Granular Firewall that can block on a per connection basis - General Questions and Answers

Is there a firewall app that can block just certain connections from an App? I currently use AFwall+ which is great but it is all or nothing (unless you write custom IPtables rules).
I would like the ability to block certain connections like stopping an app connecting to "*.facebook.com" but allowing it to connect to anything else.
On android versions previous to Oreo, the Xposed module XPrivacy could do this. You could white or black list a connection.
My phone is running Oreo 8.1, is rooted and has Xposed, however I would rather not use a firewall app that uses a VPN to work, as I have my own VPN i need to connect to.
To Summerise: Is there an android firewall that works in a restrictive sense, ideally where it asks me to allow or deny each connection the first time it happens?

Related

[Q] NoRoot Firewall app and apps access the internet

I recently installed the NoRoot Firewall app so I see which apps are accessing the internet and block those which shouldn't need access. The good part is that I haven't seen any apps access the internet that shouldn't - no flashlights, notepads, etc.
The problem is that I'm seeing some apps that will need internet access trying to connect dozens of times. I haven't used soundhound in months and it's trying to connect dozens of times in a half hour period. There are other apps that I rarely use that are trying to connect once in a while, like flickr, cloud drive (which isn't even set up), that I wish I could disable unless I need it, but I can live with those.
My questions are:
Why are some apps connecting so often when they're not in use?
Is there a way to disable apps from making connections until I'm actively trying to use them?
Thanks.
jrocket said:
My questions are:
Why are some apps connecting so often when they're not in use?
Is there a way to disable apps from making connections until I'm actively trying to use them?
Thanks.
Click to expand...
Click to collapse
They're connecting because they want to sync or maybe load some infos in the background. You can force them into hibernate mode with Greenify, but should all only work perfectly with root. Else you can't directly access the internet access.
Try Greenify and you will see if it works event without root. Not the best solution but a good beginning
Skulldiver said:
They're connecting because they want to sync or maybe load some infos in the background. You can force them into hibernate mode with Greenify, but should all only work perfectly with root. Else you can't directly access the internet access.
Try Greenify and you will see if it works event without root. Not the best solution but a good beginning
Click to expand...
Click to collapse
I know they're trying to connect, but my thinking is that they shouldn't when there's no account set up and all notifications are disabled. With apps like evernote where they're set to sync every few hours that makes sense, but if it's not serving ads, and there's no account to sync, I don't see why it needs to connect. I'm sure the app dev thinks it needs to, but I wish there was a way I could better control it.
I'll try greenify, thanks for the suggestion.

Secure Folder & ad-blockers

I have a bit of a problem with Secure Folder. I have tried using disconnect pro, adhell, and adguard. So 2x knox blockers and 1x vpn blocker. All 3 of them are installed in the standard main partition of the device and work fine on apps not in the secure folder. Any app I have in the secure folder is apparently completely bypassing the ad blocking of all 3 blockers. The only way this is possible seems to be that anything in that folder is also bypassing the knox firewall AND any vpn you have set up. Surely your phone has ONE internet connection so all traffic has to go through it, this blocking should work on secure folder apps just the same? The apps and their data may be segregated but if I have a hosts file blocking certain IP's, I see no reason that should not effect every connection on the device! For security reasons alone you would not want secure folder apps bypassing a VPN for example.
I did try to install disconnect pro in the secure folder too but it just wouldnt work, it would not turn on, probably because it was already installed and running in the main partition and can't be running twice. I really wouldn't want to run it twice anyway due to the battery drain being double for no good reason.
So basically as far as I can see it is impossible to block ads in apps installed in secure folder?? (or for that matter, use your vpn with apps in the secure folder??)
I'm having the exact same issue. I was hoping for a resolution
I use blokada (a VPN based blocker) on my note8. You have to run it within the secure apps environment to block ads there as well. It's a bit counter intuitive but I actually love this. Even if I accidentally leave my work VPN open in the main OS my traffic from secure apps doesn't get sent through it. IMO this is brilliant.
A bit to late but has anyone figured this out yet, to filter the entries phones internet access through the main sides VPN... I found that using a direct DSN will help block ads in both primary and secondary, but one primary DSN is unstable for some websites

[APP] [8.0+] NoRoot Firewall and NetGuard both not preventing data usage of System Ap

I've installed and tried both these apps, both use a VPN connection to "filter out" data usage (WiFi and Mobile data)... they also include logs of attempted connections with IP domains included.
However, when I block system apps such as Android System and its sub-apps, they still accumulate data. While some attempts for connection to Android System apps are shown in the log and blocked, some must be getting around it...because I check the Data Usage for Android System, and it constantly climbs even while "blocked" from data access by the firewall VPNs.
Anyone else have same issue? Is this just an inevitable flaw if you don't have root access? Is this possibly due to spyware which is somehow overriding?
Bump

how to completely remove ipv6 support from android 10

as the title suggests I can not completely and perpetually disable ipv6 in android 10. I tried with edxposed and custom script but it does not work, or rather sometimes yes sometimes not.
I would like to delete it on the kernel side
For Android, IPv6 can only be disabled if you’re on a mobile data connection. This is because Android does not support DHCPv6 over Wi-Fi by default.

How can I Bypass tether restrictions

There used ba a thread on here telling how to bypass the tethering on the Ace 1 5G but it's since been deleted. Does anyone have any info you can share on how to do this? It would be much appreciated!
Depends on what you need, really. I recommend VPNHotspot for most users. If you don't want to use a VPN, use a local VPN like Adguard. No need to pay for it or have any blocking enabled, just having the VPN service enabled is enough.
fddm said:
Depends on what you need, really. I recommend VPNHotspot for most users. If you don't want to use a VPN, use a local VPN like Adguard. No need to pay for it or have any blocking enabled, just having the VPN service enabled is enough.
Click to expand...
Click to collapse
The VPN service now will no longer work for streaming channels. Tried it on my Roku box.
Articul8Madness said:
The VPN service now will no longer work for streaming channels. Tried it on my Roku box.
Click to expand...
Click to collapse
Are you using a local or remote VPN? Try through 1.1.1.1 Warp if your using local VPN, it should get around service blocks if that's what your experiencing.
fddm said:
Are you using a local or remote VPN? Try through 1.1.1.1 Warp if your using local VPN, it should get around service blocks if that's what your experiencing.
Click to expand...
Click to collapse
This only appears to happen on Android 11 and 12. On 10 I don't have any issues, with or without VPN Hotspot, PDANet, or going the tunnel route with a VPN.
That hasn't been my experience, though I haven't updated my devices to Android 12 yet. Your Android version shouldn't matter and passing traffic through a remote VPN service should get around any carrier dpi and blocking.
Have you done any debugging? Like trying a dns lookup(nslookup google.com) or pinging a remote IP(ping 8.8.8.8)? To get an idea of what is not working.
Easytether? if you don't mind throttled speed through usb
josmoe said:
Easytether? if you don't mind throttled speed through usb
Click to expand...
Click to collapse
I've tested many similar apps and Easytether was the fastest of the bunch. And it supports OpenWRT. It has the same problem as all those apps though, it's just not stable. You have to reconnect usb often which makes it useless.
But as an approach for bypassing hotspot limits, apps like pdanet and easytether are solid. The only way to really combat them is carrier snitchware. I still have no idea what @Articul8Madness is experiencing past a Roku box not working, but carrier software not properly disabled could be another thing to look into.
fddm said:
That hasn't been my experience, though I haven't updated my devices to Android 12 yet. Your Android version shouldn't matter and passing traffic through a remote VPN service should get around any carrier dpi and blocking.
Have you done any debugging? Like trying a dns lookup(nslookup google.com) or pinging a remote IP(ping 8.8.8.8)? To get an idea of what is not working.
Click to expand...
Click to collapse
There's something going on with this Android 11. Even after debloating its doing crap like forcing updates. They've done something different and I haven't really gotten to the meat and potatoes yet. Debugging and pinging a remote IP doesn't work - I can't even do a custom APN because when I go to save it the phone autodeletes it upon saving.
Articul8Madness said:
There's something going on with this Android 11. Even after debloating its doing crap like forcing updates. They've done something different and I haven't really gotten to the meat and potatoes yet. Debugging and pinging a remote IP doesn't work - I can't even do a custom APN because when I go to save it the phone autodeletes it upon saving.
Click to expand...
Click to collapse
Only way I know to disable the Moto updater is to delete it with system r/w or make a Magisk module. It's in /product/priv-app/3c_ota/ and can not be disabled by normal means.
You can also use Magisk to modify /product/etc/apns-conf.xml to change APN settings, but that doesn't matter for the apps your testing.
Does your ping test only apply to VPNHotspot or another setup? Are you using any VPN, and if so, which one(s). Does it work with the normal android tether/hotspot function(while you have data)?
fddm said:
I've tested many similar apps and Easytether was the fastest of the bunch. And it supports OpenWRT. It has the same problem as all those apps though, it's just not stable. You have to reconnect usb often which makes it useless.
But as an approach for bypassing hotspot limits, apps like pdanet and easytether are solid. The only way to really combat them is carrier snitchware. I still have no idea what @Articul8Madness is experiencing past a Roku box not working, but carrier software not properly disabled could be another thing to look into.
Click to expand...
Click to collapse
its reasonable stable for me with a popular carrier hooked to linux computer which you can bridge for wifi hotspot lan router,etc.with firewall set
So tethering freedom is not longer available on the factory unlocked version?
fddm said:
Depends on what you need, really. I recommend VPNHotspot for most users. If you don't want to use a VPN, use a local VPN like Adguard. No need to pay for it or have any blocking enabled, just having the VPN service enabled is enough.
Click to expand...
Click to collapse
Seconding VPN Hotspot. In my case I was able to get it working with Blokada 4.4; Blokada 5 and 6 don't work with it, but also seem to be worse at blocking ads anyway.

Categories

Resources