README.md: Multiple VPN entries on a per app basis ?

[freebrowser1]

Not a bug, but a question.

From the README.md:

VPN / Proxifier
Rethink supports forwarding TCP and UDP connections over SOCKS5, HTTP CONNECT, and WireGuard tunnels. Split-tunneling further helps run multiple such tunnels at the same time and lets users route different apps over different tunnels. For example, one could route Firefox over SOCKS5 connecting to Tor, Netflix over WireGuard connecting through any popular VPN provider, and Telegram or WhatsApp over censorship-resistant HTTP CONNECT endpoints at the same time.

How is this accomplished ? Android does not allow multiple VPN clients (in this case Rethink and a popular VPN app together ?). Or does Rethink allow a different Wireguard or HTTP connect client on a per-app basis ?

[ignoramous]

Rethink runs WireGuard-as-a-proxy at L4 not as a "VPN" at L3 (see below), and thus can run multiple WireGuards in parallel. Similarly, HTTP (connect) and SOCKS5 tunnels are already running in L4, and can run alongside WireGuard.

Though, there's no limitation on just how many HTTP, SOCKS5, and WireGuard tunnels could be run, the current UI only supports creating either one HTTP tunnel or one SOCKS5 tunnel or multiple WireGuard tunnels (which is to say, WireGuard-as-a-proxy has first-class support on Rethink). The readme is pointing to a feature we once had then removed but intend to bring it back (that is, impl HTTP+SOCK5 as first-class citizens).

---

*From: r/rethinkdns

A very technical question, and so I'll try my best to answer it with references where appropriate.

tldr; Rethink does not leak packets or break encryption by running WireGuard as a "Proxy".

---

A VPN is analogus to a Router. Operates at layer3 (L3) on Internet Protocol (IP) packets.

A Proxy is analogus to a Load Balancer. Operates at L4 (layer4) on Transport Protocol (ex: TCP / UDP) packets.

A Firewall can be of two kinds: Stateful and Stateless (packet filter).

In Rethink's context, the app creates a VPN (L3); then proceeds to handle TCP (L4), UDP (L4), and ICMP (L3 over L4) protocols statefully. Rethink does not "understand" / keep track of the state of other protocols; and drops (blocks) them (which isn't the same as "leaking" them). Most apps (99.9%, if I were to hazard a guess) work fine with either UDP or TCP and rarely need or use other Transport protocols. P2P / LAN apps might do some funny things, and so may not work out-of-the-box when Rethink is running.

WireGuard works at L3, but not in Rethink. After applying IP / domain firewall rules, the packets are statefully transformed (either to an L4 connection-oriented stream for TCP, or to a L4 connectionless datagram for both UDP & ICMP) & forwarded to (any of the mutliple, simulataneously running) WireGuard or underlying network. The protocols Rethink does not deal with are dropped. Today, due to limitations in Android (lack of "ownership" details on ICMP datagrams), ICMP is always routed to the underlying network (usually, mobile and/or wifi).

Rethink's setup may seem restrictive or peculiar but it works nicely for Android.