NetGuard

What Is NetGuard?

You install an app, it phones home. A lot. Some of that traffic is legitimate (updates, sync), but plenty of it is analytics, ad networks, and “background noise” you never asked for. Android still doesn’t offer a simple, reliable way to deny internet access per app across all devices — especially without root.

NetGuard is the blunt instrument for that problem: per-app network control, without rooting your phone. It works by using Android’s built-in VPN service locally (on your device) to intercept traffic and apply rules, which is essentially the only viable approach for a no-root firewall on Android.

The distinctive bit is what NetGuard chooses not to be. It’s not a “VPN service” that sends your traffic through someone else’s servers, and it’s not primarily an ad-blocking product. At its core, it’s a firewall: block/allow connections per app, optionally with logging and traffic filtering features layered on top. (github.com)

NetGuard Features and Performance

NetGuard’s baseline capability is per-application internet access control. The project’s own description is concise: “A simple way to block access to the internet per app.” (github.com) That focus matters because it shapes everything else: rules are about which apps can talk to the network, rather than trying to be a full DNS resolver, a VPN provider, or a malware scanner.

How it works (and what that implies)

NetGuard relies on Android’s VPN service to route traffic locally through the app so it can enforce firewall rules without root. This is repeatedly documented in NetGuard’s own materials (and is the standard approach for no-root firewalls). The consequence is unavoidable: Android typically allows only one VPN-style service active at a time. If you’re already using a real VPN provider app, you’ll be choosing between that VPN tunnel and NetGuard’s local-VPN-based firewall (unless you move to a root firewall or a different architecture entirely).

Traffic filtering and ad blocking (realistic scope)

NetGuard can do domain-based blocking using hosts-file style lists, but with important constraints:

• Ad blocking is not available in the Google Play build due to Google Play policies, per NetGuard’s own ad-blocking documentation. (github.com) If you want hosts-file blocking, you’re pushed toward the GitHub build (and many users use F-Droid builds as well).
• Its ad blocking is hosts-file/domain based, and what gets blocked depends on the hosts file you import or download. NetGuard’s docs state it downloads the StevenBlack hosts file by default. (github.com)
• It can’t block everything. For example, NetGuard’s own docs note that YouTube ads are not domain-based and therefore can’t be blocked by NetGuard’s domain-blocking approach. (github.com)
• If an app or browser uses DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT), NetGuard may not be able to “see” DNS requests as DNS in a way that enables domain-based blocking, because the DNS is encrypted inside regular connections. NetGuard’s documentation explicitly calls this out and recommends disabling these features if you’re relying on domain blocking. (github.com)

That adds up to a simple truth: NetGuard’s “ad blocking” can be useful, but it’s not in the same category as a dedicated content blocker with per-app filtering engines, cosmetic filtering, and browser integration. It’s closer to “block known ad/tracker domains at the network layer,” with all the normal trade-offs of that strategy.

Logging and diagnostics

NetGuard’s site highlights “detailed global traffic log” and “detailed app traffic log,” plus “access / speed notifications.” (netguard.me) In practice, this can be one of NetGuard’s most valuable features: you can see which apps are attempting connections and then decide whether you want to cut them off.

Compatibility and known platform limitations

Because the app depends on Android’s VPN service behaving correctly, NetGuard’s own project documentation calls out specific unsupported environments. For example, the GitHub repo notes it is not supported for apps installed in work profiles / secure folders / second-instance features (Samsung Secure Folder, MIUI dual apps, etc.) because the Android VPN service “too often does not work correctly” in those contexts. It also notes lack of support for wired connections like ethernet/USB because the Android VPN service often doesn’t work properly there.

Performance expectations (no hype)

NetGuard is a local VPN-based firewall, so it introduces an extra hop inside your device: traffic is routed through the VPN service and evaluated against rules. The project materials don’t make hard speed promises, and you shouldn’t expect “speed boosts.” What you can expect is that enabling filtering/logging features and running traffic through a local VPN service can add overhead versus doing nothing — and that’s simply the cost of inspection and control. (If you need hard throughput numbers, you’ll have to benchmark on your specific device and Android version.)

Pricing and Plans

Your database lists NetGuard as freemium, and that matches what the project’s own materials describe in practice: core firewall functionality is available without paying, while “pro features” are unlocked via payment/donation paths.

There are two real-world payment tracks documented:

1. One-time donation model (GitHub / F-Droid builds): The official NetGuard site states you can get “all current and future NetGuard pro features (including updates) … for the GitHub or F-Droid version by a one time donation of € 0.10 or more.” It also states that donating €7 or more allows activation on all Android devices you personally own; donating less allows a one-time-only activation. (netguard.me)

2. Google Play purchase (Play Store build): The same page notes that Play Store rules don’t allow using a Play Store purchase outside the Play Store, and that the Play Store version’s pro features can only be activated with a Play Store purchase. (netguard.me)

Refunds: NetGuard’s FAQ (as mirrored in public repos) indicates that if a purchased pro feature doesn’t work as described while free features work properly and the issue can’t be fixed in a timely manner, you can get a refund. (Note: that statement is not a store-wide “no questions asked” policy; it’s tied to a specific condition.)

Because pricing and store listings can vary by region and time, we’re not listing Play Store exact prices here unless you want us to pin them with a specific current capture.

Privacy and Security Assessment

Jurisdiction and operator

NetGuard is strongly associated with its developer identity and project infrastructure (Faircode contact/support links, netguard.me site, and the M66B GitHub repository). (github.com) That matters for trust: you’re not dealing with an opaque “mobile security company” with unclear ownership; you’re dealing with an identifiable open-source project with public code.

Open-source posture

NetGuard’s source code is publicly available on GitHub under the GNU GPLv3 license. (github.com) Open source doesn’t magically guarantee safety, but it does enable independent review and makes it harder to hide obvious tracking or traffic exfiltration in the app.

“Does it send my traffic to a VPN server?”

NetGuard’s architecture is explicitly based on Android’s VPN service to route traffic locally on-device so it can filter it. That’s an important privacy distinction from consumer VPNs: NetGuard is not presented as a network that relays your traffic through third-party servers.

Logging: useful, but be intentional

NetGuard supports detailed traffic logging features (global and per-app). (netguard.me) Logs can be privacy-sensitive by definition: they can reveal which apps you use and what endpoints they contact. If you’re using NetGuard for privacy hardening, logging is a double-edged sword: great for diagnosis, but you should avoid keeping detailed logs longer than necessary.

Ad blocking: privacy gains with technical caveats

Domain blocking via hosts lists can reduce ad/tracker calls, but NetGuard’s own documentation highlights important caveats:

• Domain blocking won’t stop YouTube ads (not domain-based in the needed way). (github.com)
• If a browser/app uses encrypted DNS (DoH/DoT), NetGuard may not be able to apply domain-based blocking effectively unless you disable those features. (github.com)
• You can’t exclude a single app from ad blocking because Android resolves domain names on behalf of all apps. (github.com)

Audits and incidents

We did not find a credible, specific third-party security audit report for NetGuard in the sources reviewed here. If you need “audited no-logs” style assurances, that’s more typical of VPN providers than local firewall apps — and you should treat “no audit found” as “no audit to point to,” not as evidence of a problem.

Strengths and Limitations

Strengths

• Per-app network control without root using Android’s VPN service approach.
• Open-source codebase under GPLv3, with public repo and F-Droid distribution. (github.com)
• Actionable visibility via detailed traffic logs and app/global logging options. (netguard.me)
• Optional domain blocking via hosts lists (powerful, but not the Play Store build). (github.com)
• Freemium-friendly “pro” unlock via Play purchase or one-time donation path for GitHub/F-Droid builds. (netguard.me)

Limitations

• Occupies Android’s VPN slot, so it conflicts with running a real VPN app simultaneously in the typical setup.
• Play Store build can’t do ad blocking, per NetGuard’s own docs, which pushes power users off Play Store distribution. (github.com)
• Domain blocking isn’t magic: DoH/DoT can reduce effectiveness, and YouTube ads won’t be blocked this way. (github.com)
• Some environments are explicitly unsupported (work profile / Secure Folder / “dual apps” style setups; wired connections), due to Android VPN service limitations.

Who Should Use NetGuard?

Good fit

• Privacy-minded Android users who want per-app internet killswitches (e.g., deny network to games, offline utilities, or apps you don’t trust).
• People troubleshooting suspicious background traffic who benefit from per-app traffic logs and the ability to test “block it and see what breaks.” (netguard.me)
• Users who prefer open-source tooling and are willing to install via F-Droid or GitHub when they need features unavailable in the Play Store build. (f-droid.org)

Not a great fit

• Anyone who needs an always-on commercial VPN at the same time; NetGuard’s local VPN approach typically competes for the same system slot.
• People who want “set-and-forget” ad blocking everywhere (cosmetic filtering, anti-adblock handling, YouTube ad blocking, etc.). NetGuard’s domain blocking has clear limits. (github.com)
• Users dependent on work profiles / Secure Folder / dual-app features where NetGuard is documented as unsupported due to Android VPN service reliability issues.