Orbot + "Block port 80" universal firewall rule?

[funkypunkyz]

Hi, I use following settings

• tick "Block port 80 (insecure HTTP) traffic" under universal firewall rules
• use "Always-on VPN" with "Block connections without VPN"

For an app configured to be proxied over Orbot: Will this prevent outgoing HTTP traffic from this app to go through Tor?
Forbidding insecure HTTP seems even more important for Tor from security perspective (e.g. MITM attacks).

As I see it, this would be comparable to HTTPS-only mode in Firefox, which Tor Browser now defaults to.
Thanks for clarifications!

[ignoramous]

Rethink simply blocks traffic to port 80, which most services use as HTTP cleartext endpoint. Rethink doesn't do any inspection to see if the traffic on any of the other 60k+ ports was HTTP cleartext or not.

I'd not rely on Rethink's current implementation as the only protection mechanism.

[funkypunkyz]

Thanks for your answer @ignoramous.

Rethink doesn't do any inspection to see if the traffic on any of the other 60k+ ports was HTTP cleartext or not.

Fair enough. This was just about a simple rule for port 80.

I'd not rely on Rethink's current implementation as the only protection mechanism.

Yeah I see. Is it at least ensured, that Rethink applies all its rules (e.g. the universal rule to block all plain http/80 traffic) before forwarding requests to upstream, like Wireguard or Orbot?

[ignoramous]

Is it at least ensured, that Rethink applies all its rules (e.g. the universal rule to block all plain http/80 traffic) before forwarding requests to upstream, like Wireguard or Orbot

Yes (: Otherwise, the firewall would be no good.