All comparisonsRethink: DNS + Firewall + VPN and NetCageAn open-source Android app that combines a DNS resolver, a per-app firewall and WireGuard VPN connections.Last checked 7 November 2026Check Rethink: DNS + Firewall + VPN’s own pageYou can’t install NetCage todayIt has no store listing and no public download, so there’s no install link on this page and no price to quote. If you need something on your phone now, Rethink: DNS + Firewall + VPN is there to install and NetCage isn’t.Better served by Rethink: DNS + Firewall + VPNChoose Rethink if you also want encrypted DNS, blocklists and WireGuard in the same app, and you are happy to configure them.Better served by NetCageChoose NetCage if you only want to take the internet away from chosen apps and leave DNS, VPN servers and blocklists out of it.Row by rowNetCage’s column comes from its code. Rethink: DNS + Firewall + VPN’s comes from the linked pages. “Not stated” means we didn’t find it there, not that it’s missing.

Feature

Rethink: DNS + Firewall + VPN

NetCage

Blocks one chosen app’s internet

Yes f-droid.org

Yes

Keeps blocking while the app is in the background

Yes f-droid.org

Yes

Needs no root

Not stated on the pages we checked

Yes

Open source

Yes f-droid.org

Shows ads

No play.google.com

Partly. Promotions for the developer’s own apps only. No ad network.

In-app purchases

Yes play.google.com

What it costs

App: Free. Free install on Google Play; the listing carries an In-app purchases label at $0.99 - $48.99 per item. The site says the app is free and open source and the cloud DNS service will have a free and a paid tier play.google.com

NetCage publishes no price.Where NetCage falls short

It takes Android’s one VPN slot. While NetCage is up you can’t run another VPN, and connecting one stops NetCage.

Apps that share an Android user ID are caged together, and there’s no way to separate them.

A caged app can still hand a link to a browser you haven’t caged, and that browser connects as normal.

It doesn’t work inside an app: no domain rules, no block lists, no traffic log. An app is caged or it isn’t.

Rethink: DNS + Firewall + VPN is open source and NetCage isn’t, so you can read one app’s code and not the other’s.

Every limit, in the documentationComing from Rethink: DNS + Firewall + VPN?The documentation has a page on how the two differ and which of its guides to read first. Read it on the documentation siteIf a row here is wrong, tell us and we’ll open the page again. Contact