42: The Invisible Bodyguard That Silences 10 Million Apps

10 million installs, 4.3 ★ from 28 k reviews, yet it still feels like Android’s best-kept secret. Marcel Bokhorst’s creation is the rare firewall that needs no root, no exotic VPN certificates, and no subscription—just a simple on/off toggle for every app that wants to phone home. If you’ve ever wished for a “digital leash” on bloated social clients, analytics SDKs, or that one game that pings servers at 3 a.m., NetGuard hands you the leash and the collar.

First-run Experience  

Install is a 3 MB download from the Play Store or F-Droid. On first launch you grant two things:  

1. VPN permission – Android’s only sanctioned way to intercept traffic without root.  

2. Optional notification access if you want live bandwidth read-outs.  

A 30-second wizard explains the paradigm: “Deny by default, allow selectively.” The main screen is just a scrollable list of installed packages, each with a cellular and Wi-Fi icon. Tap an icon, traffic is blocked for that interface; long-press and you open a full rule sheet—ports, IPs, address ranges, and per-app DNS.

Core Firewall Engine  

- Simple mode: global kill-switch plus individual cellular/Wi-Fi toggles.  

- Advanced: per-address, per-port, per-UID rules; support for IPv6, LAN, and localhost.  

- Optional logging: captures packets in pcap format you can export to Wireshark.  

- Lock-down button: instantly severs everything except the apps you star.  

- Roaming block: automatically denies selected apps when you leave home country.  

- Screen-on/off rules: allow WhatsApp only when display is lit, block TikTok when it’s off.

Privacy Stance  

NetGuard creates a local VPN interface but routes zero bytes to an external server. All filtering happens on-device; no traffic is decrypted. The app is open-source (GPL 3), contains no trackers, and works entirely offline. You can even disable the update checker if you want true radio silence.

Battery & Performance  

Despite running a constant VPN service, battery impact is almost unmeasurable: less than 0.5 % over 24 hours on Android 13. RAM sits around 40 MB. CPU use spikes only when you refresh the app list or export logs. The secret is Linux’s built-in iptables backend—NetGuard simply edits rules instead of copying every packet.

Advanced Goodies (Pro add-on)  

A one-time in-app purchase (≈ a coffee and sandwich) unlocks:  

- Per-app DNS settings (block YouTube ads at resolver level).  

- Outgoing IP address filtering (stop VPN leaks).  

- Custom notification filters and live bandwidth graph in status bar.  

- Theme customisation and extra icons.  

Everything else, including basic firewall and logging, remains free.

Use-case Snapshots  

- Traveller on a 2 GB pre-paid SIM: block Google Play and system updates over cellular, allow only Maps and WhatsApp.  

- Parent: disable internet for Minecraft and Roblox during school hours using the schedule option.  

- Developer: log all analytics calls from a beta build, export pcap, feed to Wireshark.  

- Privacy nut: block Facebook’s background “metrics” completely while still keeping Messenger chat functional.

Pros:

• Zero-root system-wide firewall via Android’s VPN slot. 
• Completely free (GPL 3); no ads, no trackers, no account. 
• Per-app, per-interface, per-address rules with IPv6 support. 
• Lock-down button + roaming auto-block for travel/data-pinching. 
• Tiny footprint: 3 MB install, <40 MB RAM, <0.5 % battery/day. 
• Optional logging exports to Wireshark for nerdy forensics. 
• One-time coffee-priced unlock adds DNS filtering & bandwidth graph.

Cons:

• Can’t block in-app ad domains the way root-based AdAway can. 
• Some streaming apps detect the local VPN and refuse to play. 
• UI is utilitarian; no Material You theming or flashy graphs. 
• Initial rule list can overwhelm phones with 300+ packages. 
• IPv6 dual-stack leakage possible on heavily skinned ROMs.

Comparison  

- GlassWire focuses on bandwidth stats, not blocking.  

- NoRoot Firewall (older rival) hasn’t seen updates since 2019.  

- AdGuard needs a subscription for system-wide ad filtering and routes traffic to its servers unless you self-host.  

- Rethink DNS offers DNS + firewall but is heavier and still in beta flux.

Who Should Tap Install  

- Data-pinching users who want metered-app control without rooting.  

- Privacy advocates removing telemetry bloat from otherwise offline apps.  

- Parents curbing kids’ data or bedtime usage.  

- Frequent travellers dodging roaming surprises.

Who Can Skip  

- Root users who prefer ad-block hosts files or per-domain DPI filtering.  

- Streaming-only households that need zero packet leaks to DRM servers.  

- People who want a shiny, gesture-rich interface—this is pure function over form.

Final Packet  

NetGuard is the digital equivalent of a silent bouncer: it stands at the door, clipboard in hand, and decides which apps may speak to the outside world. No root, no drama, no monthly fee—just iron-clad, on-device filtering that respects both your battery and your privacy. If you’ve ever looked at a permission list and thought, “Why does a torch app need Wi-Fi?” NetGuard is the easiest way to cut the chatter.