An Android app-firewall test checklist for VGuard

VGuard is an experimental Android local-VPN firewall candidate. Its intended behaviour is to discard packets from selected apps while other apps retain their connection. Live Android enforcement remains unverified. This checklist helps testers collect evidence on a spare device; it is not a recommendation to rely on the preview.

Understand the Android VPN slot

A local-VPN firewall is different from a remote VPN service. VGuard uses Android’s VPN interface locally and may replace another VPN. It does not provide the remote provider’s IP masking. Do not conduct this test during sensitive activity or while depending on another VPN connection.

Run a comparison

1. Read the candidate download and setup notes. Record the app version and Android version.
2. With VGuard stopped, confirm two independent test apps can make fresh network requests. Cached content is not a useful connectivity test.
3. Select only one app for blocking. Start VGuard and approve the Android VPN request yourself.
4. Repeat fresh requests in both apps. Record whether the selected app fails while the unselected app still connects.
5. Stop VGuard and check that the selected app can connect again.

Test state changes separately

If the basic comparison works, record what happens after screen lock, sleep, Wi-Fi/mobile changes and VPN revocation. Keep each case separate. A single successful request test does not establish DNS, IPv6, background or bypass behaviour.

Know what it does not control

VGuard does not disable camera, microphone or location permissions, detect all spyware or prevent an app collecting information while offline. An app may store data and send it after access returns. This candidate has no always-on mode, lockdown or automatic restart.

Write a useful report

Include version numbers, the harmless test apps used, the steps, expected result and actual result. Do not attach personal traffic logs or real account details. Submit the result through private tester feedback. Host tests and signature checks are different from real-device routing evidence; both must be described honestly.