Umbral

Android privacy suite: per-app VPN firewall, DoH/DoT engine, bundled Tor (tor-android + IPtProxy bridges) and I2P (i2pd). Strict no-fallback routing. GPLv3+.

What it does

VPN-based firewall with per-app rules — Tunnel / Bypass / Block per application (block rules per Wi-Fi/mobile network in Advanced mode). Blocked TCP connections are actively reset; non-DNS UDP (QUIC etc.) is dropped by default so apps cannot escape the enforced path. Encrypted DNS — a local DNS engine inside the tunnel. DNS-over-HTTPS (RFC 8484) or DNS-over-TLS (RFC 7858), with a local TTL cache. Shipped provider catalogue (Cloudflare, Quad9, AdGuard, DNSforge, Mullvad) plus fully custom endpoints. All plaintext port-53 traffic inside the tunnel is intercepted and answered locally — pushed/rogue resolvers are ignored. Bundled Tor — the real Tor daemon (tor-android 0.4.9.14 from Maven Central, BSD-3) with pluggable transports via IPtProxy (obfs4, snowflake, webtunnel, meek_lite). Route the whole tunnel through Tor with one preset; DNS can be resolved through Tor as well (remote DNS, see below). Circuit renewal (NEWNYM), bootstrap progress. Bridges can be pasted in batches (one per line, validated, deduplicated) or added one by one. Custom SOCKS5 upstream for the whole tunnel, with username/password support, hostnames always sent to the proxy (remote DNS). I2P (i2pd) — the real Purple I2P router (upstream release 3.0.0 binaries, BSD-3) runs as a child process; route *.i2p traffic through the invisible internet. SOCKS/HTTP proxy on loopback, SAM opt-in, transit participation off by default. Config generation is validated against the real daemon; an opt-in live test fetches a real eepsite end-to-end through our own SOCKS5 client (see tests). Strict failure mode (default on) — if Tor or the configured proxy is unavailable, connections are refused, never silently sent directly. Anti-DPI (TLS ClientHello fragmentation) — the first TLS record of tunneled HTTPS connections is split into small TCP writes; SNI hostnames become invisible to middleboxes that do not reassemble segments. Bytes on the wire do not change, so the TLS handshake stays valid (verified by a real-handshake test). Observed SNI names are shown in Diagnostics. Honest note: rewriting SNI is impossible without a MITM proxy (it breaks the Finished MAC) — this is the working variant of the trick. Diagnostics you can trust — connection log (what was blocked/passed), DNS query log (which upstream, cached or not), Tor log, observed SNI. The screens say explicitly what the app cannot observe. Simple and Advanced UI modes — Material 3 / Jetpack Compose.

What it does NOT do (honest limitations)

It does not anonymize traffic you route directly. Encrypted DNS hides queries from the local network only; the resolver still sees them. It does not protect against a compromised OS, a rooted/backdoored device, or physical access to an unlocked phone. Per-app upstream selection inside the tunnel (app A → Tor, app B → direct) is not possible in v0.1 for a verified technical reason: the tun2socks engine (hev-socks5-tunnel) does not preserve original source ports, so per-connection UID attribution stops at the packet filter. Per-app options are Block / Bypass; the tunnel route (Direct/Tor/Proxy) is global. See docs/ARCHITECTURE.md. No DNSSEC validation is performed locally; providers that validate are marked in the UI (validation happens upstream). I2P clearnet access requires an explicitly configured outproxy; by default the I2P route serves *.i2p destinations only (that is what I2P is for). No I2P module (assessed as not integrable) — reversed in v0.2.0: bundled i2pd (Purple I2P) integration shipped; see above. Not tested on a physical device yet in this iteration — see docs/IMPLEMENTATION_STATUS.md.