NetCage is a per-app firewall: choose a listed app, and Android routes only that app into an on-device tunnel where its connections are refused, while apps you have not caged keep their normal route.
Open the app list, choose a listed app, then close its Wi-Fi route, mobile route or both. There is no domain or hostname to enter because the boundary is the whole app. Release it with the same switch.
NetCage explains the local VPN before Android shows its own consent dialogue. Grant consent, choose an app and the cage can start. Nothing is caged until you choose it. Android requires an ongoing foreground-service notification while the tunnel is active, and where it appears depends on notification permission: the notification drawer when allowed, or Android’s active-apps task manager when denied.
A profile holds a named set of apps, such as Work or Study. Apply it once, edit its members later, and keep each imported profile inactive until you choose to use it.
Set chosen days and times for an app or profile. Recovery after a reboot needs Auto-start on boot, the master cage enabled, and saved rules or schedules. They also account for clock changes. A day pass releases the target until its set end time, then the cage returns.
Pin selected apps to the home-screen widget or use the Quick Settings tile for the master cage switch. Android still needs VPN consent before either control can start the tunnel for the first time.
Search, sort, filter by category and use real app icons. Bulk caging includes Undo. Hidden apps stay out of the main list. A synced rule for an app missing from this phone appears under Settings › Data so you can remove it; uninstalling a local app prunes its rule.
The firewall, local profiles, schedules, day passes, widget, tile, export and import work while you’re signed out. Google sign-in adds cloud backup and restore, in-app support replies, cloud storage for custom icons and the ability to publish a Cage Pack.
A Cage Pack is a shareable, editable profile with a name, emoji and Android package list; importing needs no account and does not turn the cage on. Publishing needs sign-in. Reporting also needs no account. The first valid report quarantines a pack from new imports while it is reviewed.
A signed-in request automatically adds bounded diagnostics only when the last cloud sync failed: step, error class, time, app build and Android API level. It never attaches caged app names. The reply returns inside NetCage.
The local event log records cage and release actions, day passes, and tunnel state changes. You can also export the portable configuration to a file and import it on another phone.
Apps outside a caged Android UID keep their normal route. A selected app and any shared-UID siblings do not. See how Android’s VPN slot keeps those paths apart on this phone.
No. NetCage refuses a whole app’s network route; it does not filter ads, trackers, domains, websites, DNS answers or content inside an app you leave online, and Android allows one active VPN at a time, so another VPN replaces NetCage rather than running beside it.
No. The supported engine uses Android’s VPN slot. An alternative root engine is labelled experimental. Its command construction is unit tested, but the engine has never run on rooted hardware. The VPN engine remains the supported default and fallback.