v055x: "Block when DNS is bypassed" results in random internet loss in specific apps

[PortableMaker]

I want to report a specific issue after updating from v055u to v055x. On v055x, individual apps randomly lose their internet connection one by one while the system internet is still active.

For example, one app will suddenly stop loading or buffer indefinitely, but if I switch to another app, that other app has internet. Eventually, more apps will randomly experience this until I toggle RethinkDNS off and on again. This never happened to my apps back on v055u.

My setup:
RethinkDNS version: v055x
Universal Firewall Settings: "Block UDP except DNS and NTP" and "Block when DNS is bypassed" are both enabled.
Blocklists: HaGeZi Ultimate, UrlHaus, Amnesty (NSO)

It feels like a per-app connection leak or routing issue in the new version. Thank you!

[PortableMaker]

Update on my previous report:
​I have found the exact culprit causing the random per-app internet drops on v055x.
​The issue is directly tied to the Universal Firewall setting: "Block when DNS is bypassed".
​On v055u: Enabling this feature works perfectly fine with zero issues.
​On v055x: Enabling this feature immediately triggers the random connection drops and infinite buffering per app. Turning this setting OFF completely resolves the issue on v055x.
​This appears to be a regression bug with how "Block when DNS is bypassed" handles connections in the new update. I hope this specific clue helps you fix it in the next patch! Thank you for your hard work.

[glevv]

I can confirm that in the latest version drastically increased the number of network requests blocked with the reason "DNS bypassed".
It started to block everything from almost every google app, etc, which could look like there is no connection to the internet.

[ignoramous]

@glevv & @PortableMaker which Android version are you on?

can confirm that in the latest version drastically increased the number of network requests blocked with the reason "DNS bypassed

Is that not because DNS has infact been bypassed by those apps? Every version since v055o has gotten more stricter & probably better at applying DNS-specific firewall rules.

Enabling this feature immediately triggers the random connection drops and infinite buffering per app.

Is this app known to "bypass DNS", for example, by using DNS answers well beyond their time-to-live value? For instance, the Instagram app will resolve domains (to IPs) it tries to connect to, but will keep a cache of the IPs (returned as answers to domain resolution queries) for far longer (3h or more) than the assigned time-to-live (which could be mere seconds to minutes, and in some cases, even 0).

[PortableMaker]

Hi @ignoramous, thanks for the response. To answer your question, I am on Android 16.
​The main point I want to emphasize—and what points to a bug in the new version—is this: Why does everything work perfectly fine on v055u with "Block when DNS is bypassed" turned ON, but fails on v055x with the exact same setting ON?
​If this were truly just an app-side issue (like Instagram holding onto a long IP cache), it should have triggered these same random blocks and infinite buffering back when I was on v055u. But on v055u, it was flawless.
​Furthermore, simply toggling RethinkDNS OFF and ON instantly restores the connection for all apps. If the apps were stubbornly holding onto invalid cached IPs in their own memory, a quick restart of RethinkDNS wouldn't magically fix them, because the apps would still be sending traffic to those same "bad" IPs.
​This clearly indicates a regression in how v055x internally tracks or incorrectly accumulates the "bypassed" state over time compared to v055u.

[ignoramous]

work perfectly fine on v055u with "Block when DNS is bypassed" turned ON, but fails on v055x with the exact same setting ON

v055v+ has a different firewall behaviour (which is more stricter) than v055u. That said, we'll check that part of the code once more and also try to reproduce the issue you're seeing, to see if anything obvious pops up.

If the apps were stubbornly holding onto invalid cached IPs in their own memory, a quick restart of RethinkDNS wouldn't magically fix them

Change of network notification (which stop/start of a VPN app triggers) may result in these apps flushing their caches. The OS, for example, flushes all its caches, on network changes.

This clearly indicates a regression in how v055x internally

May be. What'd help us rootcause are "Very verbose" logs from Configure -> Settings -> App Logs captured as and when the issue you're reporting happens. Screenshots of the bottomsheet of those blocked connections or queries (bottomsheet is the UI that pops up when you tap on entries in Configure -> Logs -> Network & Configure -> Logs -> DNS) would also be useful.

[PortableMaker]

Thanks for agreeing to check the code and try to reproduce the issue!
​Regarding the logs and screenshots: Because the random app drops made v055x unusable for my daily needs, I have temporarily downgraded back to v055u so I can keep "Block when DNS is bypassed" enabled without issues.
​Because of this, I won't be able to provide the verbose logs or screenshots right now since everything is working perfectly on v055u. I hope your team can find something obvious when you review the code changes made after v055u or when you try to reproduce it on your end. Thank you!