How to make Firefox work with DNS and Firewall?

[omega3]

My goal is to limit adds, be more private and block newly installed apps from accessing Internet automatically.

When I have only firewall enabled I have connection in Firefox. When I have DNS and Firewall I can't connect.

Every time I enable internet I need to stop Firewall for a moment and after that it connects. Only after Firewall connects I can switch to Firewall + DNS to make it work.

In DNS setting I chosen Rethink RDNS Plus, Downloaded rules, I have On-device blocklists enabled, Use in app downloader, Prevent DNS leaks. In Apps I have for firefox, allowed unmetered wifi and metered mobile.

I don't quite understand what "bypass" means here, I guess it means don't use Rethink DNS rules (and only use firewall).

In firewall rules I have only enabled: block newly installed apps by default and Block port 80 traffic.

In Firefox settings I have: use only HTTPS, and strict protection against tracking. On android 13 (linageos 20) I have Private DNS: automatic.
Should I change something in android settings to use RethinkDNS+Firewall +Firefox?

Because I could't use Rethink DNS I tried to install 1.1.1.1 + WARP: Safer Internet to make Firefox work with Cloudflare and activated warp but it didn't work. Does it at all makes any sense to install some third party app and make it work with Rethink? I have no knowledge at all about which DNS should I use. I believe all these Rethink databases gives me more protection and privacy but I don't know how to configure it properly. I know there is cloudflare in other DNS option but I'd like to make DNS+Firewall have set up once and forget and don't be forced to change settings every time I connect to Internet.

[ignoramous]

When I have only firewall enabled I have connection in Firefox. When I have DNS and Firewall I can't connect.

1. Check Firefox entries in Configure -> Logs (the Network tab).
2. Tap on those and a bottomsheet should come up.
3. See if you spot any Firewall rule blocking the request (shows up as a red-coloured chip on the top-right corner of the bottomsheet).
4. See if you spot any errors (shows up at the footer of the bottomsheet after the connection has been closed / not active anymore).

Turn Private DNS to OFF (do not leave it at Automatic or Opportunistic).

Turn OFF all settings (except Block newly installed apps which is what you want to use) in Configure -> Firewall -> Universal firewall rules.

Make sure Firefox isn't setup to use its built-in DoH resolver.

From Configure -> Apps, search for Firefox, tap on its entry, and see if it Blocked or Excluded or Isolated (should say so at the top of the UI).

Do not modify any setting in Configure -> Network. If you have, which ones have you changed?

[omega3]

Looks like I didn't quite understood how this firewall works.

I chose DoT and Cloudflare. Prior to that I chose DNS → Rules → On device blocklists → enabled and I chose all lists. Are the lists always "valid" regardless of what DNS I chose?

PipePipe connects to various addresses:
https://i.imgur.com/tmkKFYu.png
https://i.imgur.com/h0wWoKn.png
https://i.imgur.com/kWyDCa0.png

Although per app I have alowed metered and unmetered. Should I set rules for each address to which this app connects or should I use "bypass universal" for this app?

The other issue I experience is when I have Rethink up and running (always) and I enable mobile connection in Android I need to pause Rethink for a second to make any application for example a browser work. Otherwise it can't connect. This is without changing rules, settings, etc.

Is this normal? Is pausing safe?

[ignoramous]

Are the lists always "valid" regardless of what DNS I chose?

Yes. If not, that's a bug.

Should I set rules for each address to which this app connects or should I use "bypass universal" for this app?

Depends on what you want to do?

I enable mobile connection in Android I need to pause Rethink for a second to make any application for example a browser work.

This shouldn't be required. Enable Perform connectivity checks in Configure -> Network iff you're using Auto in Configure -> Network -> Choose IP version.

Have you changed any other setting in Configure -> Network from the default ones?

Is pausing safe?

It is "safe" to pause / stop Rethink if Block connections without VPN (aka VPN Lockdown) is enabled from Android's settings (in Rethink goto, About -> VPN profile, tap on the settings or info icon next to Rethink's entry there and choose Block connections without VPN).

[omega3]

If enable in Logs → Network tab IP and domain for some app other apps won't be able to connect to this IP/domain, correct?

What if I enable in DNS tab? For example I use Aurora Store and in DNS tab I see it wants to connect to 0.0.0.0. playgoogleapis.com or android.clients.google.com. Or I have google.com ZZ (::). If I trust this domain will other apps be able to reach this domain? Like a web browser?

Sorry for such basic questions. So far I've used only ufw enable on Linux and that is my knowledge about firewalls.