NetCage
NetCage is a per-app firewall for Android. Pick any installed app and cut its internet access — foreground and background, Wi-Fi and mobile — with one switch.
It works through Android's VPN slot. NetCage builds a local tunnel that goes nowhere and routes only the apps you cage into it. Their connections are refused on your device, so a caged app reports no internet straight away. Nothing is forwarded, and no page, message or address you visit is ever read or logged. Apps you have not caged are untouched.
Package com.aoneahsan.netcage. Version 2.0.0 is prepared for release on Google Play. It is not published yet.
What you can do with it
- Cage an app with one toggle, and release it just as fast.
- Cage on one transport only — an app that may use Wi-Fi but never mobile data, or the reverse.
- Cage a whole category — every browser, game or social app currently shown, in one tap, with undo.
- Group apps into profiles for work, travel or study, and activate a profile in one action.
- Run schedules: recurring windows that cage a profile or a single app, including overnight.
- Grant a day pass: let one caged app back online for a few minutes, after which it re-cages itself.
- Control it without opening the app — a Quick Settings tile and home-screen widgets.
- Sync your setup across your own phones with optional Google sign-in.
Who it is for
Someone who wants a specific app off the network and does not want to uninstall it: a game that phones home, an app that syncs in the background, something you are trying to use less. NetCage blocks that app and leaves the rest of the phone alone.
It needs Android 8.0 or newer. It does not need root.
What it is not
- Not an ad blocker or a content blocker. NetCage does no domain filtering, no hosts file, no DNS interception and no content blocking of any kind. It blocks an app entirely, or not at all.
- Not a packet inspector. To refuse a caged app's connection NetCage reads the destination address and port at the front of the packet, and nothing else — never the contents, never a hostname. Nothing is stored, forwarded or transmitted.
- Not a proxy or a remote VPN. There is no server on the other end of the tunnel. That absence is the mechanism — see How it works.
Where to go next
| If you want to | Read |
|---|---|
| Understand the mechanism | How it works |
| Get it running properly, including at boot | Install and setup |
| Use the list, filters, bulk actions and icons | Caging apps |
| Group apps together | Profiles |
| Cage on a timetable, or let one app out briefly | Schedules and day passes |
| Control it from the shade or the home screen | Widgets and the Quick Settings tile |
| Sync between two phones | Account and sync |
| Know exactly what is seen and sent | Privacy |
| Know what it cannot do | Limitations |
| Ask a specific question | FAQ |