How I Built NetShield: A 100% Native Android VPN & Firewall Engine in Pure Kotlin & Jetpack Compose

Description and use

NetShield is a 100% native Android VPN and firewall that blocks ads, trackers, and adult content, keeps battery drain low, and ensures instant push notifications.

Problem

Developing a local network protection engine that blocks ads, trackers, and adult content across all apps while maintaining battery efficiency and push notification reliability on Android.

Outcome

NetShield delivers native ad and tracker blocking across all apps, maintains low battery drain, and ensures reliable push notifications, all without third‑party binaries.

Workflow

• 1. Implement VpnService and DatagramSocket in pure Kotlin.
• 2. Build an O(k) reverse label trie for instant domain sinkholing.
• 3. Resolve socket owner UIDs via getConnectionOwnerUid for per‑app firewalling.
• 4. Use a zero‑CPU CountDownLatch wait thread and in‑memory LRU DNS cache to avoid battery doze mode.
• 5. Add fast‑path routing for FCM (mtalk.google.com) and WhatsApp push sockets.
• 6. Persist rules, stats, and custom domains in Room DB v5 SQLite.
• 7. Release on GitHub and publish APK release.

Evidence

Building a local network protection engine from scratch came with major technical challenges and engineering learnings:

Source

I learned why DNS-level VPNs excel at blocking 3rd-party ad networks, pop-ups, and tracking domains across 100% of apps, but cannot block inlined first-party video streams (like YouTube or Instagram) without breaking main video playback.

Source

Solved Android OEM background battery killers by implementing a zero-CPU CountDownLatch wait thread and an in-memory LRU DNS cache to keep idle battery drain under ~1–2%.

Source

Added specialized fast-path routing for FCM (mtalk.google.com) and WhatsApp push sockets so real-time notifications deliver instantly even in deep sleep.

Source

100% Native Kotlin: Built using Android standard library (VpnService, DatagramSocket) with zero 3rd-party C++ binaries.

Source