Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Connexion issue #746

Closed
jossowla opened this issue Sep 3, 2017 · 17 comments
Closed

Connexion issue #746

jossowla opened this issue Sep 3, 2017 · 17 comments
Labels
Review

Comments

@jossowla
Copy link

jossowla commented Sep 3, 2017

Hi,

I don't know if this
is an issue, or a bad configuration :
Sometimes i can't access internet with all my allowed apps in AF+ firewall.
I have to apply rules with out any change to cet internet back.
Any idea ?

Thx you in advance :D
@ildar
Copy link

ildar commented Sep 3, 2017 via email

@jossowla
Copy link
Author

jossowla commented Sep 3, 2017 •
edited by ukanth
Loading

Hi ! Thx

I already turn on logs, but AF+ firewall won't log anything, even when i try to access to internet with blocked apps, logs remains empty.

When my internet is blocked, i tried to ping 8.8.8.8 and Terminal print that my pings are filtered.

My iptables rules generated by AF+ firewall :

``
==========
IPv4 Rules
==========

Chain INPUT (policy ACCEPT 1886 packets, 1084K bytes)
 pkts bytes target     prot opt in     out     source               destination         
2971K 3675M bw_INPUT   all  --  *      *       0.0.0.0/0            0.0.0.0/0           
2971K 3675M firewall   all  --  *      *       0.0.0.0/0            0.0.0.0/0           
2971K 3675M fw_INPUT   all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 oem_fwd    all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 fw_FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 bw_FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 natctrl_FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain OUTPUT (policy ACCEPT 1783 packets, 257K bytes)
 pkts bytes target     prot opt in     out     source               destination         
13851 1385K afwall     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
2131K  760M oem_out    all  --  *      *       0.0.0.0/0            0.0.0.0/0           
2131K  760M firewall   all  --  *      *       0.0.0.0/0            0.0.0.0/0           
2131K  760M fw_OUTPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
2085K  755M st_OUTPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
2085K  755M bw_OUTPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 afwall-wifi  all  --  *      eth+    0.0.0.0/0            0.0.0.0/0           
 8253  741K afwall-wifi  all  --  *      wlan+   0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-wifi  all  --  *      tiwlan+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-wifi  all  --  *      ra+     0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-wifi  all  --  *      bnep+   0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      rmnet+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      pdp+    0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      uwbr+   0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      wimax+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      vsnet+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      rmnet_sdio+  0.0.0.0/0            0.0.0.0/0           
 1943  268K afwall-3g  all  --  *      ccmni+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      qmi+    0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      svnet0+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      ccemni+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      wwan+   0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      cdma_rmnet+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      usb+    0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      rmnet_usb+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      clat4+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      cc2mni+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      bond1+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      rmnet_smux+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      ccinet+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      v4-rmnet+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      seth_w+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      v4-rmnet_data+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      rmnet_ipa+  0.0.0.0/0            0.0.0.0/0           
    0     0 afwall-3g  all  --  *      rmnet_data+  0.0.0.0/0            0.0.0.0/0           
Chain afwall-3g (24 references)
 pkts bytes target     prot opt in     out     source               destination         
 1943  268K afwall-3g-postcustom  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-3g-fork (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 1780  251K afwall-3g-home  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-3g-home (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 1001
   17  1850 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 1021
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10009
  118 19610 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10014
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10023
  575 85630 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10036
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10043
  545 94750 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10046
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10049
   99 15672 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10054
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10063
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10064
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10077
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10093
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10094
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10095
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10096
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10097
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10099
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10100
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10102
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10103
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10104
   26  2953 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10105
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10109
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10110
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10111
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10112
   55  6254 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10113
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10114
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10115
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10116
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10117
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10118
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10121
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10122
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10123
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10126
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10127
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10130
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10131
  128  8486 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 owner UID match 0
  378 32506 afwall-reject  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-3g-postcustom (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 1780  251K afwall-3g-fork  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-3g-roam (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 owner UID match 0
    0     0 afwall-reject  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-3g-tether (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 afwall-3g-fork  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-reject (5 references)
 pkts bytes target     prot opt in     out     source               destination         
 3074  292K NFLOG      all  --  *      *       0.0.0.0/0            0.0.0.0/0            nflog-prefix  "{AFL}" nflog-group 40
 3074  292K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
Chain afwall-vpn (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 owner UID match 0
    0     0 afwall-reject  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-wifi (5 references)
 pkts bytes target     prot opt in     out     source               destination         
 8253  741K afwall-wifi-postcustom  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-wifi-fork (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 afwall-wifi-lan  all  --  *      *       0.0.0.0/0            192.168.0.0/24      
 3262  385K afwall-wifi-wan  all  --  *      *       0.0.0.0/0           !192.168.0.0/24      
Chain afwall-wifi-lan (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 owner UID match 0
    0     0 afwall-reject  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-wifi-postcustom (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 1014
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 1010
 3262  385K afwall-wifi-fork  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-wifi-tether (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 afwall-wifi-fork  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain afwall-wifi-wan (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   24  3684 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 1021
 3844  213K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10009
  726  145K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10014
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10023
  135 38662 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10036
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10043
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10046
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10049
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10054
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10063
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10064
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10077
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10093
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10094
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10095
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10096
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10097
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10099
    4   240 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10100
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10102
   64  3840 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10103
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10104
  103 13397 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10105
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10107
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10109
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10110
   11   660 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10111
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10112
  152 26499 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10113
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10114
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10115
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10116
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10117
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10118
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10121
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10122
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10123
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10126
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10127
  198 15720 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10130
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10131
  288 18392 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 owner UID match 0
 2696  260K afwall-reject  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain bw_FORWARD (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 bw_costly_ccmni0  all  --  *      ccmni0  0.0.0.0/0            0.0.0.0/0           
Chain bw_INPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 162K  323M            all  --  *      *       0.0.0.0/0            0.0.0.0/0            ! quota globalAlert: 2097152 bytes 
 1610 1059K bw_costly_ccmni0  all  --  ccmni0 *       0.0.0.0/0            0.0.0.0/0           
2733K 3636M            all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner socket exists
Chain bw_OUTPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
94415  113M            all  --  *      *       0.0.0.0/0            0.0.0.0/0            ! quota globalAlert: 2097152 bytes 
 1427  222K bw_costly_ccmni0  all  --  *      ccmni0  0.0.0.0/0            0.0.0.0/0           
2084K  749M            all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner socket exists
Chain bw_costly_ccmni0 (3 references)
 pkts bytes target     prot opt in     out     source               destination         
 3037 1281K bw_penalty_box  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ! quota ccmni0: 9223372036854775807 bytes  reject-with icmp-port-unreachable
Chain bw_costly_shared (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 bw_penalty_box  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain bw_data_saver (1 references)
 pkts bytes target     prot opt in     out     source               destination         
2594K 2138M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain bw_happy_box (1 references)
 pkts bytes target     prot opt in     out     source               destination         
68785   25M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10014
 163K  148M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10009
73386   13M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 0-9999
2594K 2138M bw_data_saver  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain bw_penalty_box (2 references)
 pkts bytes target     prot opt in     out     source               destination         
2898K 2323M bw_happy_box  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain firewall (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 mobile     all  --  *      ppp+    0.0.0.0/0            0.0.0.0/0           
1138K  125M mobile     all  --  *      ccmni+  0.0.0.0/0            0.0.0.0/0           
    0     0 mobile     all  --  *      ccemni+  0.0.0.0/0            0.0.0.0/0           
    0     0 mobile     all  --  *      usb+    0.0.0.0/0            0.0.0.0/0           
    0     0 mobile     all  --  *      cc2mni+  0.0.0.0/0            0.0.0.0/0           
 431K   50M wifi       all  --  *      wlan+   0.0.0.0/0            0.0.0.0/0           
Chain fw_FORWARD (1 references)
 pkts bytes target     prot opt in     out     source               destination         
Chain fw_INPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 604K  796M fw_standby  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain fw_OUTPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 424K  124M fw_standby  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain fw_dozable (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x04/0x04
    2   270 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 0-9999
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 1001
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10009
    2   137 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10014
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10015
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10032
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10036
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10061
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10124
   24  2112 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain fw_powersave (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x04/0x04
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 0-9999
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain fw_standby (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    8   416 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x04/0x04
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10004
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10016
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10022
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10026
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10028
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10031
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10034
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10044
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10047
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10049
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10057
   85  9920 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10060
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10067
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10070
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10072
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10074
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10078
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10079
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10080
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10085
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10086
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10095
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10096
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10098
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10100
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10101
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10102
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10106
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10107
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10114
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10115
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10116
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10117
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10119
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10120
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10122
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10127
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10128
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10130
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 10039
Chain mobile (5 references)
 pkts bytes target     prot opt in     out     source               destination         
Chain natctrl_FORWARD (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain natctrl_tether_counters (0 references)
 pkts bytes target     prot opt in     out     source               destination         
Chain oem_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
Chain oem_out (1 references)
 pkts bytes target     prot opt in     out     source               destination         
Chain st_OUTPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
Chain st_clear_caught (2 references)
 pkts bytes target     prot opt in     out     source               destination         
Chain st_clear_detect (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            connmark match  0x2000000/0x2000000 reject-with icmp-port-unreachable
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            connmark match  0x1000000/0x1000000
    0     0 CONNMARK   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x0&0xffff0000=0x16030000&&0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x4&0xff0000=0x10000" CONNMARK or 0x1000000
    0     0 CONNMARK   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            u32 "0x0>>0x16&0x3c@0x8&0xffff0000=0x16fe0000&&0x0>>0x16&0x3c@0x14&0xff0000=0x10000" CONNMARK or 0x1000000
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            connmark match  0x1000000/0x1000000
    0     0 st_clear_caught  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state ESTABLISHED u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x0&0x0=0x0"
    0     0 st_clear_caught  udp  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain st_penalty_log (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            CONNMARK or 0x1000000
    0     0 NFLOG      all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain st_penalty_reject (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            CONNMARK or 0x2000000
    0     0 NFLOG      all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
Chain wifi (1 references)
 pkts bytes target     prot opt in     out     source               destination

@ukanth
Copy link
Owner

ukanth commented Sep 4, 2017

Seems like you are using kingroot/kingo root which bypasses AFWall+

@jossowla
Copy link
Author

jossowla commented Sep 4, 2017

Hi, no, i used twrp recovery & super SU to root my smartphone :3

@ukanth
Copy link
Owner

ukanth commented Sep 4, 2017

This particular line bypasses when there is connection change.

Chain OUTPUT
2131K  760M firewall   all  --  *      *       0.0.0.0/0            0.0.0.0/0 

Chain firewall (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 mobile     all  --  *      ppp+    0.0.0.0/0            0.0.0.0/0           
1138K  125M mobile     all  --  *      ccmni+  0.0.0.0/0            0.0.0.0/0           
    0     0 mobile     all  --  *      ccemni+  0.0.0.0/0            0.0.0.0/0           
    0     0 mobile     all  --  *      usb+    0.0.0.0/0            0.0.0.0/0           
    0     0 mobile     all  --  *      cc2mni+  0.0.0.0/0            0.0.0.0/0           
 431K   50M wifi       all  --  *      wlan+   0.0.0.0/0            0.0.0.0/0

Have a look at any other ROOT apps which you are using.

@jossowla
Copy link
Author

jossowla commented Sep 4, 2017

I don't use any other apps with root permissions. The only app installed with root permissions on my phone is AF+ firewall :)

@ukanth
Copy link
Owner

ukanth commented Sep 5, 2017

Then not sure why you have that chain (firewall) . You need to find out where that's coming from. it could be system app ( miui has one ) or some other setting ( i dont have details about your phone and model )

@ildar
Copy link

ildar commented Sep 5, 2017 via email

@jossowla
Copy link
Author

jossowla commented Sep 5, 2017

Here are my settings, i will try to find from where this line come from

==================
Network interfaces

ip6tnl0
ccmni17
ccmni16
ccmni15
ccmni14
ccmni13
ccmni12
ccmni11
ccmni10
lo
sit0
p2p0
ifb1
ifb0
wlan0
tunl0
ccmni9
ccmni8
ccmni7
ccmni6
ccmni5
ccmni4
ccmni3
ccmni2
ccmni1
ccmni0

===========
System info

Android version: 7.0
Manufacturer: vernee
Model: Thor E
Build: alps-mp-n0.mp1-V1.0.2_nb6753.66.n_P36
Active interface: mobile
Tether status: no
Roam status: no
IPv4 subnet:
IPv6 subnet:
/system/bin/su: not present
/system/xbin/su: not present
/system/app/Superuser.apk: not present
Superuser: eu.chainfire.supersu v2.82

===========
Preferences

activeNotification: false
activeRules: true
appVersion: 15972
bb_path: builtin
blockIPv6: false
disableIcons: false
disableTaskerToast: false
dns_value: auto
enableAdmin: false
enableConfirm: true
enableDeviceCheck: false
enableIPv6: false
enableLAN: true
enableLogService: true
enableRoam: false
enableVPN: false
fingerprintEnabled: true
fixDownloadManagerLeak: false
fixLeak: false
hasRoot: true
ip_path: auto
ipurchaseddonatekey: false
locale: fr
logDmesg: OS
logTarget: NFLOG
notification_priority: 0
notifyAppInstall: true
passSetting: p2
patternMax: 5
showFilter: false
showLogToasts: true
storedPid: []
sysColor: -10432
toast_pos: bottom
widgetX: 720
widgetY: 1280
Profile Mode : whitelist
Status : Enabled

======
Logcat

10:23:01 Selected Profile: AFWallPrefs
10:23:01 Starting root shell...
10:23:01 [libsuperuser] [SU%] START
10:23:01 Selected Profile: AFWallPrefs
10:23:01 Root shell is open
10:23:04 Selected Profile: AFWallPrefs
10:23:10 isWifiApEnabled is false

@jossowla
Copy link
Author

Hello,

I tried to disable all my systems rules. There was only my installed apps which where blocked.

But the "firewall" chain was still there. I don't know where it comes from.

Should i allow all systems entries to see if it disappear ?

@ildar
Copy link

ildar commented Sep 12, 2017 via email

@ukanth
Copy link
Owner

ukanth commented Sep 12, 2017

Seems like firewall rules is generated by system app, by doing quick search on vernee ( chinese maker ), lot of people are complaining about the firewall.

@ildar
Copy link

ildar commented Sep 12, 2017 via email

@jossowla
Copy link
Author

Hello,

I disabled my AF+ Firewall. then i rebooted my phone.
I printed my rules with iptables -L.
A lot of rules appeared .. And the "firewall" chain was there.

I am feeling real stupid because i rooted my phone and install AF+ Firewall only because i don't trust the rom installed on this one..
It doesn't make any sens if the system can write his own rules and bypass mine ^^

Do you know a way to prevent the system to use iptables ?

I noticed something else. one day, AFWall log worked for 1-2 mins. i saw many things trying to reach internet. then nothing. when i tried to join internet with blocked apps i didn't see logs anymore.

Thx for your work. :)

@jossowla
Copy link
Author

May be i could add a script which flush iptables before AF+ wall start ?
Or AF+firewall already flush iptables at the start ?

@ildar
Copy link

ildar commented Sep 29, 2017 via email

@ukanth ukanth added the Review label Mar 6, 2021
@ukanth
Copy link
Owner

ukanth commented Apr 18, 2021

No inputs. Closing due to inactivity. Please reopen if it's still relevant.

@ukanth ukanth closed this as completed Apr 18, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Review
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@ukanth @ildar @jossowla