Firewall for Android · no root required

Demarc shows every connection your Android apps make, and lets you block the ones you don't want.

Block by app, by site, by country or on a schedule — and see what you blocked. Every decision is made on the phone. There is no account, no server, and nothing about your traffic leaves the device.

Get it on Google Play See how it works User guide
Your apps The internet
demarc
Play Store
Maps
Ad SDK
Weather

What you see

Connections, lookups and totals

Read as the traffic passes, with no sampling interval and no server in between.

Connections

Every TCP and UDP flow: the app that opened it, the host and port it reached, its state, and bytes in and out.

DNS lookups

Every name an app resolves and the addresses it resolved to. Names are how you tell destinations apart when the address belongs to a CDN shared by thousands of sites.

Data in / out

Upload and download per app and device-wide, including how much moved while the screen was off and how much of it was unencrypted.

How it works

A firewall that knows which app is talking

Most firewalls see addresses. Demarc sees the app behind each connection, which is what makes a rule like "this app, this destination, not after midnight" something you can actually write.

  1. 01

    Sees every connection

    Outbound traffic from every installed app, as it happens: where it is going, on which port, and the name it looked up to get there.

  2. 02

    Names the app behind it

    Each connection is attributed to the app that opened it, without root and without a profile to install. Needs Android 10 or newer.

  3. 03

    Applies your rules

    Your ordered list decides: allow, block or alert. First match wins, and anything no rule mentions falls through to the default you set.

Features

One app, no tiers

Everything below runs on every install. There is no paid tier and nothing to unlock, because there is no server behind the app to pay for.

Watch
See what your apps are doing
  • Live connections and flows, per app
  • DNS lookups, and what they resolve to
  • Per-app & device data totals
  • Per-app detail: flows, lookups, destinations
  • Data-leak analysis and per-app privacy grades
  • Packet capture to .pcap, opens in Wireshark
  • TLS hostname (SNI) & JA3, without decrypting
  • Country & network operator on every destination
  • Behavioural detection: beaconing, DNS tunnelling, weak TLS
  • Threat-intelligence alerts on known-bad endpoints
  • Network-change alerts: resolver, gateway or proxy
  • Security report, exportable as JSON
Guard
Act on what you find
  • Per-app firewall: cut an app off entirely
  • Rules: app × destination × port × schedule
  • Build a rule straight from a connection you are looking at
  • Ad, tracker & malware blocking
  • Ten blocklists across ten categories, none on by default
  • Encrypted DNS (DoH/DoT), with an option to force apps onto it
  • Block by country, network operator or protocol
  • Default-deny mode, per app or device-wide
  • Auto-quarantine, and a one-tap lockdown tile

Three features reach the network, each off until you switch it on: blocklist downloads, the offline country database, and the encrypted DNS resolver. Everything else is matched on your phone. See all of it in the user guide →