I made a script to import the Rethink configurations into Netguard: per-app allow/deny and domain+ip whitelists. This lets you test whether you have a configuration issue or a Rethink bug (Motivated by #2243). Although you can set apps to isolate (i.e. whitelist-only), those apps where you actually need that will unfortunately not work: A handful of domains of in the Rethink settings will become pages and pages of RARP domains in the Netguard settings. Some (simpler) whitelist-only apps will work after you clear their caches in the Android settings.

I did it step-by-step with the help of Chatgpt, here is its summary prompt:

🔧 GOAL

Generate a fully importable NetGuard XML configuration file that reproduces the behavior defined by RethinkDNS SQLite exports, while preserving and integrating any existing manual NetGuard edits.

🧩 INPUT FILES

All RethinkDNS exports come from SQLite SELECT statements with known column order:

App list

SELECT ai.packageName, ai.appName, ai.uid, ai.firewallStatus, ai.connectionStatus,
       ai.screenOffAllowed, ai.backgroundAllowed, ai.isProxyExcluded, ai.isSystemApp
FROM AppInfo ai
ORDER BY ai.firewallStatus, ai.isSystemApp, ai.appName;

Domain exceptions

SELECT ai.packageName, ai.appName, cd.domain, cd.uid, cd.status
FROM CustomDomain cd
JOIN AppInfo ai ON ai.uid=cd.uid;

IP exceptions

SELECT ai.packageName, ai.appName, ci.ipAddress, ci.ruleType
FROM CustomIp ci
JOIN AppInfo ai ON ci.uid=ai.uid;

Notes:

• Some files include headers, others don’t → must autodetect.
• Schema is identical for gapps- and nogapps- variants; both must be processed.

⚙️ SEMANTIC MAPPING (Rethink → NetGuard)

App-level behavior

Persistent exceptions (always allowed even if “whitelist_only”)

com.google.android.gms
com.whatsapp
...
-> add manually

→ These apps always get wifi=1 mobile=1 screen_off=1.

🌐 DOMAIN & IP EXCEPTIONS

Domain rules (status)

IP rules (ruleType)

All rules get:

pkg="<packageName>"
version="0"
protocol="0"
time="0"
dport="0"

📁 STRUCTURAL REQUIREMENTS (NetGuard XML)

1. Start from an existing NetGuard export (to preserve the <application> and <settings> structure).

2. Update or append sections:

   • <wifi>, <mobile>, <screen_wifi>, <screen_other> for app-level permissions
   • <filter> for domain/IP rules
   • <notify>: all entries’ value="false" (no connection notifications)

3. Preserve any preexisting manual edits or custom rules (e.g., AusweisApp2).

4. Maintain valid XML header:

   <?xml version='1.0' encoding='utf-8'?>
   <netguard version="75">

5. Ensure import works (no illegal attributes, integers only where expected, e.g. no “2-65535”).

🧮 MERGING LOGIC

1. Combine all app and domain data from both gapps-* and nogapps-* sources.
2. Dedupe by (packageName, domain, block, dport).
3. Preserve all pre-existing <rule> elements from the NetGuard base file.
4. Append new ones alphabetically by pkg, then daddr.
5. Never remove or overwrite existing <filter> entries.

🔕 NOTIFICATION SETTINGS

If <notify> exists → set all:

<setting key="…" type="boolean" value="false" />

If absent → create an empty <notify/>.

🧠 OUTPUT RULES

• Output filename: netguard_config.xml (or _final.xml / _silent.xml variants).
• File must be directly importable by NetGuard without errors.
• XML declaration required.
• No Port ranges (2-65535 → invalid).
• UTF-8 encoding.

✅ CHECKLIST FOR COMPLETION

Before delivering:

• All apps from both GApps + NoGApps lists mapped correctly.
• All domain/IP exceptions (status 0/1/2, ruleType 0) included.
• Persistent “always-on” exceptions granted full network access.
• All notifications set to off.
• File validates as XML and imports cleanly into NetGuard (no NumberFormatException).
• No redundant duplicates in <filter>.
• Manual additions (e.g., AusweisApp2) retained.

rethink-to-netguard.py