Even without root, a VPN-style firewall will work against all non-system apps. The downside of this approach is that you can't combine one with another VPN app.

▲

strcat a day ago | parent | next [-]

RethinkDNS is implemented as a VPN service but it has support for local filtering combined with optionally using a WireGuard VPN or multiple chained WireGuard VPNs. You can have both via the VPN service API rather than choosing one or the other. No need for app accessible root access.

▲

username135 a day ago | parent | prev [-]

Are you referring to something like Karma on fdroid?

▲

jeroenhd a day ago | parent [-]

Yes. I used to run NetGuard, but Karma seems to work very similarly.

It looks like there's an app on F-Droid called "Rethink" that promises to do both firewalling, DNS blocking, and offers a WireGuard VPN. That seems promising, though I must add that I haven't tested it myself.

	▲	DeepSeaTortoise a day ago \| parent \| next [-]
		Rethink isn't quite ready yet. Depending on your use case you can go without getting thrown off by a bug for weeks, but when it fails it can be quite annoying. And don't use the GPlay version, but the FDroid or GitHub one. On the other hand, the functionality is top notch. Easily the best integration of consumer level DNS + firewall blocking in any application on any platform. Just block everything of an application by default and then watch the connection logs for the app and start unblocking stuff via ips, domains or wildcards until the app starts working again.
	▲	johnisgood a day ago \| parent \| prev [-]
		I have been using Rethink, I think it is great.