NetGuard review: block Android apps without root

NetGuard is a free open-source Android firewall for people who want to choose which apps may use the internet. It can allow or block each app on Wi-Fi and on mobile data, without rooting the phone, and it filters that traffic on the phone.¹²

Last checked October 28, 2026.

At a glance

What it is: A no-root firewall that allows or blocks internet access per Android app¹

Works on: Android phones and tablets. Version 2.337 needs Android 6.0 or newer. The README and FAQ still list Android 5.1 or later¹²³

Price: Free to block apps. Optional pro features are a Play purchase, or a donation (the form is preset to €7.77, and the site asks for at least €7 for lasting activation)²⁴

Licence: GNU GPL version 3. F-Droid lists GPL-3.0 only; the project text also allows later versions¹³

Best for: Android users who want a per-app internet switch

Official site: netguard.me

What NetGuard does (and how it protects your privacy)

NetGuard lets you allow or deny each app on Wi-Fi, on mobile data, or on both.¹ The project says blocking access can reduce data use, save battery, and increase privacy.¹ Traffic is allowed at first, so nothing goes offline until you block it.²

The project says a no-root firewall on Android has to use the VPN service, and NetGuard keeps it on the device.¹⁶ With filtering off, blocked traffic is dropped on the phone.² When filtering is on, allowed traffic goes to the destination the app asked for, not to a remote VPN server.²⁵ Marcel Bokhorst publishes it through FairCode B.V., with no calling home, no tracking, and no analytics.¹⁴

Apps you allow are still visible to the network you are on. What an internet provider can still see is a separate question. NetGuard allows DNS lookups so it can match domain names, and it cannot read encrypted DNS. A beginner’s guide to encrypted DNS covers that choice.²

Key features of the NetGuard firewall

Separate Wi-Fi and mobile rules. Each app can be allowed on one network and blocked on the other.¹
Allow list or block list. You can block everything, then allow a few apps, or allow everything and block the ones you name.²
Screen and roaming conditions. An app can be allowed only while the screen is on, and access can be blocked while roaming.¹
System apps, tethering, and notices. System apps can be managed, tethering is supported, and NetGuard can notify you when an app goes online and record use per address.¹⁴
Hosts-file blocking on the GitHub build. Optional ad blocking with a hosts file, and optional port forwarding, are in the README and are absent from the Play Store build.¹
Lockdown mode. Traffic is blocked except for apps you mark as allowed during lockdown.²
Optional pro tools. A paid unlock adds an exportable log, per-address rules, new-app notices, a speed graph, and extra themes.⁴

Pros and cons of NetGuard

Pros

Everyday blocking is free, with no root, and the source is under the GNU GPL.¹²
Wi-Fi and mobile data have their own switches, including screen-on and roaming rules.¹
The project says there is no calling home, no tracking, no analytics, and no advertising.³⁴
F-Droid’s suggested build is version 2.337, added on 3 August 2026. The Play listing was updated on 17 August 2026.³⁶

Cons

Android allows one VPN app at a time, so NetGuard cannot run beside another VPN app.¹⁶
The FAQ says NetGuard does not encrypt traffic or hide your IP address, and that it offers no protection during early boot, before Android starts the VPN.²
The 2.322 notes (4 October 2023) say the Play build manages only user-startable apps and some system apps. The GitHub build is for all traffic. Hosts-file blocking is absent from the Play build.¹⁷
The developer does not support F-Droid builds, and a different signature means uninstalling before a GitHub update.²
Support is for phones and tablets. Work profiles, Samsung Secure Folder, cloned apps, ethernet, a television, and a car are unsupported.¹
Filtering and logging use more battery, and that use can be heavy on older phones. Some Samsung phones stop NetGuard when memory is tight. Some Huawei and Xiaomi Android versions stop apps aggressively.²

Is NetGuard safe and private?

The privacy page says NetGuard does not share information, and that the app list stays on the phone.⁵ The FAQ says it filters on the device and does not encrypt traffic or hide your IP address.² The phone-state permission is there to notice mobile-network changes.² The traffic log can look up names at Amazon and ipinfo.io, and that lookup can be switched off.²

Play’s data-safety form, filled in by the developer, says no data is shared with third parties, that the app may collect app activity, that data is encrypted in transit, and that data cannot be deleted.⁶ The privacy page says Google’s claim that the app collects and shares email addresses is not correct.⁵ In October 2024, PiRogue Tool Suite analysed version 2.330 from GitHub and reported that the Play Billing library in that build sent device model, manufacturer, fingerprint, locale, country, carrier codes, and connection type to Google’s Firebase logging address.⁸ F-Droid’s suggested build is 2.337, by Marcel Bokhorst (M66B) of FairCode B.V.³⁴

The README warns that a Galaxy store app, “Play Music – MP3 Music player”, shares NetGuard’s package name and can replace it without confirmation. It was reported to Samsung on 8 December 2021 as probably malicious.¹

How to get started with NetGuard

Download from GitHub releases or Google Play. GitHub includes hosts-file blocking. Play is where pro features are bought. F-Droid’s page has version 2.337, built and signed by F-Droid. The developer does not support F-Droid builds.¹²³⁷
Do not install the Galaxy store title named in the README warning.¹
Turn the firewall on with the switch in the top bar. Android will ask you to allow a VPN. That VPN stays on the phone and is how NetGuard sees app traffic. Accept it.²⁶
Traffic starts allowed. Tap the Wi-Fi and mobile icons beside an app to block that network. Reddish means blocked. Greenish, blue, purple, or grey means allowed.²
For a short allow list, open Settings, then Defaults, and turn on Block Wi-Fi and Block mobile. Then allow only the apps you want online.²
After a reboot, check for the key icon. NetGuard starts on boot if it was on at shutdown and is not on external storage. On Android 8 and later, leave “Block connections without VPN” off. The README says that option blocks all traffic. On GrapheneOS that option starts on.¹²

Who should use NetGuard (and who might prefer something else)

NetGuard fits an Android phone or tablet when you want separate Wi-Fi and mobile switches and can give it the one VPN slot. Pro features add a log, per-address rules, or a new-app warning.⁴

For DNS controls in the same Android app, see Rethink DNS + Firewall + VPN. On Linux, OpenSnitch reviews which programs connect. NetGuard stays on Android phones and tablets.¹

Frequently asked questions

Is NetGuard free?

Yes for everyday blocking. Only some advanced features are paid.² On Play they are an in-app purchase. The donation form is preset to €7.77, and the site asks for at least €7 for lasting activation. Less than that turns pro features on once.⁴

Is NetGuard safe?

It is a local firewall with public source, and the developer says the app list stays on the phone.⁵ It does not encrypt allowed traffic or hide your IP address.² A 2024 report on version 2.330 found Play Billing telemetry to Google.⁸

Does NetGuard work on iPhone?

No. It is for Android phones and tablets. Version 2.337 needs Android 6.0 or newer. The README and FAQ still list Android 5.1.¹²³

Can NetGuard run next to another VPN?

No, when the other app also uses Android’s VPN service. Only one app can hold it, and the FAQ says there is no plan to add VPN support.²⁶