Ads, trackers and malware, gone
Every DNS lookup on the phone goes through the filter. Domains on your enabled blocklists are answered with NXDOMAIN, so the app asking never gets a connection — no browser extension, no per-app setup.
Android · FreeBeta 0.2.0
Your phone talks to more strangers than you do.
NetSecWall for Android filters every DNS lookup on the device, sinkholes the ad, tracking and malware domains behind them, and shows you which app asked for what — with names, not hostnames.
COMING TO GOOGLE PLAYLink coming soonSee what it does →
Android 7.0 or newer · No root needed. No account, no sign-up. · There is no APK download here — Google Play is the only place to get it, so you always get a signed, current build.
135,000+domains blocked, out of the box
4curated public lists, plus your own
0accounts, trackers or analytics in the app
What it does today
Everything below is in the app you install.
No waiting list, no unlock, no upgrade prompt. The list further down is what is still being built — we keep the two apart on purpose.
Which app asked for what
Every lookup is traced back to the app that made it, by name and icon. The game phoning an ad network at 3am stops being anonymous traffic and starts being a row you can act on.
Live activity and real stats
A streaming log you can search, filter and pause, plus charts for blocked-vs-allowed, requests by hour, your top blocked domains and the apps behind them.
Names, not hostnames
Blocked domains are attributed on-device to the company and category behind them — Advertising, Analytics, Social, Malware — turning a wall of hostnames into something readable.
Where your data went
Per-app mobile and Wi-Fi usage over 24 hours, 7 days or 30 days, ranked, so the app quietly eating your allowance has nowhere to hide.
Yours to configure
Custom blocklists, encrypted DNS over HTTPS, a Quick Settings tile, biometric app lock, block-on-boot, a daily digest, and JSON export/import of your whole setup.
Setting it up
Three taps, then leave it alone.
- 1Install from Google Play
Free, and there is no paid tier hiding behind it. Nothing to buy, nothing to unlock.
- 2Tap Turn on, accept the VPN prompt
Android routes DNS through the app so it can filter — that is what the key icon means. It is a local filter, not a VPN service: your traffic goes nowhere but where it was already going.
- 3Pick your blocklists
StevenBlack is on by default. Turn on more, or add your own list by URL, and the app downloads and refreshes them for you.
The lists it ships with
All public, all maintained by people who are not us. Turn any of them on or off; add your own by URL.
- StevenBlackads + malwareOn by default
- OISD basicbroad, low breakageOptional
- AdGuard DNS filterads + trackersOptional
- URLhauslive malware hostsOptional
Lists refresh in the background on a schedule you set. Turning one off takes effect immediately — no reinstall, no re-download.
Being built Not finished
What the app can't do yet.
All of this is written and in the build, reachable from the Enforcement engine screen — but none of it has cleared testing on real hardware, so we won't tell you it works. If you turn it on, you are trying it, not relying on it.
Per-app Wi-Fi and cellular blocking
Full-tunnel mode routes every packet through the filter and applies per-app rules to real connections, not just DNS. The decision logic is unit-tested; the packet plumbing still needs validation on real hardware.
Root enforcement (netfilter / eBPF)
On a rooted phone, rules can be pushed into the kernel itself so they survive without a VPN slot. Written to the standard AFWall+ and netd patterns — but not yet tested on a real rooted device.
Shizuku mode, no root
Uses Shizuku's ADB-shell privileges to restrict apps on metered and background data without root. The command path is confirmed; the full round-trip needs a Shizuku-enabled device to sign off.
Always-on, locked by device owner
Provisioned as device owner, the firewall becomes an always-on VPN that starts at boot and cannot be switched off from Settings. Verified on an emulator so far.
Privacy
A firewall that phones home is a joke.
So this one doesn't. The only things NetSecWall for Android ever connects to are the blocklists you enable, and the DNS resolver you choose — and you choose both.
Read the privacy policy →- No account. Nothing to sign up for, nothing to sign in to.
- No analytics, no crash reporting, no advertising SDKs — none are in the build.
- Your log, rules and stats are stored on the phone, in an app-private database.
- It talks to nothing of ours. There is no NetSecWall server behind this app.
On the desktop
The Windows app goes considerably further.
NetSecWall for Windows sees every connection by process — host, country, service, live rates — asks before a new app reaches the internet, and blocks at the Windows Firewall for good. That one is a paid product with a 7-day free trial.
Free. No account. No catch.
Android 7.0 or newer · No root needed. No account, no sign-up.
COMING TO GOOGLE PLAYLink coming soon
Questions, or something not working? Open a support ticket — the Android app is supported the same way everything else here is.