Documentation

Version 3.16.6 — major administration-tool expansion

Compared with the website’s old 3.11 line, the app now has a much larger SSH, file-transfer, LAN-scanning, backup and Wake-on-LAN feature set. This website update synchronizes the documentation with that code state.

SSH is now a full workspace

• Terminal, multiple sessions, macros and command history.
• SFTP with file operations and a background transfer queue.
• Jump Host, Known Hosts, Identity Vault, WinSCP/OpenSSH/PuTTY import and encrypted backups.
• Tunnels Pro: LOCAL, REMOTE and dynamic SOCKS5.

Network Scanner Pro and WOL PRO

• Broader host, TCP/UDP, service, inventory, history and change scanning.
• WOL PRO stores devices as profiles and keeps local wake history.
• QR and token-based automation limit calls to approved stored profiles.
• Remote Wake can wake a PC from a phone browser through Android TV on the same LAN — without ADB.

Table of contents

1. Getting started and the home screen
2. What is Free and what is Premium
3. Classic DNS, encrypted DNS, profiles and automation
4. DNS: risky switches and fields
5. Own DNS: the new local DNS firewall
6. Own DNS: switches and effects
7. Expert DNS
8. Import, export, QR and TV transfer
9. Local backup and restore
10. Wi‑Fi Analyzer and room scans
11. Internet Speed Test
12. Network tools and local statistics
13. Network Scanner Pro
14. WOL PRO and Remote Wake
15. SSH Client and tunnels
16. SSH: SFTP and Transfer Center
17. SSH: security, import and backup
18. Walkie Talkie Free and Walkie Beta QR Premium
19. Android TV, launcher, widgets and Auto/Bluetooth
20. Privacy and key notes

What this manual covers

This is not low-level developer documentation. It is a practical user guide: what each screen does, when to use it, where Free ends, where Premium begins and which features are intended only for phones or only for Android TV.

The documentation reflects the current local repository generation: 3.16.6 . The separate change log describes versions from the repository CHANGES-*.txt files and newer local commits.

1. Getting started and the home screen

The home screen keeps the essentials in one place: DNS VPN state, selected resolver, quick shortcuts to the main modules and the current Free/Premium status.

• Connect / Disconnect starts or stops the local DNS VPN. The app uses Android `VpnService` only for device-side DNS handling, not for country switching or for routing all traffic through a remote VPN server.
• Servers is where you choose classic DNS, DoH, DoT or a custom resolver.
• Apps lets Premium users decide whether DNS covers all apps or only selected apps.
• Tools is the diagnostics area: Wi‑Fi Analyzer, Speed Test, SSH, LAN discovery, Wake-on-LAN, Stability Monitor and other network tools.
• On Android TV the home screen also shows launcher guidance and remote-friendly navigation helpers.

Home customization in version 3.16.6:

• Settings lets you reorder, hide, restore and reset Home sections. Hiding a section does not delete its profiles, groups, favorites or commands.
• On a phone or tablet, hold and release a section or shortcut to edit it; hold and move to reorder it. On TV, use the on-screen controls and remote arrows.
• Home can show custom shortcuts, DNS profiles, app groups, favorite DNS servers and SSH commands grouped by server.

The simplest start is: pick a DNS server, press Connect, verify the status, then move into advanced modules only when you actually need them.

2. What is Free and what is Premium

Free remains a simple starting point for DNS changes. Premium is most useful when the app becomes an administration tool: Own DNS, SSH/SFTP, network scanning, WOL PRO, automation and advanced diagnostics.

3. Classic DNS, encrypted DNS, profiles and automation

The app can still stay simple, but it now has several layers of DNS control. The easiest way to understand it is to separate four levels.

• Classic DNS means manual IPv4/IPv6 resolvers or ready-made providers from the built-in library. This is the best choice when you only want a different resolver without extra logic.
• DNS-over-HTTPS and DNS-over-TLS encrypt DNS queries. DoT needs a hostname, while DoH needs a full HTTPS `dns-query` URL; the app warns when the selected address format does not match the transport.
• DNS profiles and app groups save ready-made setups. You can jump back to a “home”, “child”, “streaming” or “testing” setup with one tap.
• Smart Profiles automate switching. You define a time window, the profile that should become active and, optionally, a return profile after the window ends.

Child profile is a special Premium profile type. It saves the current DNS and app selection, and leaving that mode requires a 4-digit exit code. A separate recovery PIN exists only for regaining control if the exit code is forgotten.

DNS switches and fields that can change or break resolution

• Classic DNS / UDP is the safest mode for manually typed IP resolvers. It does not encrypt queries, but it is also the least likely to break connectivity when you enter custom values.
• DNS-over-TLS (DoT) requires a hostname, not a raw IP and not a full HTTPS URL. A wrong format is one of the easiest ways to lose internet access because the TLS certificate does not match the typed address.
• DNS-over-HTTPS (DoH) requires a full https://.../dns-query URL. A bare host or bare IP may be rejected by many providers, so presets are the safest option unless you know the exact endpoint.
• NextDNS ID is only a helper that builds the correct DoH URL from your configuration ID. The app does not create an account and does not manage rules from the NextDNS dashboard.
• Custom Control D accepts either a DoT hostname or a full DoH URL from your own account. It is flexible, but it is also easy to paste the wrong format and break DNS resolution.
• All apps / selected apps decides whether the local DNS VPN covers the whole device or only the chosen apps. In selected-app mode, anything outside the chosen list keeps using the normal network path instead of this DNS profile.
• IPv6 DNS enables DNS handling for IPv6-oriented networks and resolvers. It helps when your ISP or router really uses IPv6, but on poorly configured networks it can increase wait time or reduce stability.
• TCP fallback allows the app to retry DNS over TCP when UDP responses are truncated or fail. That can rescue restrictive networks or large DNS answers, but it may be slightly slower.
• Autostart restores the current settings or a chosen profile after Android TV boots. It is convenient, but if you save a broken setup the TV can come back to the same broken DNS state after every reboot.
• Kill Switch Assist is not a real system kill switch. It only helps you open Android VPN settings and resume the profile; hard traffic blocking requires Android Always-on VPN plus Block connections without VPN .
• Smart Profiles can switch DNS automatically on schedule. If DNS seems to change “by itself”, check the active schedule and the return profile first.

Important from the app code: when a DoT/DoH address does not match the selected transport, the app shows a warning and can suggest an automatic fix for known providers. In the Google Play build, the “selected apps” list is also limited to apps Android exposes to the app, so some system packages may never appear for manual split selection.

4. Own DNS: the new local DNS firewall

Own DNS is not just “another server preset”. It is a separate Premium mode that behaves like a small on-device DNS firewall.

• The app checks local rules and filter lists first.
• Only allowed domains are sent to the encrypted DoH or DoT upstream.
• Built-in categories include ads , trackers , malware and telemetry .
• You can add HTTPS sources, create custom `allow / block / host / redirect` rules, test a domain and refresh filters manually.

Safest first setup:

1. Open Own DNS settings .
2. Press Apply preconfigured profile to load a working base.
3. Check the encrypted upstream and correct the DoH/DoT address if needed.
4. Enable only the filter lists you actually want.
5. Run Test configuration or Test upstream connection .
6. Only after a successful test press Connect .

How to read the Own DNS screen:

• Dashboard shows active rules, today’s blocks, cache hit, queries, upstream latency, errors and the last update time.
• Test domain explains whether a domain will be blocked, allowed, redirected or answered by a custom host entry.
• Import domain list lets you paste hosts or domain lines and shows a preview of accepted and rejected entries.
• Auto-update filter lists enables background refresh of active filter sources.

Own DNS privacy: full domain logging is off by default. If you enable it, logs stay local for up to 7 days. You can clear them, export a full JSON file or export an anonymized version. Nothing is uploaded automatically.

Own DNS: switches and actions that affect the final result the most

• Apply preconfigured profile loads a safe starting point with working DoH and sample rules. It is a baseline for testing, not a finished policy for every home.
• Built-in ads / trackers / malware / telemetry are separate local block lists. Telemetry is often the most aggressive category because some apps reuse similar domains for diagnostics, configuration or sign-in flows.
• Auto-update filter lists refreshes active sources in the background. That keeps blocking fresh, but behavior can change without manual editing because a list may add or remove domains.
• HTTPS sources let you add external lists. The more lists you enable, the higher the false-positive risk, so Test domain and local allow exceptions become more important.
• Allow lets a domain pass locally even if wider filters would block it. This is the main tool for fixing false positives.
• Block blocks a domain locally before it ever reaches the upstream. It is the safest protection rule because it does not rewrite traffic.
• Host answers with a fixed IP directly on the device, without asking the upstream. It is useful for your own LAN hostnames, but a wrong IP immediately sends apps to the wrong place.
• Redirect rewrites a domain to another IP. It is the strongest and riskiest action because it can easily break sign-in, CDNs or app behavior when that domain normally resolves to multiple changing addresses.
• Decision order inside Own DNS is exceptions/allow → host → redirect → block → built-in lists → cache → encrypted upstream . That means an allow can unblock a listed domain, while host and redirect win before traffic reaches the external resolver.
• Test configuration / Test upstream connection should be run after every upstream or rule change. The app deliberately marks such a profile as needing a retest because skipping the test is one of the easiest ways to end up with no DNS.
• Domain logging stores allowed and blocked domains locally for up to 7 days. It does not break connectivity, but it does make the device more privacy-sensitive.
• Top blocked stats gives a lighter summary of the most frequently blocked domains without storing the full log. That is useful when you want diagnostics without full history.

Important from the app code: “Save configuration” only stores the profile, but it does not start filtering. “Connect” is the step that actually enables Own DNS. “Update filters now” downloads current sources immediately, and “Preview” shows which imported lines will be accepted or rejected before saving. Built-in telemetry is the only built-in category that is off by default.

5. Expert DNS

Expert DNS is for users who want local DNS overrides without switching to the full Own DNS workflow. It is still Premium, but more tool-like than protection-like.

• Custom Hosts maps local names to LAN IPs, for example `nas.local → 192.168.1.10`.
• Local DNS rules lets you add `allow`, `block` or `redirect`, including wildcards and limited regex rules.
• Test domain checks whether a domain would match a host entry or a rule.
• Import / export rules moves hosts and rules as JSON between devices.

If you do not need manual host or redirect overrides, keep Expert DNS off and use normal DNS switching or Own DNS instead.

6. Import, export, QR and TV transfer

Import/export avoids retyping complex settings with a TV remote. The app supports code/QR, files, one-shot URL import and local phone ↔ TV transfer protected by a code/PIN.

• Import from code / QR accepts configuration produced on another device.
• Import from URL fetches a supported JSON/list/rules file once; it is not background sync.
• Receive on TV / Send to TV works locally on a trusted LAN.

Local backup and restore

The current code also contains a broader local backup system. Standard backup covers portable application settings, while optional stores can include Wi‑Fi history, Speed Test, Network Scanner and SSH data.

• Sensitive passwords, private keys and trusted-host material are not meant for plaintext JSON. Selecting them switches the backup to an encrypted container.
• The complete encrypted backup uses AES-256-GCM with a password supplied by the user; the app does not store the backup password.
• Restore validates and previews scope, creates a local recovery snapshot before changes and includes rollback handling for failures.
• Backup is a local file, not automatic cloud synchronization.

7. Wi‑Fi Analyzer and room scans

This is one of the modules that grew the most. The key is to separate two modes.

• Basic Wi‑Fi scan is available in Free. It is a quick stationary scan around the current device and it does not save history.
• Room Wi‑Fi scanner is Premium. It lets you walk through the house with a phone or tablet, save measurement points, name them and compare complete sessions.

What are rooms and points? A “room” is not a cloud object or a device group. It is simply a saved measurement point from a physical place, for example “living room”, “bedroom”, “TV shelf” or “kitchen”. Each point remembers what the phone saw there: signal level, current channel, number of visible APs and channel recommendations.

How to run a full room scan:

1. Open the room scanner on a phone or tablet. On Android TV this mode is intentionally limited because the TV stays in one place.
2. Press Start walk scan .
3. Stand in the first place and save a point. The app can ask for a point name immediately.
4. Move to the next room or position and use Save room point again.
5. If needed, tap the last point and use Rename last point .
6. After covering the route, choose Finish and analyze .

How to read the results:

• Recommendation highlights the least congested channels based on visible networks and their strength.
• Why this channel? shows the score derived from overlap. On 2.4 GHz the key channels are usually 1 / 6 / 11.
• Detected networks lists SSIDs/BSSIDs with RSSI, channel, band and width.
• Heatmap shows which channels look cleaner and which are more crowded.

A/B comparison is for comparing two saved sessions, for example before and after changing the router channel, or one router position versus another. The app explains whether more neighboring APs appeared, whether the current network moved channels and whether the 2.4/5 GHz recommendation changed.

New scan from zero clears only the currently visible on-screen results and starts a fresh scan. It does not delete saved room history.

DFS on 5 GHz means high channels that are often cleaner, but routers may be forced to move away when radar is detected, and some TVs do not support every DFS channel. If streaming is unstable, a stable non-DFS channel near the router can be the safer choice.

On phones and tablets Android usually requires location permission or “Nearby Wi‑Fi devices” plus location services enabled. On Android TV the system often exposes only the current connection, so full house scanning is meant for a mobile device.

8. Internet Speed Test

The Speed Test has two levels.

• Quick test in Free gives a short sample and uses less data.
• Detailed test in Premium measures download, upload, latency and jitter and stores local history.

Premium also lets you choose Auto, EU, US or a custom URL . A custom test URL is useful when you want to compare behavior against a specific server or your own endpoint.

History makes sense after changing Wi‑Fi channels, switching DNS, moving the router or checking how the line behaves at different times of day.

Remember that detailed testing transfers real data. On a mobile plan it can consume quota.

9. Network tools and local statistics

Tools is now a diagnostic and administration suite: DNS/website tests, addressing and gateway information, LAN tools, Stability Monitor, WOL and the separate Network Scanner Pro.

• DNS Speed Test compares resolver response latency.
• Website reachability checks DNS plus basic HTTP/HTTPS availability.
• Network inspector / My address shows addresses, gateway, DNS and network state.
• Stability Monitor samples gateway/DNS latency to reveal spikes and instability.

Network Scanner Pro

This is a much larger module than the old “Deep LAN scan”, with quick/full profiles and its own history.

• Host discovery on the current subnet and an online-device list.
• TCP port-scan profiles and common UDP probes.
• Service detection and device identification from collected network evidence.
• Inventory, scan history and diffs between saved results.
• Latest-scan/change exports, privacy-redacted diagnostics and safe restart of interrupted scan profiles.
• SSH integration can create a starting profile for a discovered device; passwords and keys are not imported by the scanner.

WOL PRO and Remote Wake

Complete WOL PRO guide

Classic Wake-on-LAN remains a simple magic-packet action. WOL PRO adds profiles and automation around it.

1. Add a device with name, MAC, broadcast and UDP port.
2. Use Wake ; the app validates the fields and sends a standard LAN magic packet.
3. Profiles can be imported/exported as AGWOL1/QR codes. Security tokens are never embedded in the profile code.
4. Local history records WOL PRO calls and results.

Remote Wake without ADB: on Android TV enable Remote Wake and allow the chosen profile for automation/Remote Wake. While the app’s DNS/VPN service is running, the TV can host a local page on default port 8766. Scan the QR with a phone, open the TV page on the same LAN, enter the separate Remote Wake token, choose an approved profile and tap Wake.

Remote Wake is intended for a trusted LAN. The token is not placed in the URL, Wake requires POST, and the server rejects clients outside private/link-local address ranges. Do not forward the Remote Wake port from your router to the public Internet.

10. SSH Pro, terminal, SFTP and tunnels

SSH in the current code is a full Premium workspace rather than a simple “host + command” screen. It is intended for your own servers, NAS devices, routers and other systems you are authorized to administer.

Profiles, commands and terminal

• Profiles store host, port, user and selected authentication method; they can be organized, duplicated and marked as favorites.
• Quick-command macros work well as TV actions. A sensitive macro can require biometrics before execution.
• Command history and structured results include exit status, duration and mapped errors.
• The interactive terminal supports history, copy/save history, font controls, Ctrl+C, multiple/persistent sessions and reconnect policy.

SFTP and Transfer Center

The SFTP manager behaves like a dual-pane file manager for phone and server.

• Directory navigation, multi-select, recursive upload/download, create folder, rename, move, delete, chmod and remote bookmarks.
• A conflict policy can be selected before transfer.
• The queue shows exact source → destination, progress, speed and ETA. Jobs support pause, resume, stop and retry; summaries can be copied or saved as logs.
• A foreground service is used for explicitly user-started transfers according to Android background-execution rules.

Tunnels Pro and Jump Host

• LOCAL -L — a local port on this device to a service visible from the SSH server.
• REMOTE -R — reverse forwarding with safety-oriented defaults that avoid a public 0.0.0.0 bind.
• DYNAMIC SOCKS5 -D — a dynamic SOCKS5 proxy.
• Multiple tunnel definitions can share a profile transport, with start/stop/restart and optional auto-start.
• Jump Host / Bastion routes a target profile through one authenticated bastion with separate credentials and host-key verification.

SSH security, import and backup

• Known Hosts and host-key prompts prevent silently accepting an unexpected server-key change.
• Identity Vault can generate Ed25519, ECDSA P-256 or RSA-4096 keys. Private key material is protected locally with Android Keystore/AES-GCM.
• A wizard can deploy the public key into authorized_keys ; OpenSSH certificate records are also supported.
• Import supports WinSCP, OpenSSH config and PuTTY sessions. Desktop-obfuscated passwords are not blindly copied and host fingerprints are re-verified when required.
• OpenSSH export is public configuration without passwords/private keys. A separate encrypted SSH backup can include profiles, terminal settings, SFTP bookmarks, tunnels, Jump Hosts and trusted host keys; credentials are optional and stay inside the encrypted container.

11. Walkie Talkie Free and Walkie Beta QR Premium

The app now has two different conversation modules, and they should not be confused.

Walkie Talkie Free is the classic Bluetooth module. First pair the phones in Android Bluetooth settings, then put one device into waiting mode and connect from the other device through the paired conversation list. It offers chat, photos, call alert, speaker toggle and half-duplex hold-to-talk. Newer updates also added conversation lists, nearby BLE discovery and lighter battery behavior.

Walkie Beta QR is the new Premium module, separate from classic Walkie.

• It works only on compatible phones and tablets from Google Play. It does not launch on Android TV.
• The host creates a room and shows a QR code or invite code.
• A participant scans the live QR, picks a QR photo from the gallery or pastes the code manually.
• The connection runs locally through Nearby Connections , without an app cloud and without a public room directory.
• Voice is half-duplex hold-to-talk : only the person currently holding the button speaks.
• It also includes call alert, chat, photo sharing and a speaker toggle.

Most common Walkie Beta QR requirements: Premium, Google Play Services/Nearby, Bluetooth, microphone, camera and on some Android versions also location or nearby-device permission.

If Nearby is not available on the phone, classic Bluetooth Walkie remains the fallback path.

12. Android TV, launcher, widgets and Auto/Bluetooth

• Pin to Home / Add to Favorites : some TVs, including selected Sony models, do not add new apps to the home row automatically. Open Apps, long-press OK and pin the app manually.
• Leanback shortcut : the app also publishes a launcher shortcut that may appear separately.
• Autostart : after Android TV boots, the app can restore current DNS settings or a selected profile.
• Widgets : DNS start/stop widgets and a DNS profile widget are available.
• TV recording helper and on-screen remote are testing tools for capturing clean TV-style screenshots and videos.
• Android Auto compatibility tries to reduce conflicts between DNS VPN and Android Auto.
• Auto/Bluetooth rules let you choose a car Bluetooth device and decide whether DNS should disconnect automatically when the car connects and whether the previous DNS state should be restored later.

13. Privacy and key notes

The model remains local-first: no app account and no ads. Network features still communicate with services or devices explicitly selected by the user.

• DNS goes to the configured resolver; Own DNS records full domains only if the user explicitly enables logging.
• SSH/SFTP connects directly to the user’s host. Profiles, history, Known Hosts, Identity Vault and transfer logs stay local unless the user exports them.
• Network Scanner and WOL operate on the local network. Use them only on networks and devices you are authorized to manage.
• Remote Wake exposes a local HTTP listener only while the relevant app service is running. It is for trusted LAN use, requires a token and should not be exposed to the Internet.
• Local backups can contain sensitive SSH data only in a user-selected encrypted container. The backup password should not be stored by the app.
• Walkie operates locally; Premium purchases are handled by Google Play.