Feature Request: Introduce Root Mode (iptables/hosts) for Zero Battery Drain and Freeing the VPN Slot

[Rootalith]

First of all, great work on this project! The current implementation using a Local VpnService is an excellent, privacy-friendly approach for non-rooted devices.
​However, I'd like to propose introducing an alternative Root Mode for users with rooted devices. While the VPN method is effective, a root-based approach would solve several inherent limitations of Android's VPN API.
​Here is why adding a Root Mode would take this project to the next level:
​1. Zero Battery & RAM Drain (Kernel-Level Filtering)
Currently, the VpnService requires a persistent Foreground Service and wakelocks, which prevents the device from entering deep sleep and consumes battery/RAM. By using root privileges, we can push the filtering rules directly to the kernel level. This means the system will drop ad requests automatically with virtually zero battery consumption or background overhead.
​2. Freeing Up the Android VPN Slot
Android only allows one active VPN connection at a time. If a user is running this app, they cannot use a traditional VPN for encryption or geo-unblocking. A root implementation bypasses the need for the VPN API entirely, allowing users to block ads while simultaneously using their preferred VPN provider.
​3. Catching Hardcoded DNS (Rebellious Apps)
Some applications ignore the system's DNS settings and use their own hardcoded DNS servers. The standard local VPN might miss these requests. With root access, we can force all traffic (specifically Port 53) to pass through the filter, ensuring total coverage.
​Proposed Implementation Ideas:
​iptables Integration: Execute root commands to configure iptables firewalls, dropping traffic to known ad servers or redirecting port 53 traffic to a local blackhole.
​Systemless hosts Modification: Generate a comprehensive hosts file from the blocklists and mount it systemlessly (compatible with Magisk / KernelSU) to avoid modifying the read-only system partition.
​Ideally, the app could feature a "Hybrid Toggle" in the settings, allowing users to choose between VPN Mode (default) and Root Mode.
​Looking forward to hearing your thoughts on this!

[Klusek1983]

The ideal solution would be to block using root, but with the ability to add applications to blocking exceptions.From what I've noticed, probably all applications that block using root don't have this option. The only app I know of that uses root and has this capability is Adguard. Unfortunately, I'm not a technical expert, so I could be wrong.

[Rootalith]

Hi @Klusek1983,
​That is a fantastic point, and you are completely right!
​Most basic root adblockers (like those that only modify the /etc/hosts file) cannot exclude specific apps because the entire Android system relies on that single file for DNS resolution.
​However, if the developer implements the iptables (or nftables on newer Android versions) approach I mentioned above, per-app exclusion is 100% possible! Here is how it works under the hood: Android assigns a unique Linux User ID (UID) to every installed application. With root access and iptables, the app can simply inject a rule into the kernel saying: "Route all port 53 traffic through the ad-blocker, EXCEPT if the traffic originates from UID 10155 (e.g., your Banking App or a specific game)." This is exactly the method AdGuard uses when operating in Root Mode to allow per-app bypassing.
​So, if the iptables route is chosen, we get the absolute best of both worlds: Zero battery drain + full per-app bypass capabilities! It would be an amazing addition to this project.

[Rootalith]

Update: Tested with local Unbound resolver, and it's amazing!
​I wanted to share a quick update with you. I just tested your app alongside the Unbound Magisk module. I simply used your app's Custom DNS feature and pointed it to my local Unbound address (127.0.0.1:5353), as you can see in the attached screenshots. It works flawlessly together!
​I currently rely on NextDNS, but seeing how perfectly your app handles local blocklists, it proves that with your app, we can completely ditch external/third-party DNS services. Your app keeps the filtering entirely local and private, which is fantastic.
​This is exactly why the Root Mode idea is so exciting. If you implement root-level filtering (via iptables), power users will get an enormous advantage. It would allow them to run your brilliant ad-blocker seamlessly with local resolvers like Unbound, resulting in the ultimate, lightweight, zero-battery-drain privacy setup.
​You have built a truly special app here. The UI is clean, the core logic is solid, and with root support, this could easily become the absolute best open-source ad-blocker for Android enthusiasts.
​Keep up the fantastic work, you have my full support on this project! 🚀

[minhnq1-apero]

Hi @Rootalith and @Klusek1983 I was develop this feature, could you please give a try on debug version then tell me your feedback:https://github.com/pass-with-high-score/blockads-android/actions/runs/23554538716