[5.0+][ROOT][3.6.0] AFWall+ IPTables Firewall [28 AUG 2023]

ezechiel1917 · May 13, 2014

Hi, using 1.3.1.1 on Android 4.2.2 here
Automatically switching profiles through Tasker plugin doesn't work when DNS proxy is set to Disable DNS via netd in Preferences.
Afwall selects correct profile and applies it's rules but internet in allowed application is not working because DNS requests seems to be blocked (DNS server IP : UDP 53 blocked says Firewall log). If I apply rules in afwall GUI manually after this then it starts to work.
When I switch DNS proxy to Auto, Tasker profile switching works correctly.
Is this a bug or expected behaviour?

Also can you please add automatic refresh of currently applied profile/rules list when you return to afwall gui and profile was changed in meantime?
Current behaviour is that when you return to GUI you display profile/rules which was displayed last time you accessed gui. But if different profile was applied by Tasker plugin in meantime it's not correct profile anymore and you have to exit afwall then relaunch to get active profile displayed.

Ez.

ukanth · May 13, 2014

ezechiel1917 said:
Hi, using 1.3.1.1 on Android 4.2.2 here
Automatically switching profiles through Tasker plugin doesn't work when DNS proxy is set to Disable DNS via netd in Preferences.
Afwall selects correct profile and applies it's rules but internet in allowed application is not working because DNS requests seems to be blocked (DNS server IP : UDP 53 blocked says Firewall log). If I apply rules in afwall GUI manually after this then it starts to work.
When I switch DNS proxy to Auto, Tasker profile switching works correctly.
Is this a bug or expected behaviour?

Also can you please add automatic refresh of currently applied profile/rules list when you return to afwall gui and profile was changed in meantime?
Current behaviour is that when you return to GUI you display profile/rules which was displayed last time you accessed gui. But if different profile was applied by Tasker plugin in meantime it's not correct profile anymore and you have to exit afwall then relaunch to get active profile displayed.

Ez.

There were multiple reports on the same. I'm currently busy with my other work. I'll surely look into it when started working in AFWall+ If you could do the same in github will make sure that this will be addressed in the next release.

stanlefor · May 13, 2014

Hi,

Is this firewall allows to disable background activity for selected apps as mobiwol does?
How?

I tried it but it look like the background data are always allowed.

Thanls

ukanth · May 13, 2014

stanlefor said:
Hi,

Is this firewall allows to disable background activity for selected apps as mobiwol does?
How?

I tried it but it look like the background data are always allowed.

Thanls

No, it doesn't support that.

Anderson2 · May 13, 2014

Any plans to include it?

Do you feel it's not important?

stanlefor · May 15, 2014

Well, i'd like to know that too, because the problem is actually your firewall doesn't block some access...
Which is a big problem for a firewall

Thanks mate

ukanth · May 15, 2014

stanlefor said:
Well, i'd like to know that too, because the problem is actually your firewall doesn't block some access...
Which is a big problem for a firewall

Thanks mate

Sorry, But what you mean doesn't block background activity. Could you please elaborate little bit on it ?

nyarlathotep · May 16, 2014

ukanth said:
Sorry, But what you mean doesn't block background activity. Could you please elaborate little bit on it ?

He may mean the the section that one of these link to:

https://www.google.com.au/search?q=android+enable+background+data&es_sm=122&source=lnms&tbm=isch&sa=X&ei=RFJ1U96vJsGmkAWRnoHwBQ&ved=0CAoQ_AUoAw&biw=1920&bih=965

stanlefor · May 16, 2014

yeah.

http://www.pocketables.com/images/2013/08/Restrict-app-data-304x506.png

If you look at your data, you can see that applications use foreground and background data. AFWall+ doesn't block background data.

For instance, swiftkey is blocked in AFWall+ for me, but it still use data. I have to block it ether in android with "restrict background data" or with another firewall.

Anderson2 · May 16, 2014

So, to the obvious question, what is a firewall that is open source, blocks both foreground and background, is for rooted devices, and preferably (but not necessarily) is free?

I used to use Avast's mobile app which worked very well but was not open source.

---------- Post added at 08:48 PM ---------- Previous post was at 08:45 PM ----------

stanlefor said:
yeah.

http://www.pocketables.com/images/2013/08/Restrict-app-data-304x506.png

If you look at your data, you can see that applications use foreground and background data. AFWall+ doesn't block background data.

For instance, swiftkey is blocked in AFWall+ for me, but it still use data. I have to block it ether in android with "restrict background data" or with another firewall.

How do you restrict background data for "some" apps in Android?

an0n981 · May 16, 2014

Anderson2 said:
So, to the obvious question, what is a firewall that is open source, blocks both foreground and background, is for rooted devices, and preferably (but not necessarily) is free?

I used to use Avast's mobile app which worked very well but was not open source.

---------- Post added at 08:48 PM ---------- Previous post was at 08:45 PM ----------

How do you restrict background data for an app in Android?

See the check box in the pic that says 'Restrict background data'? Settings - Data usage - select the app you want to restrict

Magissia · May 17, 2014

Wait, since when the firewall doesn't block background data? Why?

Regards

Anderson2 · May 17, 2014

an0n981 said:
See the check box in the pic that says 'Restrict background data'? Settings - Data usage - select the app you want to restrict

Thank you. Not that I'm an expert but it seems meaningless for a firewall to block foreground communication and allow an app to communicate in the background all it wants. Maybe I'm missing something. I always thought security or privacy is only as good as its weakest link, and a firewall that doesn't control background communication seems to have a very large weak link.

In Settings - Data usage, not all installed apps are listed. Does that mean apps that don't appear don't communicate in the background??

Back to my question: is there an android firewall that controls both foreground and background communication?

an0n981 · May 17, 2014

Anderson2 said:
In Settings - Data usage, not all installed apps are listed. Does that mean apps that don't appear don't communicate in the background??

Only apps that have used data will be listed here.

Anderson2 said:
Back to my question: is there an android firewall that controls both foreground and background communication?

IMHO this discussion belongs in Q&A not the AFWall thread

ukanth · May 18, 2014

Magissia said:
Wait, since when the firewall doesn't block background data? Why?

Regards

Ok, lets put an end to this discussion. First of all "iptables" implementation works at kernel level to block packets regardless of foreground/background. If you restrict an application in AFWall+ will block the app by configuring the iptables rules including "background activity".

The feature the user wants is to separate this two out. Allow the application in AFWall+, but restrict the background data. Currently AFWall+ or any firewall which works on top of iptables doesn't support this.

I'll see how possible is this to implement. I doubt there are enough API's to deal with foreground/background of given application. Also will see how difficult to apply rules when an app goes foreground/background.

Anderson2 · May 18, 2014

Thank you ukanth. That is very reassuring. Excellent.

Magissia · May 18, 2014

That's what i was thinking, but something made me doubt.
Thanks you @ukanth .

cernekee · May 18, 2014

ukanth said:
The feature the user wants is to separate this two out. Allow the application in AFWall+, but restrict the background data.

What isn't clear from the discussion is whether it is necessary to completely block the app's background data via iptables (because the application is not respecting these settings) or if they just want the application to be advised of whether it is OK to use background data.

As you mentioned, blocking via iptables would require much more frequent rule updates and may introduce latency, at least under the current design. Do we have an example of a rogue app which requires this sort of restriction?

Another option for preventing an app and associated services from running into the background is to Force Stop it before navigating to another app. On many ROMs this can be done by long-pressing the back button; it may need to be enabled in Developer Options. Long-press-back probably works best with "standalone" apps; I would not trust it to work with anything that has multiple components, like Google apps or OEM ROM customizations.

ukanth · May 19, 2014

cernekee said:
What isn't clear from the discussion is whether it is necessary to completely block the app's background data via iptables (because the application is not respecting these settings) or if they just want the application to be advised of whether it is OK to use background data.

As you mentioned, blocking via iptables would require much more frequent rule updates and may introduce latency, at least under the current design. Do we have an example of a rogue app which requires this sort of restriction?

Another option for preventing an app and associated services from running into the background is to Force Stop it before navigating to another app. On many ROMs this can be done by long-pressing the back button; it may need to be enabled in Developer Options. Long-press-back probably works best with "standalone" apps; I would not trust it to work with anything that has multiple components, like Google apps or OEM ROM customizations.

You are right. Introducing this using iptables will end up messing the user experience with latency. I was thinking of control it via code. But looks like that's not possible until you have the application with platform key.

http://stackoverflow.com/questions/...ation-background-data-usage-status-in-android

One possible here is to do the same via xposed framework. Possible to introduce it as a plugin to AFWall+, with changes to current design. But we should not do it, until the current one gets stable enough.

what's your thought ?

inunxelex · May 19, 2014

ADD proxy SOCK/HTTP features

please add proxy SOCK/HTTP features using redsock (http://darkk.net.ru/redsocks/), this module also used by sshtunnel(https://play.google.com/store/apps/details?id=org.sshtunnel) or proxydroid(https://play.google.com/store/apps/details?id=org.proxydroid) :good:

here is my custom scripts for running proxy script in afwall

[5.0+][ROOT][3.6.0] AFWall+ IPTables Firewall [28 AUG 2023]

Member

Recognized Developer

stanlefor

Guest

Recognized Developer

Senior Member

stanlefor

Guest

Recognized Developer

Senior Member

stanlefor

Guest

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Recognized Developer

Senior Member

Senior Member

Senior Member

Recognized Developer

Senior Member

Top Liked Posts