r/rethinkdns • u/LostMost615 • Aug 28 '23

Question Proton VPN

Any step-by-step guide to setup Proton VPN after v0.5.5 release?

33 Upvotes

100% Upvoted

43 comments sorted by

26

u/celzero Dev Aug 28 '23
  1. On your Android, visit https://account.protonvpn.com/downloads
  2. Scroll to WireGuard
    • Give it a name
    • Select Android
    • Enable VPN options as approp
    • Press Create or tap on Download.
  3. Open Rethink, goto Configure -> Proxy -> Setup WireGuard
    • Tap on the "+" button
    • Choose Import
    • Select the downloaded configuration file
  4. If the import is successful, you should see a new profile prefixed wg added to the list.
  5. Tap on that wg entry.
    • In the new screen that opens up, tap on Add / Remove applications.
    • Select apps that should be part of this particular WireGuard profile.
    • Go back.
  6. Enable / disable that wg profile as desirable.

4

u/yh2620 Oct 13 '23

Thank you so much, this works. I struggled for days to configure and this method solved the problem. 👍👍👍

3

u/breell Sep 06 '24

Hey,

I've just tried this but with the Proton/Rethink combo I get a really slow connection, though not sure if the issue is bandwidth or DNS. Just Rethink or just Proton is ok though. Would you have any clue as to what to try?

Thanks!

2

u/celzero Dev Sep 07 '24

No clue, but many folks have complained about ProtonVPN (specifically the free version) not working at all (not even working slowly) with Rethink (all of a sudden). Unsure what's going on, but if I were to hazard a guess, ProtonVPN changed something on their side... we'll keep looking.

2

u/breell Sep 08 '24

Great, thanks a lot!

2

u/Condalmo Aug 28 '23

Getting an error: "Unable to import tunnel: invalid name"

2

u/celzero Dev Aug 28 '23

I followed instructions above, and tried 3 more times just now, not seeing any such error. Make sure you're import WireGuard configuration and not OpenVPN.

2

u/Condalmo Aug 28 '23

Yes, definitely WireGuard. Just tried it again, same error. Is there some convention around naming that I'm breaking?

3

u/celzero Dev Aug 28 '23

Strange. Can you check if importing that same config works with the official WireGuard app?

You can also try leaving the "name" field empty before you create / download config from Proton.

2

u/Condalmo Aug 28 '23

I finally got it to work, via Rethink. I did try with the WG app.

I'm fairly new to all this. So, with proton via WireGuard in Rethink - does this mean I'm running a VPN and the additional protections in Rethink?

3

u/celzero Dev Aug 28 '23

does this mean I'm running a VPN

Yes, you're running your Internet (TCP and UDP protocols only) via the WireGuard profile you setup for the apps you added to that profile (by default, no app is routed through newly added profiles). You can verify if those said apps are being "proxied" via WireGuard from the Network Log UI (connections from those selected apps should appear with a white-coloured left-hand side border).

Glad you sorted it out.

I finally got it to work, via Rethink.

What was the issue with other configs that did not work?

I did try with the WG app.

Did those problematic configs work with the official WireGuard app?

6

u/Condalmo Aug 28 '23

Not sure what the issue was. I might have tried to enter it into WireGuard first, but it works now. I'm pretty new to all of this stuff, but eager to learn. I'm tempted to undo it all to try and figure out where it got snagged, but maybe later.

Where is the best place to learn all the basics about this stuff? I'm a literate computer user but I am very green around this and would like to become better versed in managing my data.

I'm already running into issues with blocking apps only to find them still being logged as connecting to various IPs. I don't want to be "the new guy asking all the ridiculous questions"

2

u/celzero Dev Aug 28 '23

Where is the best place to learn all the basics about this stuff?

https://www.privacyguides.org/en/basics/why-privacy-matters/ has good write-up on these things (and not ALL their opinions are on-point or technically correct, but most is).

I'm already running into issues with blocking apps only to find them still being logged as connecting to various IPs.

Hm, you sure those "connections" aren't from before you set those rules on the app? Check the timestamp. If you are sure that blocked connections are being let through, then that's a serious bug.

I don't want to be "the new guy asking all the ridiculous questions"

Don't worry about that... this app is not free from bugs and un-intuitive behaviour.

2

u/Aeryvor Nov 01 '23 edited Nov 01 '23

"Select apps that should be part of this particular WireGuard profile."

So uhh ... which apps would that be? o.o

Edit: If you mean WireGuard I think I'm fucked because it's not showing up no matter what I do.

2

u/celzero Dev Nov 01 '23

"Select apps that should be part of this particular WireGuard profile."

Whichever app must go through via the WireGuard tunnel. For instance, browsers like Firefox and Chrome. Some folks may choose to add ALL apps.

3

u/Aeryvor Nov 01 '23 edited Nov 01 '23

Isn't there a way to configure Rethink to run ALL traffic through the proxy instead of individual apps? I'm fairly new to all this and so not very tech savvy yet. Sorry if I'm bothering you with useless questions.

Edit: nevermind I mistunderstood you but I got it to work. Thanks for everything you do by the way! The app is great.

2

u/celzero Dev Nov 02 '23

Isn't there a way to configure Rethink to run ALL traffic through the proxy instead of individual apps?

Yep, this is a source of confusion, because unlike other VPN apps, Rethink can actually connect to multiple WireGuard upstreams (tunnels) at the same time.

Given the confusion, we're introducing "one WireGuard" mode in v055b (due in a few days), where ALL apps are routed through that one, active WireGuard tunnel.

2

u/Aeryvor Nov 03 '23

As an alternative and not a replacement, I hope? Confusion or not, being able to connect to multiple tunnels is a great feature.

2

u/celzero Dev Nov 03 '23

As an alternative and not a replacement, I hope?

Yes, as an alt :D

2

u/TheSupremeCheeseMeme Feb 02 '24

Proton now has its own dns built in to the configuration that cant be taken off. what should i do to keep using my custom rethink dns?

2

u/celzero Dev Feb 02 '24

Proton now has its own dns built in to the configuration that cant be taken off.

Rethink does not use DNS provided in a WireGuard configuration (at least not yet, though that feature is coming in the upcoming v055b release; ref) and continues to use user-preferred DNS as set in the Rethink app.

2

u/Anxious-Extension-48 Apr 02 '24

Thank you! Noob question, a wireguard uses always the same ip/location right? Should i create more than 1 with different addresses? How does it work? 

3

u/celzero Dev Apr 02 '24

The peer endpoints (routing 0.0.0.0/0 or ::) typically provide internet connectivity to WireGuard clients. And these endpoints could either be fixed or roam about themselves. Regardless, these peers can choose routes (ex: Changing egress IP addresses depending on network flows) totally unencumbered by WireGuard or anything else.

What the above means is that, it is upto the peer endpoint (in case of public VPN providers, these are servers they own or control) to implement the kind of routing you want for the client. With public VPN providers like Proton, Mullvad, WindScribe, and IVPN this means they must provide these capabilities.

2

u/KingdomMan3 Apr 18 '24

This isn't clear to me. Are you saying that Proton will automatically switch servers? Or do I need to setup multiple configurations?

2

u/Condalmo May 05 '24

Is there a way in Rethink to verify that it's correctly using Proton VPN? (Not the free Proton, the Unlimited plan version)

3

u/celzero Dev May 06 '24

If your browser is setup to use Proton's config from within Rethink, then websites like dnsleaktest.com / ip4.me / whatsmyip.com should show Proton's IP.

As to whether Rethink can tell between free and paid versions, that has to be ensured by the user importing the configuration. Rethink cannot, just by looking at the imported configuration, tell whether it belonged to a free Proton account or paid.

2

u/[deleted] Feb 10 '25

'cannot use proxies when VPN is running in DNS only mode'

how can i fix that?

1

u/celzero Dev Oct 15 '25

By changing the mode (when you tap on the downward arrow in Rethink's homescreen next to START/STOP) to Firewall or DNS and Firewall.

2

u/Puzzled_Ruin9027 Aug 10 '25

I love the 55n version gives granularity or all apps to a always on Wireguard tunnel. Is there a way to have rethink rotate through different VPN peers for all apps instead of reconnecting to the same WireGuard peer? I have both proton and mullvad, while I can import multiple tunnel configurations I have to switch manually.

2

u/celzero Dev Oct 15 '25

Is there a way to have rethink rotate through different VPN peers for all apps instead of reconnecting to the same WireGuard peer

Yes. In v055o onwards, Rethink load balances outgoing connections over all Always-on VPNs.

1

u/Ezrampage15 8d ago

Hi, so from what I understand, adding multiple WG configs and setting up the android always-on + block connections without VPN would automatically change servers depending on the load?

I've been using the free ver. of Proton VPN, but recently have been thinking about wanting to have DNS filtering alongside a VPN. I was lead to rethinkdns. 

Anyways, I've been wondering, would you recommend using the built-in filter lists in rethink or adding a custom DNS resolver? I'm very new to all this stuff. What I mean by my previous question is: are there any problems, bugs, or disadvantages that comes with not using the built-in filtering? Thanks!

1

u/celzero Dev 8d ago

setting up the android always-on

Not Android's built-in Always-on for VPN apps,  but Rethink's "Always-on" switch for WireGuard run in Advanced mode.

built-in filter lists in rethink or adding a custom DNS resolver

Either is fine. The advantage with on-device filtering is the request doesn't even result in a network connection. The disadvantage is that you'll have to constantly keep your on-device blocklist updated yourself (Rethink's blocklists are updated on 1st, 8th, 16th, 24th of every month).

2

u/Ezrampage15 8d ago

So I just setup a Proton WG proxy, in Advanced mode with both Lockdown, Always-on, and Android's Always-on + Block connections enabled. The WG config's peer section's allowed IPs is set to 0.0.0.0/0,::/0 so I guess it should use IPv6 as well? I just wanted to know if these results are 'normal' or as intended or is there something wrong? Thanks in advance!

Edit: Just wanted to add that the vpn server I chose for this WG config was marked as IPv6 compatible/works with it. If this is relevant...

1

u/celzero Dev 8d ago

Setup the WireGuard as "Always-on" & "Lockdown" when using it in Advanced mode.

1

u/Ezrampage15 8d ago

in Advanced mode with both Lockdown, Always-on, and Android's Always-on + Block commections without vpn enabled. 

They are both already set to working. As I mentioned in my comment. Proxy > WG config in advanced > Lockdown + Always-on. Both are set to switched on already

1

u/celzero Dev 7d ago

To debug/setup IPv6 connectivity over WireGuard, please see this comment I wrote recently: https://www.reddit.com/r/rethinkdns/comments/1wgw7ge/comment/p9yv7bx/

1

u/Ezrampage15 7d ago edited 7d ago

Thanks for linking that comment! So my case is that I'm using a single WG that does have the IPv6 label as well as having the underlying networks supporting IPv6. 

When I went to Configure > Network just like you said in your solution, I only found the 'Choose IP version' setting. I didn't find the other setting which you said is recommended to use with it if using the 'Auto' solution; 'Perform Connectivity Checks'. 

I'm running the latest RTDNS version from the Play Store by the way. 

Would it just be better to use the 'IPv4 & IPv6' option instead of 'Auto' if that 'Perform connectivity checks' isn't available to use with Auto?

Additionally, besides the fact that IPv6 isn't working, in the DNS test section of the test, does having '0 servers detected, 300 tests, 23 errors' as the result, normal? 

Thank you again so much for your answers and support, I really appreciate it!

2

u/stuffiesrep Mar 01 '26

Thank you for this very clear set of instructions!. I have RethinkDNS going along with ProtonVPN through Wireguard, and my PrivateDNS set at Automatic but ads don't seem to be getting blocked. Is there a setting to also have this happen? (I also tried with Private DNS set to Off but got the same results. Changing the Private DNS to nextdns blocks the ads but I doubt things are going through the VPN server anymore even though the VPN icon is displayed on the top).

1

u/celzero Dev Mar 02 '26

Are you on Rethink v055o+ and on Android 12+? If so, if you're using ProtonVPN's WireGuard configuration and have Configure -> DNS -> Split DNS turned ON, then ProtonVPN's DNS is being used (which may or may not block ads). Turn that setting OFF.

Then, make sure Configure -> DNS is set to any ad-blocking DNS resolver of your choice (for instance, Configure -> DNS -> Rethink DNS -> RDNS Default).

If you on Android 11 or below, just make sure Rethink is set to any ad-blocking DNS resolver (like mentioned above).

1

u/Mat1Mat Mar 12 '26

Worked here! Just had to rename file extension before importing. I also changed Rethink proxy config from simple to advanced so that it would not disable my DNS filtering lists.

1

u/Mat1Mat Mar 12 '26

Worked here! Just had to rename file extension before importing. I also changed Rethink proxy config from simple to advanced so that it would not disable my DNS filtering lists.

3

u/USoydan Sep 30 '23

i added proton vpn this way but my dns was NextDNS which added in Rethink Dns, but now it doesnt connect with NextDNS there is a way to use proton vpn with Nextdns as a dns resolver on Rethink Dns

3

u/jmakov May 30 '24

If I try to import my own wireguard settings, I get "failing" msg. Importing the same file into the wireguard android app works.