yashsingh1/xdaforums huggingface dataset:
[Paid Software Announcement and Discussion] M66B:
The app is free to download, but there is a low data limit to try the app, which can be removed by a monthly subscription. Try the app and you'll see how it works.
[Paid Software Announcement and Discussion] sulasno:
Before and after
[Paid Software Announcement and Discussion] M66B:
Before and after enabling VPN/Sentry I guess?

You are not mentioning your location, which does matter.

I have 25 MBit/sec upload and download speed in the Netherlands through the VPN, which I hardly can get using openVPN.

The current and only server is located in France.

Edit: my result using fast.com
[Paid Software Announcement and Discussion] OSheden:
Blocking domains using wildcard works with both IPv4 an IPv6? I mean that if I block *.qwerty.com from the log (T4), will it also work on IPv6 (T6)?
[Paid Software Announcement and Discussion] M66B:
No, you'll need to block both, if that is what you're after.

For flexibility an address is the combination of the IP version and protocol, the domain name and the port number.

This means for example that you can allow an IPv6 address while blocking a similar IPv4 address or allow UDP while blocking TCP for the same domain name/port.
[Paid Software Announcement and Discussion] sulasno:
I am located in Thailand. Actually speed doesn't really matter if I don't watch video
[Paid Software Announcement and Discussion] OSheden:
Thank you for the explanation.

By the way fast.com is not reliable. I did the tests with VPN/Sentry and with NetGuard (no remote access). I get a higher score with VPN/Sentry lol
[Paid Software Announcement and Discussion] M66B:
Did you have filtering enabled in NetGuard?
[Paid Software Announcement and Discussion] OSheden:
Yes
[Paid Software Announcement and Discussion] M66B:
Then the result might even be correct, since filtering on device will result in speed reduction and extra battery usage. In the case of VPN/Sentry the VPN server takes are of filtering (and fortunately the server is not battery powered ;) ). Related FAQ: https://www.vpnsentry.net/faq/#FAQ16
[Paid Software Announcement and Discussion] OSheden:
Gotcha but I still get 32 Mbps without NetGuard which is really low compared to my real Internet speed (about 70-80 Mbps)

Is it normal that VPN/Sentry is automatically disabled when Always-ON option is switched off from the system settings?
[Paid Software Announcement and Discussion] M66B:
Since the way to the internet is longer, a speed reduction is inevitable. Therefore the comparison should with other VPN solutions only.

What do you exactly mean by "is automatically disabled" ?

The Always-on feature should not have an effect on the enabled or disabled state in any case.
[Paid Software Announcement and Discussion] OSheden:
I know. I was just talking about the reliability of fast.com.

1. VPN/Sentry is active. I do see its icon in the statusbar and the VPN key too.

2. Go to System settings > More > VPN > I hit the gear next to VPN/Sentry > I uncheck the line "Always-on VPN"

3. VPN/Sentry is disabled. I no longer see its icon on the statusbar and the VPN key.

Instead I have a warning icon saying "VPN/Sentry has been disabled, likely by using another VPN-bsaed app

4. Back to the system settings, I enable Always-on VPN for VPN/Sentry

5. The "disconnected" cloud icon appears in the statusbar, next to the warning.

6. I select the notification of VPN/Sentry to open the app and switch on the app from the action bar.

The warning icon is removed.

Note: NetGuard is the only other app than is mentioned in the list of VPN apps.
[Paid Software Announcement and Discussion] M66B:
I have the same behavior on my device and IMO this is odd Android behavior. I see no reason why Android should disable the VPN when changing this setting, also because you can just manually enable it again wether always-on is enabled or disabled. Anyway, VPN/Sentry plays no part in this, Android dictates.
[Paid Software Announcement and Discussion] Loader009:
[MENTION=2799345]M66B[/MENTION], testing it right now for a month.

I have new questions >.<

(I read the FAQ again, just to be sure I didn't miss something - so don't hit me if I did, I was fast reading.)

- IPv6; I don't have this at home, is it possible to use it with VPN/Sentry? (I guess not because it is not a tunnel but a proxy-like connection, which means that for IPv6 traffic I need an IPv6 at the phone.)

- Are GCM pushes enabled/possible or blocked due to complexity? (Asking this to be sure if extra-action is needed, like for WhatsApp [still using it... shame on me], Telegram, Threema etc. - they then need slightly different settings than without VPN/Sentry.)

- Probably the same as above; are any incoming connections possible? (Don't need them except for maybe GCM but I am curious.)
[Paid Software Announcement and Discussion] M66B:
I have no problem with questions and certainly not in this phase where the FAQ is still being built up. Actually you are asking interesting questions and some answers might actually surprise you and others ;)

IPv6: if you don't have an IPv6 connection, you will, maybe surprisingly, have one if you have VPN/Sentry enabled. Try accessing http://ipv6.google.com/ with and without VPN/Sentry enabled (assuming you normally don't have an IPv6 connection).

GCM pushes: VPN/Sentry doesn't block anything by default. GCM push messages are, maybe surprisingly, received over an outgoing connection. Look for xxxtalk.google.com:5228 connections of Google Play services. Blocking these (and maybe other) connections will block push messages.

Incoming connections are not routed into the VPN as there is no reason for that (this is not a VPN/Sentry choice but an Android choice). By default Android doesn't accept incoming connections at all. You could, if you have root permissions, install server apps to accept incoming connections, but I see no reasons why a mobile device should act as a server.

Edit: as a result of your questions I have added this FAQ: https://www.vpnsentry.net/faq/#FAQ24
[Paid Software Announcement and Discussion] Loader009:
[MENTION=2799345]M66B[/MENTION]

IPv6; well, doesn't work for me yet... but wait, I still have to check if AFWall+ or other things are blocking something.

I think your solution is working NAT-based, which means that IPv6 have also to be NATed... but IPv6 is actually not NAT compatible [read this some time ago in connection with OpenWRT/LEDE], am I wrong?

Please don't go too much into technical detail, as I am not very deeply involved in this stuff, just getting some knowledge here and there for practical use.

GCM pushes; hm... I have to observe this, I remember having problems on getting notifications on time, but this might have been because I blocked the DNS's you mentioned, earlier with XPrivacy on Marshmallow or Lollipop.

Incoming connections; agree, there is no real reason for this and we would need open ports (NAT forwarding), which is not worth the work and also not the goal of this app.

Another one, but this is probably obvious:

- Apps which are blocked e.g. on mobile (but allowed on Wi-Fi); are they blocked at the phone or blocked at the server?

If blocked at the server, there is still little traffic to the server but it's negligible [so complicated word... sounds like gibligibli].

I think it's blocked at the phone with the uid but anyway, all they probably get is "not connectable" or a timeout or any other failing message.
[Paid Software Announcement and Discussion] M66B:
Without going into technical details as requested ;) , I have had IPv6 connectivity on my device while being on a IPv4 only network, but this is currently broken. I already know what the problem is and I will fix this soon (I will let it know here when this has been fixed).

The server does all the hard work, to save on battery and to limit the network speed reduction, so the server takes care of filtering (blocking/allowing). This means indeed that there is a little traffic going to the server. SYN packets (connection requests) are mostly just 60 bytes, so this can be neglected compared to the battery savings.
[Paid Software Announcement and Discussion] M66B:
IPv6 does work again :)

[MENTION=4724631]Loader009[/MENTION] thanks for bringing this (indirectly) to my attention.
[Paid Software Announcement and Discussion] Loader009:
Here's a hint to something that might be useful someday (not only for China):

https://aur.archlinux.org/packages/openvpn-xor-git

edit [this might help also]: https://aur.archlinux.org/packages/openvpn-xor-patched

and this: https://github.com/Tunnelblick/Tunnelblick/tree/master/third_party/sources/openvpn

(I know, it's the user repo from arch linux, but I haven't gone deeper into this and the github link seems to be the official openvpn-github.)

Dunno if it is applicable on your app/server, but I think that this may be something a VPN provider is interested in...

Well, your goal is not exactly to bypass DeepPacketInspection, still maybe you're interested in this.
[Paid Software Announcement and Discussion] M66B:
Thanks for the suggestion, but as you already said bypassing things is not the goal of VPN/Sentry and might even be illegal and I don't want to get involved into illegal things.
[Paid Software Announcement and Discussion] Loader009:
DPI is illegal, so (in my understanding) countermeasures should be tolerated...

But yeah, it's too vague for your app/server, someone might find something against those countermeasures and... it's your decision, I just wanted to point at it.
[Paid Software Announcement and Discussion] M66B:
The last days there was not a single crash report in the Google Play developer console, so it seems all critical bugs have been solved.

I have just updated this FAQ with some additional information: https://www.vpnsentry.net/faq/#FAQ14

In short: your DNS traffic is secure and cannot be altered by malicious third parties if you have VPN/Sentry enabled (think of open Wi-Fi hotspots).

A personal experience: I have recently seen an open hotspot trying to serve VPN/Sentry a false security certificate (which is basically a Man-in-the-middle attack). VPN/Sentry correctly refused to connect to the VPN server. Since the Android VPN service keeps running all the time, the traffic didn't go anywhere, which is exactly what you want in such a situation.
[Paid Software Announcement and Discussion] Droidphilev:
Hi,

It's a bit unclear (and maybe also a stupid question). How do i leave USB tethering out of VPN usage? Just giving it a try.
[Paid Software Announcement and Discussion] M66B:
Tethering should work out of the box (and thus not be routed into the VPN). Please let me know if this isn't the case.
[Paid Software Announcement and Discussion] Droidphilev:
Ok, will watch the counter.
[Paid Software Announcement and Discussion] M66B:
I have just released

beta

version 0.33.

It may take Google's servers a few hours to make this release available everywhere.

The loading of app icons have been optimized further.

[MENTION=7340930]yadida08[/MENTION] can you please let me know if this works still okay for you?

I have also added a server selector to the profile, but there is nothing to select yet. Linking the server selection to a profile seemed a good idea to me, but please let me know if you have another idea about this.
[Paid Software Announcement and Discussion] Primokorn:
Having a dedicated place to select the VPN servers could be interesting too.

With several servers (I hope VPN/Sentry will be popular enough to launch many servers :)) users could want to see the workload of each server and check if they are all operational (something like that but for servers). I know that NordVPN's Android app is appreciated for this feature.
[Paid Software Announcement and Discussion] Droidphilev:
Hi,

Some questions and some finding:

- what happens if i let an app go through vpn, i freeze the app and defrost it again? Will it's settings be remembered? (Frozen apps are not shown like in Xprivacy.)

- Will it stay 50mb free a day?

Today i gave it a test. Suddenly i got locked out of my Gmail account (which i check with a 3th party client). Stuff like Google play etc also go through the VPN. I had to log in using a browser window to let the mail work again which i did not but i let the mailclient bypass the VPN. Mail worked again. I wonder how far one can go with this before an account gets locked. Play service etc have a french IP. The mailclient on the phone has my mobile provider IP while my pc which is also logged in all the time has another IP. Any ideas about this please?
[Paid Software Announcement and Discussion] M66B:
My goal was to keep the main screen as clean as possible. I was also assuming that the server selection would not be changed often. When there are many different locations that could be different of course.

Linking the server to a profile would allow for profiles like "At home" and "Travelling in Asia", automatically selecting a server in France and Canada respectively.

Thanks for your suggestion, but for now I will keep it as it is, which doesn't hold any guarantee for the future ;)
[Paid Software Announcement and Discussion] M66B:
Assuming that freezing an defrosting an app means disabling and enabling an app, the app settings will be preserved. In fact the app will still be visible in the app list if you select 'Show all apps' in the main menu.

The free allowance is meant to try the app and might change. For now I will keep it at 50 MB per day, but if the servers get busy I might decrease this and maybe I will limit the number of days as well.

I don't think you need to worry to be locked out of Gmail and other services. Google and for example Facebook too detect that you are at an "unusual" location and to protect you they require you to login again to be sure it is you. After that they simply add the new location to the list of "usual" locations and will not bother you again with it.

Edit: I have a added a FAQ about Google, Facebook, etc asking you to login again: https://www.vpnsentry.net/faq/#FAQ26
[Paid Software Announcement and Discussion] Droidphilev:
Ok, thank you. Will retry and login to Google using a browser.
[Paid Software Announcement and Discussion] Primokorn:
Seems legit to me ;)

I'm not used to often changing the VPN servers but it can happen when I feel a slower connection. Some contents are also geo-blocked like TV streaming and websites use the IP to redirect us to a subdomain or home page related to the local language.

Unfortunately we can't ask those services to disable this feature. We do know that we are using a VPN service and our IP is not the same. We know!!! :p

Amazon also sends us a confirmation code by email...

(sigh)
[Paid Software Announcement and Discussion] M66B:
Just to see if it would be useful: who would be interested in a server in Canada?
[Paid Software Announcement and Discussion] Primokorn:
Can we suggest other countries? :D

Do you plan to add an option to clear specific app rules? I mean removing all app rules of my web browser app for instance.
[Paid Software Announcement and Discussion] M66B:
Although for now I think in continents, you are free to suggest other countries.

For the time being I want to limit to OVH as provider, so the number of possible countries will be limited at this moment.

I have been thinking about this, but I am not sure yet. The design goal is still to have a minimum number of UI elements.
[Paid Software Announcement and Discussion] Primokorn:
In "Europe", Switzerland is one of the best country for a VPN server IMO (hello ProtoVPN/Protonmail, hello Tutanota...).

While I understand some requests (including mines :)) may sound superfluous, this one is pretty important since some apps like web browsers will have hundreds of domains to display in the coming weeks/months. Maybe an option to only clear data of domains that don't have rules. :confused:
[Paid Software Announcement and Discussion] M66B:
Clearing entries without rules can be done by exporting and importing ;)
[Paid Software Announcement and Discussion] Primokorn:
Interesting :D You should add this tip in the FAQ or somewhere else!
[Paid Software Announcement and Discussion] M66B:
Nah, that is only for serious enthusiasts reading here ;)
[Paid Software Announcement and Discussion] yadida08:
Hi

In version v0.32, I had no bug but I noticed some VPN / S disconnects from I think of a disconnection of the server. Tell me if I'm wrong?

I just updated the version v0.33, I keep you informed if I encounter a problem.

For servers, you want them to be part of the European Union?
[Paid Software Announcement and Discussion] M66B:
Disconnects are normal if there are connectivity changes (Wi-Fi to mobile, etc) and when the server is restarted to update the software. VPN/Sentry will automatically reconnect, mostly soon, but if this doesn't happen I like to know.

There is already a server in the EU and I might add one for the America's.
[Paid Software Announcement and Discussion] yadida08:
OK and for v0.33 for the moment VPN behaves well. :good:

For servers I understand better why the application in Canada.

If you want one in North America, you can also see if the server would not be cheaper if it was based in Mexico or Haiti?
[Paid Software Announcement and Discussion] Loader009:
[MENTION=2799345]M66B[/MENTION], I often block wildcard domains...

The one which I blocked is then orange but the other one (which is or should also be blocked by the wildcard) stays with the same color as the unblocked one.

Could you change the color of all domains which are blocked?
[Paid Software Announcement and Discussion] M66B:
Unfortunately this can't be done without performance impact.
[Paid Software Announcement and Discussion] Loader009:
[MENTION=2799345]M66B[/MENTION], can you do this per app only?

I mean, we use the UI not very often and this feature would help with blocking domains... otherwise I would always block with wildcards but what happens if I unblock one of those wildcard domains, will all wildcard domains be removed or just the one which was orange?

e.g.

blabla.google.com

blublu.google.com

Both blocked as wildcard domains, what happens if I then unblock blublu.google.com, blabla.google.com is still orange but will it be blocked or not?
[Paid Software Announcement and Discussion] M66B:
Blocking rules take precedence over allowing rules, see also here: https://www.vpnsentry.net/faq/#FAQ23
[Paid Software Announcement and Discussion] Loader009:
ok, I guess that the server doesn't save

block *.google.com

but it saves

block (blabla).google.com

block (blublu).google.com

I ask this because if there is a duplicate value for a block rule, it might delete both values. Using the latter version means that there is always only one value even by using wildcards.

Guess I should stop on trying to find bugs, since you have great experience in developing, I have none :cyclops:
[Paid Software Announcement and Discussion] kaizokan:
It's great to see another privacy app from you! :)

Too bad that Xprivacy won't be updated anymore but i understand the reason why and probably would have done the same.

Switching to VPN/Sentry will be like giving away 99% of my privacy ...in comparison to the protection of Xprivacy ;) luckily i can still use Xprivacy :D

I'm pretty sure I will try this app soon and will try to come up with ideas for improvement.

But for now I do have a question. It's about the mixing of internet traffic, there is not much info about what this does/how this works.

Could you explain this in more detail? And maybe also in simple term on the first page, so that everyone will understand what it means.
[Paid Software Announcement and Discussion] IronRoo:
+1 for Switzerland or any county with similar strong privacy laws (that is the number two criteria for me choosing a VPN, number 1 would be a trusted provider ;))
[Paid Software Announcement and Discussion] IronRoo:
Black theme :highfive:
[Paid Software Announcement and Discussion] M66B:
There is nothing magical about this, It is just how a VPN works. The internet traffic of all users go to the same servers. These servers forward the traffic to the internet. This means that for the receiver the traffic seems to come from the same place. In other words, they cannot use your IP address anymore to track you.
[Paid Software Announcement and Discussion] M66B:
Both rules will indeed be saved, so you can still undo any of the rules, for example to allow one of them, because the app appeared to really need that one address to do what you want it to do.

That I have more than 35 years experience developing and selling software (really) doesn't mean my software will be bug free and cannot be improved. Software is simply to complex for that. So, just keep trying to find bugs and keep asking questions to make things better.
[Paid Software Announcement and Discussion] M66B:
I have just released

beta

version 0.34.

It may take Google's servers a few hours to make this release available everywhere.

Besides some minor changes and bug fixes, the sort order of addresses has been changed to group related addresses (hopefully you'll understand it when you see it).
[Paid Software Announcement and Discussion] Droidphilev:
Hi,

I'm sorry for this:

-If i understand correctly: if VPN stops (for example: daily limit is reached) there is no firewall either? In other words: when the main switch is off then there is no blocking either?

-Is there a way to mass-change a setting (like in XP)? For example: i have +200 apps but only want a few to goto the server. Is there a way to mass change "bypass vpn"?

thanks
[Paid Software Announcement and Discussion] M66B:
No need for sorry's.

If you manually disable VPN/Sentry using the switch in the action bar, then VPN/Sentry will be completely disabled and so there isn't a firewall running anymore. Note that the firewall is actually running on the VPN server to save on battery usage.

Reaching the daily usage limit will not disable VPN/Sentry, only the connection with the VPN server will be terminated, which means that all traffic will appear to be blocked (so no leaking).

VPN/Sentry is designed to encrypt all traffic and to send all traffic through the VPN. The setting the exclude apps from the VPN is only meant for rare apps that need to reach the local DNS server. Since I want to keep the number of UI elements minimal, there will be no way to mass change the bypass VPN setting.
[Paid Software Announcement and Discussion] Loader009:
[MENTION=2799345]M66B[/MENTION], what about the connections while android is still starting but SystemUI is loaded (but apparently not VPN/Sentry, at least it takes some more seconds).

My question is, are those connections leaked before VPN/Sentry has been started?

Also, I had some kind of connection problem this morning. I wanted to update your app over the Play Store but it never started the download. The logs stated that android.clients.google.com could not be resolved. After disabling VPN/Sentry, I wait until the notification was gone and reenable it, it worked fine again.

(Sadly I cannot gather any logs now, Magisk "lost" its root, so I have to do a cold boot.)

fyi, I have often some kind of soft-reboot at night, if this is important. This is not intended, I have to look what app/module (Magisk/XPosed) is causing this.
[Paid Software Announcement and Discussion] M66B:
If your Android version doesn't support Always-on VPNs, connections will be allowed like usual as long as the Android VPN service (key icon in the status bar) is not started by VPN/Sentry.

Regarding not being able to update: double check your rules. How did you notice that android.clients.google.com could not be resolved?
[Paid Software Announcement and Discussion] Loader009:
Ok, Always-on is activated and it seems to start pretty early.

I already double checked.

At the global rules I block all facebook connections and one twitter.

At the Google Play Store nothing is blocked.

I restarted my phone, now it can't look for any updates or list my installed apps.

I noticed that when I looked wit CatLog over the log. I looked for any error message and saw that one... couldn't save the log afterwards because of Magisk root failing (probably gonna use another root solution).
[Paid Software Announcement and Discussion] M66B:
The real-time log is meant to debug issues like this.