I wanted to reduce the amount of thing that Google knows about myself, because after reading several articles about what data that Google collect by default in android, I feel terrified. Because it is like no matter where I go, there is a creep behind my back that keeps on following me, watching me 24/7, like a drunk weirdo on the street that looks at me with scary eye and keeps on insisting to follow me (where in this case, the creep is Google). While trying to reduce the amount of data that google can collect on my phone (I have uninstalled or disabled all google app, including google play store, except google play services) , there is a severe roadblock that I encountered and don't know how to solve. One of the problem is that **I don't know how to keep google play services enabled while also preventing it from connecting to internet to stop google from misusing it to collect data in my phone**. I can disable it, but many app on my phone (such as WhatsApp) either breaks or work incorrectly when google play services is disabled. The most notable problem is that WhatsApp stop working in the background when google play services is disabled, that means I wont receive call and messages unless WhatsApp is opened in my screen (I have tried everything to prevent it from stop working in the background, none worked). To keep it simple, this is what I want to achieve: **I want google play services to remain enabled and all apps that use google play services able to connect to internet, while at the same time I don't want to allow google play services to connect to the internet**. In other word, I need some kind of firewall that allows all app, except google play services, from connecting to the internet. Android does not have firewall by default, and I tried to use firewall for non-rooted device such as NetGuard. To my surprise, google play services didn't show up in any of the firewall I tried, which means I cant use the firewall to block it. I really, really want to avoid rooting my phone because of serious security issues and the possibility of bricking my phone in the process. So, how to achieve what i want in non-rooted android phone?

I have a VPN to a service, and an app to deal with it. I want this app to ...really not working et all, if the VPN is not turned on. My best idea is to limit its network access to the VPN interface. In Linux, it would be easy with iptables (+ using that apps have their own uid on Android), but is there a much better way?

So my idea for a project is a firewall for Android hotspot. Like on routers you can block access to certain websites, I want to implement it in Android. In settings, system can only limit number of connected users. There aren't advanced options (I'm using Android 13). So if I for example block instagram on my firewall, the devices connected to my mobile hotspot won't be able to access it. Like a parental control. I know I probably must root my phone for this, but it's no problem. The answers I read were old and I didn't find any specific instructions. People recommended using hosts file or iptables but I'm not sure it would work if the request isn't directly from my phone. Downloaded a few blockers but they also fail, or doesn't even have options to do this. So the main question is, is it possible ? I wanted to ask before I start digging in my phone. Information I found: https://android.stackexchange.com/questions/214660/is-there-a-way-to-set-up-a-firewall-on-mobile-hotspot-to-block-incoming-connecti https://www.reddit.com/r/AndroidQuestions/comments/ihjrbv/mobile_hotspot_allow_only_one_website/ How to use iptables in an Android application https://android.stackexchange.com/questions/144422/create-wifi-hotspot-but-block-access-certain-domains https://android.stackexchange.com/questions/195351/how-to-block-a-particular-website https://android.stackexchange.com/questions/149381/how-to-block-filter-sites-on-mobile-data-connection-preferably-using-dns-server/219405#219405 https://android.stackexchange.com/questions/16485/how-to-block-access-to-a-website/218316#218316

Many Android apps don't work properly with Contacts access fully denied. This limits the applicability of the Android's built-in Permissions model when dealing with Contacts protection. Hence the question: Are there ways for fine-grained Contacts restrictions on a per-app basis in Android? Like one of: - Present zero contacts to a given app while still allowing contacts access - Limit the list of Contacts fields available to a given app. (E.g. do not present the Notes or Address fields to a messaging app) For rooted phones there is the excellent XPrivacyLua, effectively providing API firewall functionality, where you e.g. present empty contacts list by default while allowing full contacts list to selected apps. Do we have something similar for non-rooted devices? Anything like a Contacts proxy or a virtual contacts provider?

I got the inspiration here . It looks like AFWall+ is able to create a NAT forwarding policy to keep all traffic going through a SOCKS5 proxy and fool Google apps into thinking they are not connected via a VPN (Google apps implement additional security measures when connecting via VPNService and if you are in China you will not pass the security check - the security check requests don't go through VPN, so they will EOF because GFW will kill these requests, read more here ). So my question is, if let's say I have a socks5 server running at 192.168.1.1:1088 which tunnels all connections via vmess protocol (aka V2Ray) to remote servers in the US, how do I create my custom script? I have tried:

IP6TABLES=/system/bin/ip6tables
IPTABLES=/system/bin/iptables
ULIMIT=/system/bin/ulimit
PORT=1088
SERVER=192.168.1.1
$ULIMIT -n 4096
$IP6TABLES -F
$IP6TABLES -A INPUT -j DROP
$IP6TABLES -A OUTPUT -j DROP
$IPTABLES -t nat -F OUTPUT
$IPTABLES -t nat -A OUTPUT -o lo -j RETURN
$IPTABLES -t nat -A OUTPUT -d 127.0.0.1 -j RETURN
$IPTABLES -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to-destination $SERVER:$PORT
$IPTABLES -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination $SERVER:$PORT
$IPTABLES -t nat -A OUTPUT -p tcp -j DNAT --to-destination $SERVER:$PORT
$IPTABLES -t nat -A OUTPUT -p udp -j DNAT --to-destination $SERVER:$PORT

This does not work. So: 1. Did I create a wrong script? How do I create a script that does what I want to do? 2. Are there other settings that I should enable first? I didn't tick any app so I assume that means all app go through custom script, right?

Connecting from Linux, using an older adb (downloaded at tried 1.0.41 just to troubleshoot this - no difference, except that the messages now do include "Connection refused"), and the devices runs Android 9. This has worked fine literally for years, but all of a sudden, I can no longer connect to a device via TCP/IP. I can't think of anything that has changed. The device has a static IP (and I usually connect and disconnect multiple times per day), and I do run a firewall on it (AFWall+), which has never caused a problem in the past. $ ADB_TRACE=1 adb connect 192.168.0.2 main: 1915:140003988076352 | Handling commandline() adb_query: 1915:140003988076352 | adb_query: host:connect:192.168.0.2 _adb_connect: 1915:140003988076352 | _adb_connect: host:version WriteFdExactly: 1915:140003988076352 | writex: fd=3 len=4: 30303063 000c WriteFdExactly: 1915:140003988076352 | writex: fd=3 len=12: 686f73743a76657273696f6e host:version ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=4 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=4 got=4 4f4b4159 OKAY _adb_connect: 1915:140003988076352 | _adb_connect: return fd 3 adb_connect: 1915:140003988076352 | adb_connect: service host:connect:192.168.0.2 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=4 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=4 got=4 30303034 0004 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=4 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=4 got=4 30303230 0020 _adb_connect: 1915:140003988076352 | _adb_connect: host:connect:192.168.0.2 WriteFdExactly: 1915:140003988076352 | writex: fd=3 len=4: 30303161 001a WriteFdExactly: 1915:140003988076352 | writex: fd=3 len=26: 686f73743a636f6e6e6563743a313732 host:connect:192 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=4 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=4 got=4 4f4b4159 OKAY _adb_connect: 1915:140003988076352 | _adb_connect: return fd 3 adb_connect: 1915:140003988076352 | adb_connect: return fd 3 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=4 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=4 got=4 30303237 0027 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=39 ReadFdExactly: 1915:140003988076352 | readx: fd=3 wanted=39 got=39 756e61626c6520746f20636f6e6e6563 unable to connec unable to connect to 192.168.0.2:5555 Any ideas what might cause this?

I'm using the only open source firewall for Android: [NetGuard](https://play.google.com/store/apps/details?id=eu.faircode.netguard) and would like to use a VPN in addition. Is this possible? If so: _how_? Both types of apps typically use virtual VPN tunnels. NetGuard has network settings too. Many adblockers use such as well which is why I'm only using a Firefox AddOn.

I have a rooted Android 11 device and I use a VPN app with the option Block connections without VPN enabled. This prevents any apps on my phone from communicating with my PC on the same LAN/WIFI network. For example, I can't use VoiceMeeter VBAN or Asus Armoury Crate apps from my phone. Is there a way I can set up routing rules or firewall rules on my phone so that local traffic bypasses the VPN block and goes through the LAN/WIFI network? What I have tried so far: • I have used the split tunneling feature, but it didn't work. • I have used the AFWall+ app to allow LAN/WIFI access for some apps, but it also didn't work. I appreciate any help or suggestions. Thank you.

I'm using Rethink DNS to monitor traffic. I'm curious as to why the 'Phone and Messaging Storage' group would be reaching out to google domains in addition to app.hubspot.com. Attached are the firewall logs along with the apps included within the 'Phone and Messaging Storage' group.

Background -- I want to temporarily block a specific app from using the Internet on my Android device, using a batch file. The device is rooted, so it should be possible via the PC. The problem -- I actually found something over the Internet that seems to work fine for most apps:

@echo off
set package_name="com.android.chrome"

c:
cd\
cd C:\Users\User\AppData\Local\Android\Sdk\platform-tools

for /f "delims=" %%A in ('adb shell dumpsys package %package_name% ^| findstr "userId="') do (
  for /f "tokens=2 delims== " %%B in ("%%A") do (
    echo Extracted UID: %%B
    adb shell "su -c 'iptables -A OUTPUT -m owner --uid-owner %%B -j DROP'"
  )
)

And to unblock:

@echo off
set package_name="com.android.chrome"

c:
cd\
cd C:\Users\User\AppData\Local\Android\Sdk\platform-tools

for /f "delims=" %%A in ('adb shell dumpsys package %package_name% ^| findstr "userId="') do (
  for /f "tokens=2 delims== " %%B in ("%%A") do (
    echo Extracted UID: %%B
    adb shell "su -c 'iptables -D OUTPUT -m owner --uid-owner %%B -j DROP'"
  )
)

Thing is, as I wrote, it doesn't always work for all apps. I also tried this instead:

...
adb shell "su -c 'iptables -I OUTPUT -m owner --uid-owner %%B -j REJECT'"

What I've found -- I've found an open sourced app called "AFWall+ " , and inside of it, I've noticed a file that seems to call many functions to block the app. When launching the app and applying a blocking rule, it indeed takes some time, which means maybe it's worth checking out: https://github.com/ukanth/afwall/blob/beta/app/src/main/java/dev/ukanth/ufirewall/Api.java#L660 I've tried to launch it and debug, and I think it created more than 90 adb commands in the process of blocking a single app that I chose... But, it seems it worked. The questions -- 1. Is there a minimal way to block an app completely from the Internet using adb ? 2. How come there are so many commands that were used on "AFWall+"?

Instead of using 3rd party app freezers, I've been using "pm disable-user" / "pm uninstall" for years to disable/uninstall bloatware. However, some apps, if uninstalled (or even disabled sometimes), bootloop the device or just break basic functionality. So, I wish to block internet access to that bloatware which indirectly prevents me from removing it. Is there an adb command to implement internet blocking on a per app basis, like "pm uninstall" is for uninstalling? *(Yes, there are plenty firewall apps, but why rely on a 3rd-party app for something you can do yourself?)*

I'm using a firewall (NoRoot) on (Samsung) Android (10) to try to harden it, but now, push-notifications aren't coming through. I'm trying to figure out which apps/services are responsible for that and what URLs/ports need to be whitelisted. I've seen several candidates that might be it: * System * A *different* System‽ * System (Uninstalled) 🤨 * Google Play services/Google Services Framework * AASAservice, Accessibility, … … …, Wallpapers, WlanTest (very long list) * Hiya Service Most search results just mention this page which doesn't specify the app/service that requires the URLs and ports listed. Likewise, this answer (which is outdated since GCM is deprecated) also doesn't specify *which service* to whitelist. And this page outright recommends just allowing everything which defeats the whole point to a firewall.

I've seen many articles and tried many applications like 'mobiwol ' 'droidwall' 'avast antivirus' 'foxfi'. **What my problem is that I've a very limited mobile data and I want to use it with my laptop with wireless/usb tethering without any android app accessing internet.** I was thinking to block all android application to access internet and just allow portable hotspot to access mobile data, then I'll connect via portable hotspot and use the data in my laptop. I found application like 'droidwall' or 'avast antivirus' which requires a rooted device, but I cannot root my device as it'll void warranty. Then I found 'Noroot firewall' or 'mobiwol ' which creates a virtual VPN to block internet access. That's exactly what I want. But I want to allow portable hotspot to access mobile data which is not possible see 2nd last answer here . So basically I'm struck. Can anyone please suggest what should I do? or simply *how can I use internet in laptop via android device without android app accessing mobile data?* Note: My device - samsung tab2 3100, android version 4.1.2

A few non-rooted (no rooted) Android 7 and 8 phones from (Huawei, ZTE, Neffos and Samsung) were tested in this simple firewall (NetGuard) experiment. A selection of apps (including apps from the phone manufacturer) was chosen to be blocked from accessing the Internet regardless using Mobile Data or WiFi, by using NetGuard. Before the experiment, NetGuard and GlassWire for Android were installed. The GlassWire is activated to monitor if these apps still can access to the Internet. Throughout the experiment, GlassWire reported that some apps, that were blocked by NetGuard, had network traffic to the Internet. Therefore, it seems that users who buy any Android phones are denied full control of the phone, even if they have installed privacy protection apps such as NetGuard. So, to make the experiment fair enough, this question is posted here, requesting help from experts out there, on whether what is the actual problem(s). Is the problem caused because GlassWire reports false positives? Or NetGuard requires special configurations in order to block Internet for selected apps? Or Android phones disregard users and allow apps to access Internet even though NetGuard was installed?

I installed an AOSP Android 12 based ROM with root. I set up a simple custom stateful iptables firewall to block all connectivity except for a browser. I connect to WiFi and there is no internet. This setup does work after some initial network activity occurs on a freshly setup ROM with just the default firewall left in place for a little time (until browser able to access internet). What sequence of events occurs behind the scenes on a freshly set up Android ROM for the internet connectivity to be enabled? What sort of things must occur for Android network connectivity to become available for apps after a fresh installation and after having established WiFi connection? There's no internet if you just open up the firewall for one app on a new installation and having connected to a WiFi.

Is there a way via adb shell to disable an apps access to WiFi and Data? I'd like to turn off internet for all apps and then selectively turn it on for required apps. I know the manual way by going to App Info, that is not what I'm looking for. Nor for a firewall style third party app. I'm specifically looking for a way I can script this.

Since I uninstalled root firewall, I've been facing a lot of bugs concerning network connectivity; I lost tethering access and the internet became so slow. Even browsers have reported "connection refused" issues. How to fix this?

Some posts explain, that Android OS has all ports open by default with a policy to accept all incoming connections. But od a "NetGuard" Android project they mention "Android does not allow incoming connections". So, how is it and what is the default configuration of a netfilter in Android OS? Thank you in advance!

We are using BenQ Interactive Flat Panels (IFPs) at school, and we are having issues with updating the apps. The firewall rules we have set up *should* bypass all authentication, but when it comes to updating the apps, the download either just hangs (i.e. when using DMS) or immediately fails (when attempting a download on the device). System version updates work without issue, but a reset will not "download" the system version, this must be run off a USB instead. We have reserved the DHCP IPs (both Wifi and Eth) and assigned them to the firewall rules listed below (provided by BenQ): |App |URL/DNS | |-------|-----------| |EZWrite |https://ezwriteupload-eu.s3.eu-central-1.amazonaws.com/
https://ezwriteupload.s3-ap-northeast-1.amazonaws.com
https://ezwrite.benq.com/
https://ezwrite-relay.benq.com/
https://service-portal.benq.com
https://iam.benq.com
\*.pubnub.com
\*.pndsn.com
\*.pubnub.net
\*.pubnub.io
stun.l.google.com
stun1.l.google.com
stun2.l.google.com
stun3.l.google.com
stun4.l.google.com
stun.services.mozilla.com
23.21.150.121
stun01.sipphone.com
stun.ekiga.net
stun.fwdnet.net
stun.ideasip.com
stun.iptel.org
stun.rixtelecom.se
stun.schlund.de
stunserver.org
stun.softjoys.com
stun.voiparound.com
stun.voipbuster.com
stun.voipstunt.com
stun.voxgratia.org
stun.xten.com| |EZWrite OTA| http://qspublic.s3.amazonaws.com
https://qspublic.s3-ap-southeast-1.amazonaws.com/
|FW OTA| http://vod.benq.com/tvservice_api/api/response.php
https://d3bx1fc1zkxy8q.cloudfront.net
https://donglefw.s3-ap-northeast-1.amazonaws.com/
update.xml
https://qotaapi.benq.com/api/v2/
https://vod.benq.com
https://benqqota.firebaseio.com
https://d1m7bten765ify.cloudfront.net| |AMS|https://ams.benq.com/api/*
https://www.googleapis.com
https://api.dropboxapi.com |InstaQshare/InstaShare |http://h1.ee-share.com/| |BenQ Suggest |http://vod.benq.com/suggest/public/| |Easy Setting |https://smartdms.benq.com/ESApi/public
http://relaysmartdms.benq.com:443
https://smartdms.benq.com.cn/ESApi/public
http://relaysmartdms.benq.com.cn:443
|X-Sign |https://Relay.benq.com
https://Apiservice.benq.com
https://X-Sign.benq.com
https://logapiservice.benq.com
https://qspublic.s3.amazonaws.com
https://xsignbdp-eu.s3.eu-central-1.amazonaws.com
https://vod.benq.com
https://sa900-api.elasticbeanstalk.com
https://api.openweathermap.org
https://Relay.benq.com.cn
https://Apiservice.benq.com.cn
https://X-Sign.benq.com.cn
https://logapiservice.benq.com.cn
http://qspublic.s3.cn-north-1.amazonaws.com.cn
https://benqxsignbdp.oss-cn-hangzhou.aliyuncs.com
https://benqxsignbdp.oss.aliyuncs.com
https://vod.benq.com
https://xsignbdp.s3.cn-north-1.amazonaws.com.cn
| |DMS |https://dms.benq.com/
https://vod.benq.com/
http://staging2.benq.com
https://dms-relay.benq.com
https://cmota.s3.amazonaws.com/
https://dsdownload.benq.com
apexd90h2t5wg-ats.iot.eu-central-1.amazonaws.com
https://benq-dms-eu.s3.eu-central-1.amazonaws.com| |Qtouch |reg.wittydog.com.cn
www.wittydog.com.cn| |Blizz/TeamViewer|\*.teamviewer.com
\*.blizz.com| |Android Time Sync| time.android.com
2.android.pool.ntp.org| |Broadcast| https://x-signbroadcast-relay.benq.com
https://x-signbroadcast-api.benq.com
https://X-Signbroadcast.benq.com
https://qspublic.s3.amazonaws.com
https://broadcastbdp-eu.s3.eu-central-1.amazonaws.com
https://vod.benq.com
https://x-signbroadcast-relay.benq.com.cn
https://x-signbroadcast-api.benq.com.cn
https://X-Signbroadcast.benq.com.cn
http://qspublic.s3.cn-north-1.amazonaws.com.cn
https://vod.benq.com
https://broadcastbdp.s3.cn-north-1.amazonaws.com.cn| |InstaShare2 |https://vod.benq.com/
On your Windows firewall, allow access to the following application: %ProgramFiles(x86)%\InstaShare 2\BenQShare.exe| |IAM |apitest.benq.com
iam.benq.com|

I've been using the Android mobile hotspot to get an Internet connection while traveling. The stock hotspot is fine for my laptop which is firewalled, but there are a few devices (smart TV, game system, etc) which are not at all secure to put onto an open network. I want to have a firewall on my mobile hotspot (for blocking all external traffic except return traffic). Is there any way, including app for that? Preferably open source but even paid is fine. My Android isn't rooted, so I would prefer a solution that doesn't require rooting my phone (if possible). Just in case you might think NAT provides adequate firewalling for security, read here . TLDR; NAT is not a security layer. I've already tried searching for this here, but I only found a question from someone trying to filter IP addresses that was never answered. None of the hotspots I found in the Play store offered any port blocking features. I should mention that I have reason to believe my carrier's NAT does not block incoming connections. That reason being that running a web server on my phone using NodeJS in Termux will be accessible over the Internet.