AFWall+ (Android Firewall +) - iptables based firewall for Android

I have updated my Pixel 2 to Android 9. After updating I have rooted with/over Magisk 16.7. But now after a few houres AFWall v2.9.9 (donate) is blocking all all kind of media downloads (youtube, google play, image and video downloads via whatsapp), If I reinstall AFWall+ it works again a few houres. Before updating to Android 9 it worked perfectly. Does anybody have the same issue?

Rules: https://pastebin.com/ZvgqHCfd

Edit: Exactly the same issue I have: https://forum.xda-developers.com/showpost.php?p=77302832&postcount=4612

Describe the bug After upgrading to 3.5.0 it seems that I can no longer apply the rules. Or I should say "almost" because it works probably 1/30.

Firewall Logs Emailed the complete log to [email protected]

The log is full of the similar lines:

====== 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/iptables -A afwall-3g-home -m owner --uid-owner 10268 -j RETURN' exited with status 4, retrying (attempt 1/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4, retrying (attempt 1/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4, retrying (attempt 2/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4, retrying (attempt 3/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4, retrying (attempt 4/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4, retrying (attempt 5/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4, retrying (attempt 6/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4, retrying (attempt 7/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4, retrying (attempt 8/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4, retrying (attempt 9/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4, retrying (attempt 10/10) 22:18:33 command '/data/user/0/dev.ukanth.ufirewall/app_bin/ip6tables -A afwall-3g-home -m owner --uid-owner 10257 -j RETURN' exited with status 4 Output: Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Smartphone (please complete the following information):

• Device: Nokia 8.3 5G
• Android OS: stock Android 11 (00WW_2_200)

Additional context

It appears like a plain race condition. I have found that disabling IPv6 support appears to fix the problem. And it appears the app tries to apply both IPv4 and IPv6 rules concurrently. Which probably explains the message about "another app holding xtables lock", the reason why the app appears to retry the commands and also explains why sometimes it works.

Maybe it should simply apply the rules sequentially?

Here are the collection of issues reported and devices

• Network blocked completly ( because of OUTPUT DROP)
• Error applying rules ( N4 / S3 / Xperia )

When AFWALL is enabled, USB tethering DNS resolution does not work. However, browsing sites by ip works, so the only problem is the DNS.

(Tethering) - DHCP+DNS services is enabled. Enabling or disabling (root) - Applications running as root or (Kernel) - Linux Kernel has no effect.

Versions: AFWall+ (v1.3.4.1), Android 4.4.4 Cyanogenmod 11-20140805-M9-hammerhead, Nexus 5.

There were similar issues before: #178 , #4

Edit: Using Black list mode solves this, see attached image.

I blocked Whatsapp for Wi-Fi and LAN and allowed it for mobile connections. But when I reenable Wi-Fi the android connection manager shows me that some kbytes slip through the Wi-Fi device. (Enable Wi-Fi, disable Wi-Fi enable Wi-Fi)

Note: This only seems to happen for a short time when the connection was established. Because all traffic is blocked after that. Android 4.4.4

When I enable "LAN control" on my Android device I cannot send out mDNS requests. mDNS broadcasts go to 224.0.0.251 on UDP port 5353. This request stays within the local network and, I believe, should be allowed. It's useful for printer and device discovery.

My request is that this address range would be allowed/whitelisted when I enable 'LAN communication' for one of my apps.

More info on mDNS can be found at: https://en.wikipedia.org/wiki/Multicast_DNS

Thanks for your time developing this program.

Hi,

After the last update if I wanna to use tethering I have to disable AFWall. Is other option for tethering about I don't know or it's a bug?

Thank you!

#551 reopening as i got this when i close afwall window

6807-6807/dev.ukanth.ufirewall I/art: System.exit called, status: 0
6807-6807/dev.ukanth.ufirewall I/AndroidRuntime: VM exiting with result code 0, cleanup skipped.
763-1003/? D/GraphicsStats: Buffer count: 7
763-1003/? I/WindowState: WIN DEATH: Window{7e6602 u0 dev.ukanth.ufirewall/dev.ukanth.ufirewall.MainActivity}
763-778/? I/libprocessgroup: Killing pid 6840 in uid 10068 as part of process group 6807
763-778/? I/libprocessgroup: Killing pid 7566 in uid 10068 as part of process group 6807
763-778/? I/ActivityManager: Process dev.ukanth.ufirewall (pid 6807) has died
763-778/? W/ActivityManager: Scheduling restart of crashed service dev.ukanth.ufirewall/.service.RootShell in 1000ms
763-778/? W/ActivityManager: Scheduling restart of crashed service dev.ukanth.ufirewall/.log.LogService in 11000ms
763-1003/? W/InputMethodManagerService: Got RemoteException sending setActive(false) notification to pid 6807 uid 10068
10060-10060/? A/libc: Fatal signal 13 (SIGPIPE), code 0 in tid 10060 (dmesg)
333-333/? I/DEBUG: property debug.db.uid not set; NOT waiting for gdb.
333-333/? I/DEBUG: HINT: adb shell setprop debug.db.uid 100000
333-333/? I/DEBUG: HINT: adb forward tcp:5039 tcp:5039
333-333/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
333-333/? A/DEBUG: CM Version: '13.0-20160803-UNOFFICIAL-temasek-hlte'
333-333/? A/DEBUG: Build fingerprint: 'samsung/hltexx/hlte:5.0/LRX21V/N9005XXUGBOK6:user/release-keys'
333-333/? A/DEBUG: Revision: '0'
333-333/? A/DEBUG: ABI: 'arm'
333-333/? A/DEBUG: pid: 10060, tid: 10060, name: dmesg  >>> dmesg <<<
333-333/? A/DEBUG: signal 13 (SIGPIPE), code 0 (SI_USER), fault addr --------
333-333/? A/DEBUG:     r0 ffffffe0  r1 b6c40000  r2 00000283  r3 b6c4023f
333-333/? A/DEBUG:     r4 00000283  r5 b6c40000  r6 00000001  r7 00000004
333-333/? A/DEBUG:     r8 b6f98568  r9 00000000  sl 00000000  fp be8a1a3c
333-333/? A/DEBUG:     ip 00000000  sp be8a1988  lr b6f41ca9  pc b6e7de0c  cpsr 20060010
763-971/? W/NativeCrashListener: Couldn't find ProcessRecord for pid 10060
333-333/? A/DEBUG: backtrace:
333-333/? E/DEBUG: AM write failed: Broken pipe
333-333/? A/DEBUG:     #00 pc 00041e0c  /system/lib/libc.so (write+12)
333-333/? A/DEBUG:     #01 pc 00007ca5  /system/bin/toybox
333-333/? A/DEBUG:     #02 pc 00009a5d  /system/bin/toybox
333-333/? A/DEBUG:     #03 pc 0000a851  /system/bin/toybox
333-333/? A/DEBUG:     #04 pc 0000711d  /system/bin/toybox
333-333/? A/DEBUG:     #05 pc 00006d01  /system/bin/toybox
333-333/? A/DEBUG:     #06 pc 00007167  /system/bin/toybox
333-333/? A/DEBUG:     #07 pc 000173bd  /system/lib/libc.so (__libc_init+44)
333-333/? A/DEBUG:     #08 pc 00006c10  /system/bin/toybox
333-333/? A/DEBUG: Tombstone written to: /data/tombstones/tombstone_08
763-797/? I/BootReceiver: Copying /data/tombstones/tombstone_08 to DropBox (SYSTEM_TOMBSTONE)
763-899/? I/TemperatureHumiditySensor: Accuracy has been changed to 3
763-791/? I/ActivityManager: Start proc 10061:dev.ukanth.ufirewall/u0a68 for service dev.ukanth.ufirewall/.service.RootShell
10061-10061/? I/art: Late-enabling -Xcheck:jni
10061-10061/dev.ukanth.ufirewall W/System: ClassLoader referenced unknown path: /data/app/dev.ukanth.ufirewall-1/lib/arm
10061-10061/dev.ukanth.ufirewall I/AFWall: Starting Log Service: while true; do dmesg -c ; sleep 1 ; done for LogTarget: LOG
10061-10061/dev.ukanth.ufirewall I/AFWall: rootSession is not Null
10061-10061/dev.ukanth.ufirewall D/AFWall: logservice shell started
10102-10102/? D/AndroidRuntime: >>>>>> START com.android.internal.os.RuntimeInit uid 0 <<<<<<
10102-10102/? D/AndroidRuntime: CheckJNI is OFF
16661-16661/? D/ICU: No timezone override file found: /data/misc/zoneinfo/current/icu/icu_tzdata.dat
16661-16661/? I/Radio-JNI: register_android_hardware_Radio DONE
16661-16661/? D/AndroidRuntime: Calling main entry com.android.commands.am.Am
16661-16661/? D/AndroidRuntime: Shutting down VM

Hello, i just switched to android 8.1 and i'm getting an error while activating the firewall. Whenever i press activate firewall it starts counting the rules and then responds with "Error applying iptable rules"

I'm not familiar with the codebase or Android development in general, but this seems to work. I copypasted the VPN implementation to add a new checkbox that pushes traffic through Orbot. Works on my phone.

Is this a viable feature to be added? If so I'll clean it up.

Hello,

I recently opened https://github.com/ukanth/afwall/issues/699 but it seems that actually the problem is another: I uninstalled and reinstalled AFWall+ and bought the license and had an empty setup. In this everything was okay, i.e., all apps were blocked - also VPN based.

Yet, after an immediate reboot of the phone (AICP based on LineageOS, Android 7.1, device HTC10) I noticed that beside the fact that no app was selected for traffic (i.e., all should still be blocked) internet traffic was flowing normally. The browser could access any page, Google Play was working, etc.

So it seems that after a device reboot AFWall+ does not get activated again though it says that it is active.

Hi.

I've got this very annoying issue.

I use my phone as a document scanner only and rely heavily on having transparent LAN connection from and into the phone. I use Xyplorer and SMBSync2 to transfer data and the issue is that despite allowing LAN connections for ALL apps in AFWall+ (and denying internet for ALL) and also enabling the option to allow inbound LAN connections after a while (I don't know how long) when AFWall+ is working in the background it then starts to block my apps from accessing any other LAN host.

To fix this problem all I need to do (but I do it every single time, and many times a scanning session) is to open AFWall+ UI and then go back to the app and retry connecting (usually 1-2 times).

I can't add no logs, because AFWall+ crashes when I enable logging.

For the iptables rules they are simple: block internet for every single app/service, and enable LAN access for every single app/service Also as I said, I enabled "allow inbound LAN connections" in the options.

Running LineageOS 14.1 osprey on Motorola Gen3 (2015).

Please advise.

"Default whitelist behaviour" problem (UI Preferences): Changes cannot be undone; once marked it remains so even after.

"Clone profile" problem: Profiles cannot be duplicated, are only adopted without settings (completely empty).

Firewall Logs https://drive.google.com/file/d/1tnxuoim2i-Gv1q1EHd44u4MfIm4Icaf7/view?usp=drivesdk

Smartphone:

• Device: [samsung galaxy s6] (rooted, magisk; LSposed framework)
• Android OS: [LOS 18.1 unofficial]
• AFWall+ (v3.5.3) (donate)

Additional: It is not known whether the "whitelist problem" also occurs with the "blacklist presetting" because I didn't want to make any further settings that I can't undo.

The same problems also exists at the same device with original STOCK ROM.

Otherwise, I am very satisfied. Thanks for the great work!

Is your feature request related to a problem? Please describe. I'm surprised to find the default filter table OUTPUT chain policy is left to ALLOW. This can lead to accidental short-lived data leaks when restarting or after starting app until rules are loaded.

Describe the solution you'd like Allow a preferences option to change the default OUTPUT policy from ACCEPT to REJECT

Describe alternatives you've considered I'm blocking things during boot using magisk startup scripts by simply changing OUTPUT policy to REJECT. But then when afwall starts, it changes the policy back to ACCEPT and there could be miliseconds until all rules load and data traffic can leak

Additional context It's fine if you make me type "YES I KNOW WHAT I'M DOING" before enabling this.

Is your feature request related to a problem? Please describe. Please provide instructions to enable prevention of data leak.

Describe the solution you'd like Please direct me to working android 10+ instructions to enable boot support.

Describe alternatives you've considered the checkbox is greyed out. it tells me to have init.d or su.d. I google hours and try all crap, nothing works. super su apk says is outdated. magisk init.d module gives me a non-working Init.d-Injector-1.0.zip then I find out is wrongly compressed, I repack then it doesn't work. I find then a different file name Init.d-Injector_v3.1.zip, again it installs but doesn't work, I see no /system/etc/init.d, nor /system/etc/init is writable. there is a init.d scripts play store app that runs /storage/emulated/0/init.d but hey suprise that is encrypted and available only after first unlock.

Additional context This is a bloody mess.

I am using afwall donate on my Oneplus6, oxygenOS 11.1.2.2 under Android 11 rooted with Magisk

If I am switching from wifi to mobile data (4G) and visa versa everything is blocked ( no internet) and I need to switch off and on AFwall, for an internet-connection again. A similar problem was already known in 2018 see#852. Let me know to fix this problem. Thx Ben

IPv4rules-switch->4g-NoInternet.log IPv4rules-Switch2Wifi-Nointernet.log IPv4rules-with-4Ginternet.log IPv4rules-with-wifi-internet.log