallback upstream should be set to "none", correct?

Please refer to the attached screenshot and clarify.

Why is AdGuard whitelisting Appsflyer connections - one of the biggest omni-channel trackers out there?
Can we still trust AdGuard? Screens attached
Whitelisting Appsflyer defeats the whole purpose of the app.

How can I control/edit whitelists?
Any we can supercede these ''Allowlisted'' entries? - bcoz inspite of adding a block entry for Appsflyer, they are still not being blocked. This new UI is confusing. There used to be setting to disable ADG connect/disconnect issues on network changes...where can I find it? How do I implement this on new ADG?

Thanks in advance.

bit.spirit said:

Why is AdGuard whitelisting Appsflyer connections - one of the biggest omni-channel trackers out there?
Can we still trust AdGuard? Screens attached
Whitelisting Appsflyer defeats the whole purpose of the app.

How can I control/edit whitelists?
Any we can supercede these ''Allowlisted'' entries? - bcoz inspite of adding a block entry for Appsflyer, they are still not being blocked.

View attachment 5935615View attachment 5935617View attachment 5935619


This new UI is confusing. There used to be setting to disable ADG connect/disconnect issues on network changes...where can I find it? How do I implement this on new ADG?

Thanks in advance.

Click to expand...

I may be wrong, but based on your 2nd screenshot which shows the DNS response SERVFAIL, it seems to me that appsflyer.com may have been automatically whitelisted as a result of all DNS servers failing to reply to your requests. I would start diagnosing this by disabling the "SERVFAIL failure response" under Low-level settings, then try visiting the same websites and see whether appflyer.com is still whitelisted. You may have inadvertently misconfigured some DNS related settings.

As for ADG connect/disconnect, that's pretty much the reason I started the conversation here - like you, I need some clarifications and directions from ADG's technical team. When I started playing with ADG v.4.0 I thought it was a half baked product however, switching from local VPN to Automatic Proxy (root only) does change the app's blocking algorithms and behavior completely. Automatic proxy is based on iptables which should drastically improve both, the VPN and firewall capabilities however, at the expense of stability, it seems to me. I explained on a thread above what I believe to be the problem and I also submitted a ticket to ADG. I would also hope for Daria Edgard Team to get more involved and provide the much needed support for advanced users. Moreover, I've asked through various venues (XDA, GitHub and ADG support) for someone in ADG's technical team to provide the complete suggested configuration required to safely switch from Local VPN to Automatic proxy (if ready) but I didn't get anything so far.

bit.spirit said:

Why is AdGuard whitelisting Appsflyer connections - one of the biggest omni-channel trackers out there?
Can we still trust AdGuard? Screens attached
Whitelisting Appsflyer defeats the whole purpose of the app.

How can I control/edit whitelists?
Any we can supercede these ''Allowlisted'' entries? - bcoz inspite of adding a block entry for Appsflyer, they are still not being blocked.

View attachment 5935615View attachment 5935617View attachment 5935619


This new UI is confusing. There used to be setting to disable ADG connect/disconnect issues on network changes...where can I find it? How do I implement this on new ADG?

Thanks in advance.

Click to expand...

I tried visiting Appsflyer.com and the connection was blocked by Peter Lowe's blocking rules. No DNS response, neither blocked, or whitelisted - which is normal.

Thanks Nacos - have implemented as instructed. Seems to be the solution as of now.

Whenever I buy a new phone - I debloat it, then install all apps + ADG ( but no signal/network) and put it in observation mode for a few days to catch and block new ad/analytics/tracking/ping URLs which I find in the logs, before I actually start using the phone. And being in the mobile advertising industry, seeing Appsflyer requests passing thru was like a shock to my system, hence the thread.

Was used to the old UI - this new UI and new nomenclatures is very confusing and cant seem to find old functions - especially the connect/disconnect setting during NW changes. The same seem to be happening in this version too - but no way to mitigate it. Some requests are leaking during this NW change.
ADG version - 4.0 nightly 88

Last - still need a way to edit filters and /or supersede filtering rules.
Need more clarity on this ''AllowListed" filter/setting and how to counter it.

All the same, thanks everybody for the help and support.