Lantern
On-device DNS firewall and real-time network monitor.
On-device DNS firewall that sinkholes trackers via local synthetic responses and attributes every lookup to apps.
- Platform
- Android 10+ (min SDK 29)
- Approach
- On-device VpnService DNS firewall
- Behaviour
- Sinkholes trackers, zero telemetry
- Architecture
- Multi-module Gradle, Clean MVI
- 80,000+
- threat domains indexed
- <0.05ms
- local sinkhole latency
- 2,048
- entries in DNS TTL cache
- 3-tier
- automated test suite
In the app
What it is
Lantern establishes an on-device Android VpnService tunnel to intercept raw IPv4/UDP byte streams, resolving safe queries while actively sinkholing ad, telemetry, and tracking domains with synthetic 0.0.0.0 and NXDOMAIN responses in under 0.05ms. It features an in-memory reverse suffix trie, encrypted DoH/DoT upstream transports, /proc/net/udp socket attribution, and forensic CSV/JSON data export.
- 01
An app initiates DNS query
Any time an app makes a network connection, it issues a DNS lookup over UDP port 53.
- 02
Lantern intercepts UDP byte stream
The local VpnService captures port 53 packets via sentinel DNS routing (10.0.0.2). All non-DNS TCP/UDP user payload bypasses the tunnel completely.
- 03
Kernel socket attribution
Lantern queries /proc/net/udp and ConnectivityManager to attribute the 4-tuple connection to the exact originating Linux UID and app package name.
- 04
O(k) Suffix Trie classification
The domain is matched backwards against 80,000+ malicious domains in O(k) time. Clean domains proceed; blacklisted trackers are sinkholed with synthetic 0.0.0.0/NXDOMAIN replies in <0.05ms.
- 05
Encrypted upstream & batch logging
Permitted queries are resolved over encrypted DoH (RFC 8484) or DoT (RFC 7858) using protected sockets. Telemetry records are batched in a mutex memory buffer and written to Room without blocking the UI.
What it does
Active tracker sinkholing
Stops analytics, telemetry, and spyware at the packet boundary before any outbound connection can be established.
Encrypted DoH & DoT
Prevents ISP snooping and DNS spoofing by upgrading traditional plaintext DNS to encrypted TLS or HTTPS upstreams.
Per-app firewall bypass
Selectively exclude sensitive applications (banking, enterprise VPNs) directly at the Android OS kernel level.
Forensic data export
Export comprehensive session DNS logs in RFC 4180 CSV or JSON formats for offline security auditing and analysis.
How it works
- 1
App
UDP 53 query
- 2
VpnService tunnel
10.0.0.2/32 sentinel
- 3
Socket attribution
/proc/net/udp -> UID
- 4
Reverse suffix trie
O(k) domain verdict
- 5
Sinkhole / Encrypted DNS
0.0.0.0 or DoH/DoT
- 6
Batched log
Room, 50 items or 2s
- 7
Synthetic / Wire reply
back to app
Questions
- What does Lantern do?
- Lantern establishes a local VpnService tunnel to intercept DNS byte streams, actively sinkholing ad and telemetry domains with synthetic 0.0.0.0/NXDOMAIN answers in <0.05ms, while routing permitted queries through encrypted DoH/DoT resolvers.
- Does Lantern block trackers or just audit?
- Lantern actively blocks trackers. It features on-device DNS sinkholing that returns synthetic 0.0.0.0 or NXDOMAIN responses to cut off tracking at the socket layer.
- Does Lantern route all my device traffic?
- No. Only DNS queries enter the tunnel via a sentinel address (10.0.0.2). All application TCP/UDP payloads bypass the tunnel completely. Lantern never sees your user content.
- How does Lantern evaluate 80,000+ domains without lag?
- Lantern indexes threat domains in an in-memory Reverse Suffix Trie. Lookups cost only O(k) time relative to domain label length rather than list size, executing in sub-millisecond speeds.
- What Android version does Lantern require?
- Android 10 or newer (min SDK 29), utilizing /proc/net/udp connection scanning and modern VpnService APIs with zero root permissions.
Under the hood
Sentinel routing instead of full VPN tunnel
Rather than routing device-wide internet traffic, Lantern routes only the sentinel DNS address into the VPN. Battery consumption is negligible, and Lantern physically cannot see user payload bytes.
Zero-dependency packet parsing
Lantern decodes raw byte buffers from the TUN file descriptor by hand—parsing IP and UDP headers and DNS wire format directly to achieve minimal memory allocation and sub-millisecond response latency.
Reverse suffix trie for O(k) threat lookup
Domains are stored label-by-label from right to left (e.g. ['com', 'tracker', 'ad']). Matching costs only the length of the query string O(k), independent of whether the blacklist contains 80,000 or 1,000,000 domains.
Local sinkholing vs plain auditing
Rather than just watching trackers phone home, Lantern constructs a synthetic DNS answer pointing to 0.0.0.0 or NXDOMAIN, neutralizing trackers on-device with zero network latency.
Mutex-buffered asynchronous Room logging
High-frequency packet streams are accumulated into an in-memory ring buffer and flushed to Room in atomic batches (50 records or 2s timeout), keeping the main thread and packet loops 100% stutter-free.
Modern encrypted DNS transports
Equipped with custom HTTP/2 DoH (RFC 8484) and TLS DoT (RFC 7858) socket pipelines with a 2,048-entry TTL cache, keeping external queries private from local networks and ISPs.
Strict multi-module architecture & 3-tier testing
Decoupled into modular core-networking, domain, and data layers with unit tests, Flow Turbine assertions, and Robolectric JVM emulation, ensuring complete testability without a physical device.
Stack
- Language
- Kotlin 2.0+, Coroutines, Flow
- UI & Design
- Jetpack Compose, Material 3, Geist font
- Dependency injection
- Hilt
- Networking
- Android VpnService, protected sockets, Raw UDP wire format
- Encrypted DNS
- DoH (RFC 8484), DoT (RFC 7858)
- Classification
- In-memory Reverse Suffix Trie (80,000+ domains)
- Attribution
- /proc/net/udp socket scanner + ConnectivityManager
- Storage
- Room SQLite, Mutex batch flushing
- Testing
- JUnit 5, MockK, Turbine, Robolectric
- SDK range
- Min SDK 29 (Android 10), Target SDK 35
Written about
More from the same desk