Rethink is not suitable for serious tunneling and proxying. The app is fine for blocking apps, but not for proxying.
problem is that WireGuard in Rethink is a VPN-inside-a-VPN: WireGuard acts as an internal proxy function. Android’s kill-switch applies to Rethink itself, not to the internal WireGuard instance.
When using Rethink on Android you can enable “block traffic outside the VPN,” but that only affects certain features — for example DNS filtering and blocking. If you allowed apps to access the network and the VPN provider drops, WireGuard can stop and traffic may continue outside the WireGuard tunnel. The kill-switch operates on Rethink’s firewall, which functions as a VPN to block apps. But Android’s kill-switch does not cover the internal proxy function.
You can check for leaks on VPN failure with an app like “Find My IP,” or run a Termux script that periodically checks your IP (while true; do curl -s https://api.ipify.org; echo “”; sleep 8; done).