Get hands dirty into AOSP IPTABLES - Security Discussion

I am looking for AOSP developer to customize IPSEC scripts with rules that routes all connections to TOR and TOR only all the time.

Related

[Q] Multiplayer Game APP

hello forum, i was wondering if there is a way do develop a game, actually very similar to a existing app Tile Attack from Rossant, that supports a multiplayer mode, wifi , Bluetooth ad hoc, any of these ways, if someone knows, please leave a reply.
if this thread already exists im sorry, tried searching but found nothing.
I don't know the game you've mentioned, but in short, the easy and official way to develop a short-range multi-player game (i.e. something you would play with friends in the same room) is to use UDP over WiFi (you both need to be on the same WiFi network). For a longer-range game, you would have to set up one or more servers for the game; the phone's official APIs don't include server sockets, and even if they did, most networks firewall incoming connections. You can access the server using any networking API on the phone (UDP, TCP Client, or HTTP Client).
Unofficially, you can do server sockets just fine on WP7 (there's even a managed wrapper for them, see the "Homebrew" library project which is available, among other places, in the Root Webserver app) but that won't be allowed into Marketplace. Similarly, native APIs to directly access the Bluetooth stack do exist, but they are unofficial and won't be allowed.
There's an "Apps & Games" sub-forum that may be able to help you more, if you're looking to develop a Marketplace-acceptable game. A lot of what we do here is unofficial, although you're certainly welcome to ask questions about official stuff too.
GoodDayToDie said:
I don't know the game you've mentioned, but in short, the easy and official way to develop a short-range multi-player game (i.e. something you would play with friends in the same room) is to use UDP over WiFi (you both need to be on the same WiFi network). For a longer-range game, you would have to set up one or more servers for the game; the phone's official APIs don't include server sockets, and even if they did, most networks firewall incoming connections. You can access the server using any networking API on the phone (UDP, TCP Client, or HTTP Client).
Unofficially, you can do server sockets just fine on WP7 (there's even a managed wrapper for them, see the "Homebrew" library project which is available, among other places, in the Root Webserver app) but that won't be allowed into Marketplace. Similarly, native APIs to directly access the Bluetooth stack do exist, but they are unofficial and won't be allowed.
There's an "Apps & Games" sub-forum that may be able to help you more, if you're looking to develop a Marketplace-acceptable game. A lot of what we do here is unofficial, although you're certainly welcome to ask questions about official stuff too.
Click to expand...
Click to collapse
Thanks for the reply, ill have what you mentioned in mind =)

[APP][2.3.3+][PROXY][NO ROOT] Orxy -- Android Tor Proxy

Lots of people are having trouble getting Orbot working on newer devices. To solve this I made Orxy: a compatible alternative free anonymous Tor proxy.
Orxy is an Orbot alternative that supports devices running the latest Android. Orxy protects network traffic using The Onion Router (Tor) network. Tor encrypts the data and sends it through random points across the world to hide where the connection started. For example, while using Orxy, a website you visit might think you're looking at it from another country. Use it the same way as Orbot: configure your apps to use the local proxy server settings. Instruction details on the play store page.
It has optional add-ons to get full Tor proxying without root, and to hide the Tor traffic in another a layer of encryption. Neither are required to use the app.
If Orbot is not working, I hope it helps get people their Tor back.
Available on Google Play
Legalese: It is produced independently from the Tor® anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else. Do not use without knowing the inherent risks and limitations of Tor. Use at your own risk.
Thanks....
It's Cool
Glad you like it, thanks for the support.
Promo for XDA readers:
https://rideem.io/from/orxify/for/xda gives out a code per day to get the orxify add-on free.

[APP][6.0+] RethinkDNS: Anti-Censorship + Adblocker + Firewall [open source] [no root]

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
RethinkDNS is an anti-internet censorship tool with DNS-based adblocking and a firewall built-in for Android 6+ devices.
The app itself is free to use and comes with RethinkDNS (previous name BraveDNS) resolver with support custom denylists, allowlists, ability to store DNS logs for later analysis, view those logs consolidated from multiple devices in a single interface and so on: Pretty much a pi-hole in the cloud.
Why'd we build this?
As concerned Android users: It absolutely irks us that people who do care enough about privacy still couldn't use privacy-enhancing apps without requiring a degree in computer science. We saw this pattern unfold multiple times and a lot of tools over the years have done a tremendous job of making niche security tools accessible to naive users. We wanted to further that conversation on Android with a vision for what we think such a tool should look like:
1. Anti-censorship: Enable open internet. DNS over HTTPS (and the imminent ESNI standard) is going to effectively break censorship as implemented in a lot of countries without requiring to route the traffic through VPNs. VPNs (and distributed tech like IPFS and mesh networks like Lantern) are still required in countries that employ Deep Packet Inspection. That's something we'd like to tackle in the near future.
2. Anti-surveillance: Expose apps, their activity logs, network logs, and provide some actionable insights to the users on what they could do next. Exodus Privacy does a good job at statically analyzing an app and laying bare the trackers and permissions in-use, whilst the evergreen NetGuard does ever-so-well in revealing an app's connectivity history. We believe, there's a lot more that can be done than simply firewall an app: For instance, you could disable it, uninstall it, remove its permissions, remove the so-called special permissions (like read notification permission, read SMS permission, read app-usage statistics permission etc). Basically, empower the user with whatever control is available without-root in a neat little interface (think CleanMaster vs using the stock Settings app but being actually effective and not lie).
The current version of RethinkDNS (previous name: BraveDNS) is a start in the direction laid out above partly because we want such an app ourselves and partly because we feel people deserve more such tools, and we hope to build it with this community's input, because god knows we have been wrong plenty when it comes to "what people really want".
As privacy enthusiasts: We were frustrated that if we wanted to use NetGuard we couldn't use another VPN app, or if we wanted to use a DNS changer like Blokada then we couldn't use NetGuard (though, NetGuard + Private DNS feature alleviates the problem on Android 9+). We wanted something that wasn't as restrictive because we knew it could be built and so we did.
Key points:
1. Easy configuration.
2. No root required.
3. Free and open source (forked from Intra).
4. No built-in trackers or analytics.
5. In continuous development.
Current features:
1. DNS over HTTPS (circumvent censorship and prevent surveillance of DNS logs by ISPs and everyone else), DNSCrypt v2 with Anonymized Relays, and DNS over Tor.
2. View DNS logs, including latencies and other metadata.
3. Ad-block through RethinkDNS (previous name: BraveDNS) free resolver and local blocklists.
4. Add your own DNS over HTTPS / DNSCrypt v2 servers.
5. Firewall by app categories.
6. Firewall individual apps.
7. Firewall individual IP addresses.
8. Firewall when apps are in the background (not-in-active-use).
9. Firewall when device is locked.
10. Forward DNS and TCP connections to Orbot (Tor as a proxy).
11. Forward HTTP connections to any HTTP proxy.
12. Forward TCP connections to any SOCKS5 endpoint or to Orbot.
13. Forward DNS connections to any app running locally on-device or any endpoint (either local or on the Internet).
14. [v053g / Sep '21] Firewall when apps bypass DNS (for example, block connections to IPs that apps resolve themselves).
15. [v053g / Sep '21] Pause: Pause the Firewall and DNS for a brief time-period.
16. [v053g / Sep '21] DNS Trap: Proxy all requests made on Port 53 to user-set DNS endpoint (for instance, this traps and redirects all custom DNS requests WhatsApp sends to Google's `8.8.8.8` DNS servers to the DNS endpoint of a user's choice).
17. [v053i / Jul '22] IPv6 support.
18. [v053i / Jul '22] Firewall based on metered (LTE) or unmetered connection (Wifi).
Planned (in order):
0. Custom DNS allowlists/denylists.
1. WireGuard VPN integration.
3. Per-app DNS and VPN (route traffic to multiple VPNs / DNS based on which app is making those connections).
See: github/celzero/rethink-app/feature-backlog.
We can't emphasize this enough: Let us know what you'd like to see us build and more importantly what'd make this tool use-able for other Android users who care enough but aren't as tech-savvy.
If you'd like to contribute, please feel free to send pull requests our way.
Thanks.
---
Source: github/celzero/rethink-app
Website: rethinkfirewall.com
Blog: blog.rethinkdns.com
Twitter: twitter.com/rethinkdns
FAQ: rethinkdns.com/faq
License: Apache 2.0
Download: via RethinkDNS.com | PlayStore | F-Droid.
---
Reserved.
pls add system apps block on firewall, also block domain on dns log and dns server change
Thanks.
System apps: Good catch. We'd look to put that in the coming days.
DNS block button against a domain in the logs: We do plan add that but not sure if it ends up violating PlayStore terms. May be we need two versions, one for f-droid and another for PlayStore like Blokada has.
Can you elaborate what you mean by block domain on DNS server change?
ignoramous said:
Thanks.
System apps: Good catch. We'd look to put that in the coming days.
DNS block button against a domain in the logs: We do plan add that but not sure if it ends up violating PlayStore terms. May be we need two versions, one for f-droid and another for PlayStore like Blokada has.
Can you elaborate what you mean by block domain on DNS server change?
Click to expand...
Click to collapse
block/allow individual domains which are showed by log.
change dns servers just like nebulo app.
also proxy on tor n dnscrypt support like invizible-pro app.
> change dns servers just like nebulo app.
Dnscrypt shouldn't be much trouble to implement but I wonder what extra protection it affords over DNS over HTTPS. That said, I've added it to our backlog.
> block/allow individual domains which are showed by log.
Gotcha but as mentioned before I am not sure if this feature breaks PlayStore terms. Added.
> also proxy on tor n dnscrypt support like invizible-pro app.
Yes! This is something that we want to do next. Once the part with Firewall and DNS is done (our immediate attention is adding missing features and later add support for Android 6+). Thanks for the heads-up: invizible-pro looks great, and exactly the kind of app that we envision to build ourselves.
Is this affiliated in any way with https://brave.com/?
No it isn't affiliated with brave.com.
We won a grant from Mozilla Builders, however; to pursue this, which we are now doing so full-time.
Hello, I am on a stock Pixel 2 XL, Android 10, latest security patches as of August. The app starts and runs, but tapping the start circle does nothing. DNS or Firewall doesn't start.
So this still exposes one's real IP address, yes?
y0himba said:
Hello, I am on a stock Pixel 2 XL, Android 10, latest security patches as of August. The app starts and runs, but tapping the start circle does nothing. DNS or Firewall doesn't start.
Click to expand...
Click to collapse
Strange. This is unlikely related to Pixel or the latest Android Oreo update. Please check if any other VPN app has been set to "Always-on VPN" like-so (also see attached):
1. Settings -> Wifi and internet -> VPN.
2. Click on the sprocket icon against the apps.
3. Check if "Always-on VPN" is check-marked.
Disable that setting (if and only if you do not want that VPN app to be an "Always-on VPN") and BraveDNS should now prompt you for VPN access once you click "Start".
BraveDNS (or any app that requires VPN API access to function) cannot work with other VPN apps in-tandem (especially, not with "Always-on VPNs").
pocholo36 said:
So this still exposes one's real IP address, yes?
Click to expand...
Click to collapse
Yes, BraveDNS isn't a VPN service like ProtonVPN / Mullvad / Lantern etc are. Right now (though we do have plans to add VPN servers like Lantern et al in probably two to three months from today but that'd be only to support anti-censorship and not anonymity). See: https://github.com/celzero/brave-android-app/issues/52 and https://github.com/celzero/brave-android-app/issues/51
We're adding support for SOCKS5 and HTTPS-Proxy in the upcoming release (next week) which would help forward traffic to VPNs (like NordVPN) that support those protocols: https://github.com/celzero/brave-android-app/issues/45
Right now, BraveDNS uses VPN access on-device to change DNS and implement Firewall functionality (similar to what the excellent NetGuard app does).
ignoramous said:
Yes, BraveDNS isn't a VPN service like ProtonVPN / Mullvad / Lantern etc are. Right now (though we do have plans to add VPN servers like Lantern et al in probably two to three months from today but that'd be only to support anti-censorship and not anonymity). See: https://github.com/celzero/brave-android-app/issues/52 and https://github.com/celzero/brave-android-app/issues/51
We're adding support for SOCKS5 and HTTPS-Proxy in the upcoming release (next week) which would help forward traffic to VPNs (like NordVPN) that support those protocols: https://github.com/celzero/brave-android-app/issues/45
Right now, BraveDNS uses VPN access on-device to change DNS and implement Firewall functionality (similar to what the excellent NetGuard app does).
Click to expand...
Click to collapse
I've been looking for an all in one solution. Currently forced to use AdGuard+Nord...
Looking forward to it. Thanks for all you guys do.
Thanks. Nice work.
Unfortunately, it usually comes down to firewall or VPN
Would love to see what you guys do (if at all) to allow third party VPNs
My brief experience with this is not great. Breaks several apps once turned off the app no longer opens so has to be uninstalled to turn it back on. Ad blocking did not seem to function at all.
ignoramous said:
Strange. This is unlikely related to Pixel or the latest Android Oreo update. Please check if any other VPN app has been set to "Always-on VPN" like-....
Click to expand...
Click to collapse
That fixed it. I should have figured as much, but I'm getting too old for this I think. I can't wait until you offer subscriptions! This is brilliant. I hope it's on the up and up though, I'm paranoid so don't mind me.
bladestonez said:
My brief experience with this is not great. Breaks several apps once turned off the app no longer opens so has to be uninstalled to turn it back on. Ad blocking did not seem to function at all.
Click to expand...
Click to collapse
So sorry this app has forced you to uninstall apps in order to use them. That definitely sounds like something went wildly wrong.
Would you please tell us more about the device, the Android version, and probably the list of steps that led to this issue you saw? You could also email us logs or a screen recording at [email protected]
We do know of crashes especially on flaky networks and on network changes, and we would eventually fix those but they have been extremely hard to track-down in production builds to a root cause (due to lack of stack trace / debug symbols for native crashes).
BraveDNS has been in development for a total of 2 months and was released three weeks back. It is a baby app and I fully expect stupid bugs to appear in the wild but cautiously hopeful that we'd fix most if not all.
Re: adblocking:
Adblocking is done exclusively through DNS. If the default endpoint doesn't work, you can point the app to a custom DNS over HTTPS endpoint. https://dns.adguard.com/dns-query is AdGuard's content blocking DNS endpoint. And https://doh.pi-dns.com/dns-query is another volunteer-run content-blocking DNS.
How is this different from adguard?
Using a VPN method to firewall on a rooted device is a no from me (i can totally understand if you use this to increase your userbase to non-root users, but thats not for me), ill stick with Invisible (for DNSCrypt & its ability to load my 19Mb blacklist) and my root firewall for now.
Really need to change the name.
Brave = Brave Browser
A lot of people are going to assume it's a VPN by Brave.
It's like calling it FirefoxVPN.

Question DNS over HTTPS

Hi,
I've read on multiple pages that A13 supposedly supports DNS over HTTPS but there's no such option under the private DNS settings. It keeps using DNS over TLS.
Anyone knows how to properly enable it so self originating traffic uses DoH?
Not trying to advertise anything specific, but this:
DoH with Quad9 DNS Servers | Quad9
DoH is a secure DNS protocol that is getting a lot of traction lately. Mozilla announced support for it in their Firefox browser and Google recently announced support for developers and Alphabet through Jigsaw released the Intra app for Android.
www.quad9.net
has a link to this:
A safer route to a more open internet
Intra is an Android app that gives you safer, more open Internet access. Intra protects you from DNS manipulation, a type of cyber attack used to block access to news sites, social media platforms, and messaging apps.
getintra.org
Maybe one or both could get you what you're looking for. I don't particularly know if there is a native way since the first article is from 2018.
roirraW edor ehT said:
Not trying to advertise anything specific, but this:
DoH with Quad9 DNS Servers | Quad9
DoH is a secure DNS protocol that is getting a lot of traction lately. Mozilla announced support for it in their Firefox browser and Google recently announced support for developers and Alphabet through Jigsaw released the Intra app for Android.
www.quad9.net
has a link to this:
A safer route to a more open internet
Intra is an Android app that gives you safer, more open Internet access. Intra protects you from DNS manipulation, a type of cyber attack used to block access to news sites, social media platforms, and messaging apps.
getintra.org
Maybe one or both could get you what you're looking for. I don't particularly know if there is a native way since the first article is from 2018.
Click to expand...
Click to collapse
Thanks but I'm looking for a native way and it keeps sticking to DoT.
Dracozirion said:
Hi,
I've read on multiple pages that A13 supposedly supports DNS over HTTPS but there's no such option under the private DNS settings. It keeps using DNS over TLS.
Anyone knows how to properly enable it so self originating traffic uses DoH?
Click to expand...
Click to collapse
From what I remember reading you have to use either dns.google or cloudflare-dns.com to get the advantage of DoH. Google hasn't opened it to other sources like adguard.net or nextdns iirc
Mrcactuseater said:
From what I remember reading you have to use either dns.google or cloudflare-dns.com to get the advantage of DoH. Google hasn't opened it to other sources like adguard.net or nextdns iirc
Click to expand...
Click to collapse
That seems to have done it for some reason. Netdaemon uses HTTP3 (QUIC) now, didn't seem to work with 1dot1dot1dot1.cloudflare-dns.com.
Gonna monitor this, thanks!
Edit: there's still an active session for DoT (TCP port 853) but the tx/Rx counters increase only for the QUIC session. Probably failback or so.
I have a question about all these new DNS protocols: how does the phone initially resolve the fqdn 1dot1dot1dot1.cloudflare-dns.com or DNS.google? I guess connectivity to a classical DNS server is required for that first query or are they hardcoded in hosts file?
@Dracozirion for what it's worth if you're rooted, Magisk has a setting for "DNS over HTTPS", but I assume you're not rooted since you're looking for a native function - but also informational in case another user visits this thread for the similar purpose of achieving it any way they can.
I haven't used this setting.
Mrcactuseater said:
From what I remember reading you have to use either dns.google or cloudflare-dns.com to get the advantage of DoH. Google hasn't opened it to other sources like adguard.net or nextdns iirc
Click to expand...
Click to collapse
Thanks. Now I have DoH via Cloudflare.
roirraW edor ehT said:
@Dracozirion for what it's worth if you're rooted, Magisk has a setting for "DNS over HTTPS", but I assume you're not rooted since you're looking for a native function - but also informational in case another user visits this thread for the similar purpose of achieving it any way they can.
I haven't used this setting.
Click to expand...
Click to collapse
I did root but that's only for DNS requests coming from the Magisk app itself.
Dracozirion said:
I did root but that's only for DNS requests coming from the Magisk app itself.
Click to expand...
Click to collapse
Ah, I see. Thanks!

Question How to quickly turn off Private DNS?

I use adguard's Private DNS server for adblocking purposes however when I am connected to some public wifi hotspots, the private DNS will not allow me to log into the public wifi hotspot for some reason. When I turn off private DNS it works fine.
Is there a way I can quickly turn off private DNS without digging into the menus of my phone? maybe a quicktile or routine?
thanks!
Perhaps you could try the Private DNS Quick Settings Tile
Private DNS Quick Tile | F-Droid - Free and Open Source Android App Repository
Quickly toggle and configure Private DNS on Android 9.0+
f-droid.org
(you need to perform some actions via adb to allow this to work, so read the info in the link above)
craigacgomez said:
Perhaps you could try the Private DNS Quick Settings Tile
Private DNS Quick Tile | F-Droid - Free and Open Source Android App Repository
Quickly toggle and configure Private DNS on Android 9.0+
f-droid.org
(you need to perform some actions via adb to allow this to work, so read the info in the link above)
Click to expand...
Click to collapse
thanks! let me try it out
craigacgomez said:
Perhaps you could try the Private DNS Quick Settings Tile
Private DNS Quick Tile | F-Droid - Free and Open Source Android App Repository
Quickly toggle and configure Private DNS on Android 9.0+
f-droid.org
(you need to perform some actions via adb to allow this to work, so read the info in the link above)
Click to expand...
Click to collapse
I've been annoyed by same problem for long time, but not annoyed enough to actually looking for a specific solution like this. Thank you for this. Make life much easier
craigacgomez said:
Perhaps you could try the Private DNS Quick Settings Tile
Private DNS Quick Tile | F-Droid - Free and Open Source Android App Repository
Quickly toggle and configure Private DNS on Android 9.0+
f-droid.org
(you need to perform some actions via adb to allow this to work, so read the info in the link above)
Click to expand...
Click to collapse
thanks for this, its a big help!
seems to be working so far.

Categories

Resources