"Block when DNS is bypassed"

[an0o0oo00o00o0o00onymo0o000o0o0ooo0o0us]

It seems a lot of my issues with apps are solved when "Block when DNS is bypassed" is turned off or I "Bypass Universal" for the app (which just bypasses the "Universal firewall rules" where "Block when DNS is bypassed" is located?)

Can someone give me some information on what happens instead then? I've googled it a bit but I'm still not fully clear on what is going on.

• Rethink setup: I have a WireGuard proxy setup on "Simple" mode. I use 2 on device blocklists.

For apps that require their own DNS, and bypass Rethink's; is it only the options under the "DNS" section (blocklists) that are being ignored in my case? I know when you do an IP test; there can be 2 addresses. An IP address and a DNS address. Are these "bypassed" apps atleast using my WireGuard's IP address?

It would be greatly beneficial for me to turn this "Block when DNS is bypassed" option off to be honest, so I have to do less troubleshooting. Just want to make sure first.

Thanks.

[onetimecontributor]

If you don't care about privacy, then you don't need "Block when DNS is bypassed" to be enabled. Per-app "bypass universal" allows more granular control for those who do care.
Quite often apps try to use their "preferred" DNS first, but when failed, fall back to Android's (rdns).

[onetimecontributor]

In my case, it's just few apps that don't work without bypass

[ignoramous]

For apps that require their own DNS, and bypass Rethink's; is it only the options under the "DNS" section (blocklists) that are being ignored in my case.

If Rethink is running in DNS + Firewall mode:

1. Blocklists are bypassed (not ignored).
2. User-set DNS upstream (in your case, the Simple-mode WireGuard's DNS) is bypassed.

Are these "bypassed" apps atleast using my WireGuard's IP address?

In Simple-mode WireGuard, yes. Unless you've setup the app in question to "Bypass app from all proxies".

You can confirm this from Configure -> Logs -> Network. The traffic from app should appear as "proxied" (these entries appear with a white-coloured left-hand side border, and when you tap on them, the bottomsheet that comes up should be labelled Proxied: ... in the top right-hand corner).

greatly beneficial for me to turn this "Block when DNS is bypassed" option off to be honest, so I have to do less troubleshooting

Which apps don't work with this setting turned ON? Those apps are suspect if you don't really "trust" its developers. You should instead consider "Bypass Universal" or "Bypass DNS & Firewall" (bypasses all global domain & IP rules, including DNS blocklists; will not bypass per-app domain & IP rules) apps you "trust".