[Samsung Galaxy S 5 Unified Development] Ines*:
I purposely chose this LineageOS thread since Marcel thinks it is very likely not a NetGuard problem and I agree. So we cannot expect him to spend time on this.

I now try to explain my thoughts and findings to the best of my knowledge, I hope it is correct.

a)

2.137 works with 'Filter traffic' on, without it does not.

For API >= 21, NetGuard lets "green" apps bypass the local VPN when 'Filter traffic' is off. NetGuard does this by calling

- VpnService.Builder addDisallowedApplication

which was added in API level 21

=> So 'addDisallowedApplication' does not seem to work in your LineageOS version.

Marcel already suspected this part.

b) more complex situation

In version 2.140, a check was added if the socket used to forward the traffic will be protected. This is optional for API >= 21.

All Netguard versions up to 2.139 have this socket protection for all Android versions.

Since 2.140, NetGuard intends to skip the socket protection for API >= 21 (where it is optional).

Android versions API >= 21 work with or without it if the OS is implemented properly.

Only for older Android versions, this is mandatory, otherwise everything is blocked. (forwarded traffic re-enters the local VPN resulting in an endless loop)

Unfortunately, in 2.140 .. 2.167, an uninitialized variable is used for the check which was corrected only in 2.168.

Logging output for some versions among 2.140 .. 2.167 showed that most of the times a very high value is obtained, much higher than 21, just by chance, hence the 'protect socket' seems to be skipped very often.

So for 2.140 .. 2.167, we do not know if the 'protect socket' is done or not.

This means (with 'Filter traffic' on):

2.137 working with 'protect socket' which is always done (no check)

2.147 working => probably the 'protect socket' was done (by chance)

2.148 NOT working => probably the 'protect socket' was NOT done (by chance)

2.163 NOT working => probably the 'protect socket' was NOT done (by chance)

2.168 ??? => 'protect socket' will NOT be done

2.229 NOT working => correct version check, 'protect socket' was definitely NOT done

I erroneously assumed, 2.163 has a correct check implemented, but only 2.168 and onwards have.

So if 2.168 does not work (which is to be anticipated) we would know that a change between

2.137 and 2.168 (besides 'Filter traffic' being off) also causes the 'not working'. Still quite some code changes.

The best would be to test with a version > 2.139 compiled with the check removed (two lines) and see if it works (with 'Filter traffic' on). This would give us a proof.

=> But even without such a test, I am fairly confident that this second feature - 'protect socket' being optional for API >= 21 - is also not properly implemented in your LineageOS version. It does not need to be done for API >= 21.

Some months ago, I observed a full blocking of NetGuard 2.148 compiled for and running on KitKat when the 'protect socket' was erroneously skipped but KitKat needs it (API value should have been 19 but the uninitialized variable was 2 billion something).

Your LineageOS version also seems to need the 'protect socket', but it should not (API >= 21).

Edit: There is no change between 2.147 and 2.148 that explains the different behavior. This is a very strong indication that the usage of the uninitialized variable in the check for the API version if the 'protect socket' will be done or not makes the difference in whether it works or not for these 2 versions.