Old Android firewalls needed root: full control of the phone, which also weakens its security and can break banking apps. Today a firewall can check every app’s traffic without root, using a feature that Android itself provides.
The trick: Android’s own VPN feature
Android lets one app at a time receive the phone’s internet traffic through its VpnService feature. Most people know it from VPN apps that send traffic to a server far away. A firewall uses the same door differently: it keeps the traffic on the phone, checks it, and then lets it go straight to the internet. There is no remote server.
What happens when an app goes online
- The app asks for a website’s address (a DNS look-up) or opens a connection.
- Android hands that request to the firewall app.
- The firewall checks it: which app is this, which website, is it on a block list, does a rule apply?
- Allowed: the firewall connects to the internet for the app. Blocked: the app gets “no such site” or the connection is refused.
- The decision is written into an activity list on the phone, so you can see what happened and why.
What a no-root firewall can do
- Block any app completely, or only on Wi-Fi or only on mobile data.
- Block ads, trackers and harmful websites in every app, not only the browser.
- Stop apps from skipping your blocks with their own private DNS.
- Show every connection: app, website, time and data used.
Honest limits
| Limit | Why |
|---|---|
| Only one VPN app at a time | Android allows one. Starting another VPN switches the firewall off. |
| A short gap after a restart | Apps can connect before the firewall starts, unless you turn on Android’s Always-on VPN and Block connections without VPN for it. |
| No view inside encrypted traffic | It sees the app, the website name and the address, not the content of HTTPS pages. |
| Phone-maker battery savers | Some brands stop background apps; allow the firewall to run in the background. |
Android documents the always-on settings in its VPN guide.
Root vs. no root
| Root firewall | No-root firewall | |
|---|---|---|
| Needs a rooted phone | Yes | No |
| Phone security stays intact | Weakened by root | Yes |
| Can run alongside a normal VPN | Yes | No (one VPN at a time) |
| Install from Google Play and use | Rarely | Yes |
TacUNS: a no-root firewall
TacUNS works exactly this way: a network engine on the phone checks every connection, your rules and history stay on the phone, and there is no account. Since version 2.0.1, Home also tells you whether Android keeps TacUNS on after a restart. See every feature or read what DNS filtering is.