# celzero/rethink-app architecture

> Architecture diagram of the GitHub repository celzero/rethink-app, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/celzero/rethink-app
- Repository: https://github.com/celzero/rethink-app

## Overview

Rethink DNS + Firewall + VPN is an Android network-protection client: users choose DNS, firewall, or VPN/proxy behavior, then app traffic is routed, filtered, and monitored. The README documents multiple DNS protocols, per-app split tunneling, WireGuard and proxy transports, and activity-based firewall rules. Source excerpts support the VPN service, DNS transport selection, and firewall decision components; broader endpoint configuration and monitoring capabilities are represented at their exact enclosing directories because their implementation was not sampled.

Main entry points: [`app/src/main/java/com/celzero/bravedns/service/TunFlowManager.kt`](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/TunFlowManager.kt) (Tunnel flow), [`app/src/main/java/com/celzero/bravedns/service/TunFirewallManager.kt`](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/TunFirewallManager.kt) (Flow firewall), [`app/src/main/java/com/celzero/bravedns/tunnel/TunDnsManager.kt`](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/tunnel/TunDnsManager.kt) (DNS routing), [`app/src/main/java/com/celzero/bravedns/service/BraveVPNService.kt`](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/BraveVPNService.kt) (VPN service)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_app["App interface"]
  node_home["Home and settings"]
  node_logui["Logs and statistics"]
end

subgraph group_traffic["Traffic protection"]
  node_vpnservice["VPN service<br/>[BraveVPNService.kt]"]
  node_tunflow["Tunnel flow<br/>[TunFlowManager.kt]"]
  node_tunfirewall["Flow firewall"]
  node_dnsmanager["DNS routing<br/>[TunDnsManager.kt]"]
  node_wgmanager["WireGuard tunnels"]
  node_proxymanager["Proxy transports<br/>[ProxyManager.kt]"]
  node_rpn["Rethink Proxy Network"]
end

subgraph group_config["Rules and transports"]
  node_firewall["App firewall rules<br/>[FirewallManager.kt]"]
  node_domainrules["Domain rules"]
  node_iprules["IP rules<br/>[IpRulesManager.kt]"]
  node_dnsresolver["DNS transports"]
  node_blocklists["DNS blocklists"]
  node_accessibility["Foreground tracking"]
end

subgraph group_observability["Network monitoring"]
  node_connmonitor["Connection monitor"]
  node_dnslogs["DNS query logs<br/>[DnsLogTracker.kt]"]
  node_netlogs["Network logs<br/>[NetLogTracker.kt]"]
end

subgraph group_state["Persistent state"]
  node_database[("App and rules store<br/>[AppDatabase.kt]")]
  node_logdatabase[("Traffic log store<br/>[LogDatabase.kt]")]
end

node_user(("Android user"))
node_network(("Network"))

node_user -->|"configures modes"| node_home
node_home -->|"starts protection"| node_vpnservice
node_vpnservice -->|"captures traffic"| node_tunflow
node_tunflow -->|"evaluates flows"| node_tunfirewall
node_tunfirewall -->|"checks app rules"| node_firewall
node_tunfirewall -->|"checks IP rules"| node_iprules
node_tunfirewall -->|"checks domain rules"| node_domainrules
node_tunfirewall -->|"allows or blocks"| node_network
node_accessibility -->|"updates foreground state"| node_firewall
node_tunflow -->|"routes DNS queries"| node_dnsmanager
node_dnsmanager -->|"selects transport"| node_dnsresolver
node_dnsmanager -->|"checks connection policy"| node_firewall
node_dnsmanager -->|"applies DNS policy"| node_blocklists
node_tunflow -->|"uses configured tunnels"| node_wgmanager
node_tunflow -->|"uses proxy routes"| node_proxymanager
node_proxymanager -.->|"dispatches RPN traffic"| node_rpn
node_vpnservice -->|"starts tracking"| node_connmonitor
node_vpnservice -->|"starts tracking"| node_netlogs
node_dnsmanager -->|"tracks query decisions"| node_dnslogs
node_connmonitor -->|"persists connections"| node_logdatabase
node_netlogs -->|"persists network events"| node_logdatabase
node_dnslogs -->|"persists DNS events"| node_logdatabase
node_firewall -->|"reads and writes rules"| node_database
node_dnsresolver -->|"stores endpoints"| node_database
node_blocklists -->|"stores list settings"| node_database
node_logui -->|"reads activity"| node_logdatabase

click node_home "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/ui/HomeScreenActivity.kt"
click node_vpnservice "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/BraveVPNService.kt"
click node_tunflow "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/TunFlowManager.kt"
click node_tunfirewall "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/TunFirewallManager.kt"
click node_firewall "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/FirewallManager.kt"
click node_domainrules "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/DomainRulesManager.kt"
click node_iprules "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/IpRulesManager.kt"
click node_dnsmanager "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/tunnel/TunDnsManager.kt"
click node_dnsresolver "https://github.com/celzero/rethink-app/tree/main/app/src/main/java/com/celzero/bravedns/database"
click node_wgmanager "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/WireguardManager.kt"
click node_proxymanager "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/ProxyManager.kt"
click node_rpn "https://github.com/celzero/rethink-app/tree/main/app/src/main/java/com/celzero/bravedns/rpnproxy"
click node_blocklists "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/RethinkBlocklistManager.kt"
click node_accessibility "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/util/BackgroundAccessibilityService.kt"
click node_connmonitor "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/ConnectionMonitor.kt"
click node_dnslogs "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/DnsLogTracker.kt"
click node_netlogs "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/NetLogTracker.kt"
click node_logui "https://github.com/celzero/rethink-app/tree/main/app/src/main/java/com/celzero/bravedns/ui"
click node_database "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/database/AppDatabase.kt"
click node_logdatabase "https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/database/LogDatabase.kt"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_home,node_logui,node_user toneBlue
class node_vpnservice,node_tunflow,node_tunfirewall,node_dnsmanager,node_wgmanager,node_proxymanager,node_rpn toneAmber
class node_firewall,node_domainrules,node_iprules,node_dnsresolver,node_blocklists,node_accessibility toneMint
class node_connmonitor,node_dnslogs,node_netlogs toneRose
class node_database,node_logdatabase,node_network toneIndigo
```

## Components

### App interface

- [Home and settings](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/ui/HomeScreenActivity.kt): `app/src/main/java/com/celzero/bravedns/ui/HomeScreenActivity.kt`
- [Logs and statistics](https://github.com/celzero/rethink-app/tree/main/app/src/main/java/com/celzero/bravedns/ui): `app/src/main/java/com/celzero/bravedns/ui`

### Traffic protection

- [VPN service](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/BraveVPNService.kt): `app/src/main/java/com/celzero/bravedns/service/BraveVPNService.kt`
- [Tunnel flow](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/TunFlowManager.kt): `app/src/main/java/com/celzero/bravedns/service/TunFlowManager.kt`
- [Flow firewall](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/TunFirewallManager.kt): `app/src/main/java/com/celzero/bravedns/service/TunFirewallManager.kt`
- [DNS routing](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/tunnel/TunDnsManager.kt): `app/src/main/java/com/celzero/bravedns/tunnel/TunDnsManager.kt`
- [WireGuard tunnels](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/WireguardManager.kt): `app/src/main/java/com/celzero/bravedns/service/WireguardManager.kt`
- [Proxy transports](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/ProxyManager.kt): `app/src/main/java/com/celzero/bravedns/service/ProxyManager.kt`
- [Rethink Proxy Network](https://github.com/celzero/rethink-app/tree/main/app/src/main/java/com/celzero/bravedns/rpnproxy): `app/src/main/java/com/celzero/bravedns/rpnproxy`

### Rules and transports

- [App firewall rules](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/FirewallManager.kt): `app/src/main/java/com/celzero/bravedns/service/FirewallManager.kt`
- [Domain rules](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/DomainRulesManager.kt): `app/src/main/java/com/celzero/bravedns/service/DomainRulesManager.kt`
- [IP rules](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/IpRulesManager.kt): `app/src/main/java/com/celzero/bravedns/service/IpRulesManager.kt`
- [DNS transports](https://github.com/celzero/rethink-app/tree/main/app/src/main/java/com/celzero/bravedns/database): `app/src/main/java/com/celzero/bravedns/database`
- [DNS blocklists](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/RethinkBlocklistManager.kt): `app/src/main/java/com/celzero/bravedns/service/RethinkBlocklistManager.kt`
- [Foreground tracking](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/util/BackgroundAccessibilityService.kt): `app/src/main/java/com/celzero/bravedns/util/BackgroundAccessibilityService.kt`

### Network monitoring

- [Connection monitor](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/ConnectionMonitor.kt): `app/src/main/java/com/celzero/bravedns/service/ConnectionMonitor.kt`
- [DNS query logs](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/DnsLogTracker.kt): `app/src/main/java/com/celzero/bravedns/service/DnsLogTracker.kt`
- [Network logs](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/service/NetLogTracker.kt): `app/src/main/java/com/celzero/bravedns/service/NetLogTracker.kt`

### Persistent state

- [App and rules store](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/database/AppDatabase.kt): `app/src/main/java/com/celzero/bravedns/database/AppDatabase.kt`
- [Traffic log store](https://github.com/celzero/rethink-app/blob/main/app/src/main/java/com/celzero/bravedns/database/LogDatabase.kt): `app/src/main/java/com/celzero/bravedns/database/LogDatabase.kt`

### Other components

- **Android user**
- **Network**

## Connections

- Android user → Home and settings: configures modes
- Home and settings → VPN service: starts protection
- VPN service → Tunnel flow: captures traffic
- Tunnel flow → Flow firewall: evaluates flows
- Flow firewall → App firewall rules: checks app rules
- Flow firewall → IP rules: checks IP rules
- Flow firewall → Domain rules: checks domain rules
- Flow firewall → Network: allows or blocks
- Foreground tracking → App firewall rules: updates foreground state
- Tunnel flow → DNS routing: routes DNS queries
- DNS routing → DNS transports: selects transport
- DNS routing → App firewall rules: checks connection policy
- DNS routing → DNS blocklists: applies DNS policy
- Tunnel flow → WireGuard tunnels: uses configured tunnels
- Tunnel flow → Proxy transports: uses proxy routes
- Proxy transports → Rethink Proxy Network: dispatches RPN traffic
- VPN service → Connection monitor: starts tracking
- VPN service → Network logs: starts tracking
- DNS routing → DNS query logs: tracks query decisions
- Connection monitor → Traffic log store: persists connections
- Network logs → Traffic log store: persists network events
- DNS query logs → Traffic log store: persists DNS events
- App firewall rules → App and rules store: reads and writes rules
- DNS transports → App and rules store: stores endpoints
- DNS blocklists → App and rules store: stores list settings
- Logs and statistics → Traffic log store: reads activity