An Android app enabling you to block access to and loading from TLDs and domains via user-configurable blocklists. Companion app to the IA Defensa AWAGAM browser extension.
(The app ships with no blocking rules—create your own blocklist or use an existing blocklist.)
Install via F-DroidDownload the appBrowse blocklists
AWAGAM is not currently distributed through the Google Play Store, so if you download the app directly, Android asks you about it twice (once to allow installations from wherever you downloaded it, and once more from Play Protect, which warns about any app it has not seen before). When Play Protect warns, choose More details, then Install anyway. A direct download does not update itself.
This app does not collect or share any data with IA Defensa. Its only external connections are the ones filtering needs—DNS queries to the resolver you select, and blocklist fetches from the URLs you add. The source code is open for auditing. The app is free software.
AWAGAM creates a local VPN that intercepts DNS queries only. Blocked domains resolve to 0.0.0.0, preventing connections:
Android app makes connection → AWAGAM local VPN (DNS interception only) → request blocked if on blocklist (0.0.0.0), otherwise successful (upstream DNS [DoH]).
Your actual Internet traffic is not routed through this VPN—only DNS lookups are filtered.
| Limitation | Explanation |
|---|---|
| No URL blocking | DNS only sees domain names, not full URLs—use the browser extension for URL-level blocking |
| VPN slot conflict | Android allows only one VPN at a time, i.e., the app cannot run alongside other VPN apps |
| DoH bypass | Apps using their own DNS-over-HTTPS bypass system DNS filtering |
If you use a VPN for privacy or work, AWAGAM cannot run simultaneously. Alternatives:
External connections:
Uses the same JSON format as the browser extension:
{
"group-id": {
"name": "Human-readable group name",
"context": "Optional description or context URL(s)",
"tlds": [
".example"
],
"domains": [
"example.com",
"example.org"
],
"urls": []
}
}Note: Domain entries cover all subdomains—example.com also blocks www.example.com, shop.example.com, and any other subdomain. URL patterns are parsed but ignored at DNS level.
Bundles (lists of blocklists) are supported as well.
The default upstream is DNS4EU, an EU-based, GDPR-compliant resolver that blocks malware and phishing. Supported providers:
| Provider | Features |
|---|---|
| DNS4EU | EU-based, GDPR-compliant; variants: protective (default), child-safe, no-ads, child-safe plus no-ads, unfiltered |
| Cloudflare | Fast global network |
| Reliable, widely used | |
| Quad9 | Security-focused, blocks malicious domains |
| OpenDNS | Cisco-operated |
| AdGuard | Privacy-focused |
Provider IPs are hardcoded to avoid DNS lookup loops when the VPN is active.