Using NordVPN with rethinkDNS for simultaneious IP cloacking and list based filtering

Hi all,

I just got the new version of rethink from playstore and saw it had wireguard support. For the longest time, my biggest complaint with rethink is that I can't use it at the same time as nordVPN which doesn't have any real ad blocking. With ability to proxy through Wireguard I figured the problem is finally solved but it was tricky to do out of the box so I thought I'd write a post.

This is just based on my thin understanding so please post with corrections and improvements.

Goals

• Block most ads
• Have IP cloacking (especially regional support to get around locale based blocking) using nordVPN as I subscribe already

Solutions

• Use rethink custom dns configurator plus nordVPN (disable rethink android app)
  • Can easily refresh exit node of nordVPN and change countries without new wireguard config.
  • Seemed to block more ads than rethink app when using https://adblock.turtlecute.org/ though I didn't notice any difference on actual ad-ridden sites.
  • Previous posts here have noted that private dns is not as secure as rethink app due to anti leak measures.
• Use rethink android app with nordVPN wireguard proxy
  • Need one wireguard proxy for each server (so at least for each country and sometimes needs to be refreshed due to servers being brought down and up)
  • By default, does not use rethink dns blocklists so harder to configure.

The first one is fairly straightforward using DNS over TLS links from rethink but the second is quite complex so I'll go into some more detail.

1. Get wireguard configuration for NordVPN.
   1. I googled and found https://lazyadmin.nl/home-network/nordvpn-wireguard-as-unifi-vpn-client . If you go until step 7 it will give you a working wireguard config.
   2. Caveat: Remove `ForcedHandshake` from Peer settings as it's not official and will break importing.
   3. Probably many of the other settings aren't required but also didn't cause problems. (For example it seems to use cloudflare DNS which I don't need but doesn't hurt)
2. Add configuration to rethink
   1. Go to rethink proxy settings and add wireguard proxy. You can transfer the file to your phone to import or generate a QR code for it.
3. Configure rethink to still block ads even when proxy is on. (Sad this isn't default)
   1. Switch to advanced mode and toggle on 'Always-on'. If you want to turn off the VPN, you need to uncheck it later. (annoying that it takes two steps). It seems simple mode should also work but for some reason simple mode always showed ads no matter what other settings I chose.
   2. Enable rethinkDNS for proxy traffic. (Two ways seem to work)
      1. Enable 'Never proxy DNS' in DNS settings. This means DNS traffic goes through normal rethink DNS instead of proxy so gets filtered properly. But perhaps this is less secure or doesn't work for certain usecases?
      2. OR: Enable 'Loopback proxy forwarder apps' which seems to route proxy traffic back through rethink DNS enabling proper filtering.
      3. OR: Don't enable either of those and just use Advanced mode with always-on? I just tested this now while writing and it seems to work as long as we're using Advanced mode. There might just be a bug here.

Let me know if there is any unnecessary bits here or if others have nice workflows they like.