An Android app enabling you to block access to and loading from TLDs and domains via user-configurable blocklists. Companion app to the IA Defensa AWAGAM browser extension.
(The app ships with no blocking rules—create your own blocklist or use an existing blocklist.)
Download the appInstall via F-DroidBrowse blocklists
AWAGAM is not currently distributed through the Play Store, so Android asks twice before installing a direct download: once to allow installations from wherever you downloaded it, and once more from Play Protect, which warns about any app it has not seen before—choose More details, then Install anyway. Adding the F-Droid repository avoids both prompts and keeps the app updated; a direct download does not update itself.
This app does not collect or share any data with IA Defensa. Its only external connections are the ones filtering needs—DNS queries to the resolver you select, and blocklist fetches from the URLs you add. The source code is open for auditing. The app is free software.
AWAGAM creates a local VPN that intercepts DNS queries only. Blocked domains resolve to 0.0.0.0, preventing connections.
┌───────────┐ ┌───────────────────────────┐ ┌─────────────┐
│ Android │────▶│ AWAGAM Local VPN │────▶│ Upstream │
│ Apps │ │ (DNS interception only) │ │ DNS (DoH) │
└───────────┘ └───────────────────────────┘ └─────────────┘
│
▼ blocked
┌───────────┐
│ Return │
│ 0.0.0.0 │
└───────────┘Your actual Internet traffic is not routed through this VPN—only DNS lookups are filtered.
| Limitation | Explanation |
|---|---|
| No URL blocking | DNS only sees domain names, not full URLs—use the browser extension for URL-level blocking |
| VPN slot conflict | Android allows only one VPN at a time, i.e., the app cannot run alongside other VPN apps |
| DoH bypass | Apps using their own DNS-over-HTTPS bypass system DNS filtering |
If you use a VPN for privacy or work, AWAGAM cannot run simultaneously. Alternatives:
External connections:
Uses the same JSON format as the browser extension:
{
"group-id": {
"name": "Human-readable group name",
"context": "Optional description or context URL(s)",
"tlds": [
".example"
],
"domains": [
"example.com",
"example.org"
],
"urls": []
}
}Note: Domain entries cover all subdomains—example.com also blocks www.example.com, shop.example.com, and any other subdomain. URL patterns are parsed but ignored at DNS level.
Bundles (lists of blocklists) are supported as well.
The default upstream is DNS4EU, an EU-based, GDPR-compliant resolver that blocks malware and phishing. Supported providers:
| Provider | Features |
|---|---|
| DNS4EU | EU-based, GDPR-compliant; variants: protective (default), child-safe, no-ads, child-safe plus no-ads, unfiltered |
| Cloudflare | Fast global network |
| Reliable, widely used | |
| Quad9 | Security-focused, blocks malicious domains |
| OpenDNS | Cisco-operated |
| AdGuard | Privacy-focused |
Provider IPs are hardcoded to avoid DNS lookup loops when the VPN is active.