[5.0+][ROOT][3.6.0] AFWall+ IPTables Firewall [28 AUG 2023]

bthylafh · Apr 6, 2019

Necessary privs for Signal over cell data?

EDIT: The solution was to give Signal access to roaming cellular data. No idea why this would be, except maybe that I'm on an MVNO that uses T-Mobile's network.

I searched here and on Google, and didn't see anything obviously matching my question:

I have a rooted phone running Lineage 16 & MindTheGapps and want to configure AFWall+ so that only a few apps can use my cellular data when it's active. I'm having a little trouble getting Signal to work correctly: I've given it permission to access LAN, WAN, and non-roaming cellular but it won't send messages until I disable AFWall+. Are there other core or system processes that I should whitelist?

I have the Core processes configured like so:
VPN access for everything.
Full access for the kernel.
Media gets WAN access
NTP gets WAN.
Root apps get everything but cellular and roaming
VPN on WAN only.

System processes:
VPN for everything.
WAN/LAN for CaptivePortalLogin
Non-roaming cellular for com.qualcomm.embms.
Same for a block consisting of Phone and Messaging Storage, Messaging service, com.qualcomm.qti.telephonyservice,com.qti.qualcomm .datastatusnotification, SIM Toolkit, org.codeaurora.ims, com.qualcomm.qcrilmsgtunnel, com.qualcomm.qti.ims, and Phone Services.

I'm testing by disconnecting from my wifi and connecting to data.

shahirnoh87@gmail.com · Apr 6, 2019

Vivo Y31L

htr5 · Apr 11, 2019

• Recently, my SuperSU app asked me to grant AFWall+ root permission again. This usually happens if the app is updated/changed but I hadn't initiate d any update. Did the AFWall+ do something by itself?

• When a new app is installed, the default action is to allow all connections. Would it be possible to switch the default action to block? The user is then required to grant access such as with firewalls on computers.

• Is there any interest from the dev or others for a screen overlay for when a new app is installed (similar to prompts on a computer's firewall)

• Finally, thank you very much. This app has completely transformed the way I use my phone.

lazylord2016 · Apr 11, 2019

Unable to call (volte) after enabling afwall. any help

Portgas D. Ace · Apr 11, 2019

lazylord2016 said:
Unable to call (volte) after enabling afwall. any help

Not possible with such less information provided.

jcmm11 · Apr 12, 2019

htr5 said:
• Recently, my SuperSU app asked me to grant AFWall+ root permission again. This usually happens if the app is updated/changed but I hadn't initiate d any update. Did the AFWall+ do something by itself?

• When a new app is installed, the default action is to allow all connections. Would it be possible to switch the default action to block? The user is then required to grant access such as with firewalls on computers.

• Is there any interest from the dev or others for a screen overlay for when a new app is installed (similar to prompts on a computer's firewall)

• Finally, thank you very much. This app has completely transformed the way I use my phone.

For #1 I wouldn't worry about it unless it starts to happen frequently.

For #2 - change the default from 'Block Selected' to 'Allow Selected'. You may have to redo all your rules after changing this. See attached image for where you change this.

#3 - meh. I'm fine with the notification I get when a new program is installed.

cobrax2 · Apr 12, 2019

hi guys
i am on htc 10, android 7
i understand that if i disable the show notification icon setting, the app is going into the background and eventually gets killed. but the rules remain active?
what happens if i let it with the notification on and block it from the android itself with "block all notifications"? will it run then and just wont show me notifications when new apps get installed?
thanks

gazzacbr · Apr 12, 2019

htr5 said:
• When a new app is installed, the default action is to allow all connections. Would it be possible to switch the default action to block? The user is then required to grant access such as with firewalls on computers.

• Finally, thank you very much. This app has completely transformed the way I use my phone.

I am guessing that you have set for blacklist so by definition everything will be allowed by default.
I much prefer whitelist then I have more control
my 2c

Estebanium · Apr 12, 2019

How is it possible that the log tells me an App was blocked (mdns UID 1020) while I don't have this App in the list of Apps? I am on Android Pie.

GeeM · Apr 18, 2019

Issues with Hotspot and CaptivePortalLogin

Hi there,

I have been using AFWall+ for nearly a month now, I am still getting used to it but so far it has been very positive. However I am still facing 2 major issues: I can't get any internet connection while sharing my mobile data through my wifi hotspot, and whenever I try to login on a public wifi with the CaptivePortalLogin, the app crashes and I cannot access the public Wifi at all. Both the CaptivePortalLogin and the tethering (DHCP+DNS) services are allowed for any connection.

Are these issues related? Is there any other service that I must add to the white list?

Thanks

Oswald Boelcke · Apr 18, 2019

GeeM said:
Hi there,

I have been using AFWall+ for nearly a month now, I am still getting used to it but so far it has been very positive. However I am still facing 2 major issues: I can't get any internet connection while sharing my mobile data through my wifi hotspot, and whenever I try to login on a public wifi with the CaptivePortalLogin, the app crashes and I cannot access the public Wifi at all. Both the CaptivePortalLogin and the tethering (DHCP+DNS) services are allowed for any connection.

Are these issues related? Is there any other service that I must add to the white list?

Thanks

First, I need to admit that I haven't granted internet access to CaptivePortalLogin and it's frozen. Additionally, I've run following code through Termux:

Code:

su 
pm disable com.android.captiveportallogin  
settings put global captive_portal_detection_enabled 0 
settings put global captive_portal_server localhost 
settings put global captive_portal_mode 0  
reboot

Now my actual question: In preferences => Binaries => DNS Proxy, what is your choice?

GeeM · Apr 18, 2019

Oswald Boelcke said:
First, I need to admit that I haven't granted internet access to CaptivePortalLogin and it's frozen. Additionally, I've run following code through Termux:

Code:

su pm disable com.android.captiveportallogin settings put global captive_portal_detection_enabled 0 settings put global captive_portal_server localhost settings put global captive_portal_mode 0 reboot

Now my actual question: In preferences => Binaries => DNS Proxy, what is your choice?

Thanks for your help.

I saw the CaptivePortalLogin fix for those who decided they do not want to allow/use the CaptivePortalLogin but I personally don't have any issue with it and that's why I allowed it and thought I would avoid some complications (unless you guys advise I should block it for good reasons)...

as for the Binaries preferences, it's set on Auto.

MDV106 · Apr 18, 2019

I am having trouble getting apps like ftp server and KDE connect to work while i use AfWall. Also my WiFi signal in status bar shows an x symbol indicating 'no internet' even though it works. How do i get around these issues. I have blocked all internet access to all apps except for those that require internet access to work.

brackenhill_mob · Apr 20, 2019

MDV106 said:
I am having trouble getting apps like ftp server and KDE connect to work while i use AfWall. Also my WiFi signal in status bar shows an x symbol indicating 'no internet' even though it works. How do i get around these issues. I have blocked all internet access to all apps except for those that require internet access to work.

Turn logging on and see which system service is being denied internet access. You might have to play with this a bit to find the right one. I've had this a couple of times on different roms and this is how I fixed it.

MDV106 · Apr 20, 2019

brackenhill_mob said:
Turn logging on and see which system service is being denied internet access. You might have to play with this a bit to find the right one. I've had this a couple of times on different roms and this is how I fixed it.

I fixed the wifi icon problem by following the commands 2 posts above. The KDE conjnect problem is likely caused by me being connected to a network using the CloudflareDNS$Magisk module so maybe the app is having difficulty picking up my device's Ip address. I decided to uninstall KDE Connect and communicate with my pc using Syncthing-Lite instead.

blinkycan · Apr 20, 2019

guys i have read the past few pages about dns but can't find an answers,

Afwall is blocking the new private dns feature of android 9 pie, the dns traffic is reported as "(root) Apps running as root", port 853 TCP

can i easily open that tcp port 853 for DNS over TLS without allowing the whole "Apps running as root"? thanks !

Adrian312 · Apr 20, 2019

blinkycan said:
guys i have read the past few pages about dns but can't find an answers,

Afwall is blocking the new private dns feature of android 9 pie, the dns traffic is reported as "(root) Apps running as root", port 853 TCP

can i easily open that tcp port 853 for DNS over TLS without allowing the whole "Apps running as root"? thanks !

Well you can give it a try and let us know

Oswald Boelcke · Apr 21, 2019

GeeM said:
Thanks for your help.

I saw the CaptivePortalLogin fix for those who decided they do not want to allow/use the CaptivePortalLogin but I personally don't have any issue with it and that's why I allowed it and thought I would avoid some complications (unless you guys advise I should block it for good reasons)...

as for the Binaries preferences, it's set on Auto.

I apologise for the late reply but have been busy with other things.
Personally blocked CaptivePortalLogin as provided because I don't want data sent to "http://clients3.google.com" to return a HTTP status code "204". The sent request contains the IP address of the network, time of network address and type of browser. I simply don't want Google to get these data but it's a very personal decision and I've never experienced problems due to my setup. But I know it might lead to problems to e.g. login at a hotel.
Regarding the binary, "auto" is certainly fine but I've disabled "DNS via netd" to allow AFWall+ to clearly match all DNS requests to the respective applications. However, this setting requires that "[0] (root) - Apps running as root" has access to the internet.

MDV106 · Apr 21, 2019

Oswald Boelcke said:
I apologise for the late reply but have been busy with other things.
Personally blocked CaptivePortalLogin as provided because I don't want data sent to "http://clients3.google.com" to return a HTTP status code "204". The sent request contains the IP address of the network, time of network address and type of browser. I simply don't want Google to get these data but it's a very personal decision and I've never experienced problems due to my setup. But I know it might lead to problems to e.g. login at a hotel.
Regarding the binary, "auto" is certainly fine but I've disabled "DNS via netd" to allow AFWall+ to clearly match all DNS requests to the respective applications. However, this setting requires that "[0] (root) - Apps running as root" has access to the internet.

Do you mind explaining what advantage does "to allow AFWall+ to clearly match all DNS requests to the respective applications." provide? Also I followed your previous code segement and it helped remove the "x" symbol next to wifi in status bar.

darfri · Apr 22, 2019

What does Afwall specifically try to do when tor redirection is on?

Does it try to connect to localhost:9050 to find orbot waiting ?
It doesn't seem to..

I do not want to exhaust my phone with tor running all the time. Instead I use Proxydroid to connect to REMOTE server consisting warmed up tor waiting on tcp9050. Over vpn.

I want to give up using Proxydroid oldie and "release a slot" for more background procresses.

What would be the CUSTOM SCRIPT for that matter?

[5.0+][ROOT][3.6.0] AFWall+ IPTables Firewall [28 AUG 2023]

New member

New member

Senior Member

Senior Member

Inactive Recognized Contributor

Recognized Contributor

Attachments

Senior Member

Senior Member

Senior Member

Senior Member

Senior Moderator / Moderator Committee

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Moderator / Moderator Committee

Senior Member

Senior Member

Top Liked Posts