Can Google services be firewall-filtered (market yes, sync no)?

Question

I recently asked about the availability of calendars with limited sandbox permissions, since I felt that most of them ask for access that is too wide, and hence are not as secure as I'd like. I also explored in that question what options were available to sync only to local computers, and to definitively prevent the device from syncing private data (calendar, contacts, todos) to Google. I plan to do my own backups locally.

Side note: not syncing private data with Google is a little trickier than a new user would expect. This is because a Google account is required to use the marketplace, and once the phone has that account, it cannot be removed without a factory reset (at least in version 2.2). The sync to it can be disabled, but if one accidentally turns it on - easily done momentarily, in my view - contacts and calendar are likely to whoosh to the cloud in short order.

One of course has to balance security requirements with usability, and my favourite calendars thus far (Business Calendar, aCalendar) do not offer their own private calendar repositories (they just work with any calendar sync provider). Ergo, they are equally at risk of accidental cloud synching as the stock Calendar application.

So, I am wondering if rooting the device and installing a firewall would be the way to go? I was originally of the view that I could grant application permissions to Market/Play to contact Google, but not Calendar. However I see in the DroidWall FAQ, if one wishes to continue using the market after installing the firewall:

Enable the following applications:

• "Market";
• "Media Storage, DRM Protected Content Storage, Download Manager" and
• "Calendar Sync Adapter, Google Services Framework, Contacts Sync Adapter"

It seems odd that, to use the market one needs to grant permissions to the latter, but would be entirely in keeping with Google's policy of making it hard to avoid their services. Any root owners here have thoughts as to whether it is possible? I'm hoping I can filter+block on calendar.google.com etc whilst permitting play.google.com - or similar.

(I suppose the easiest answer to this Q is "try it!", but I'm looking for expertise before I risk rooting my phone).

Answer 1

To firewall, you need a root, as it modifies the iptables and filters the network stack. The iptables comes with Droidwall which is btw, an excellent tool and a must have if your ROM is rooted :)

Edit: Just checked mine, in theory its possible to create a script to modify the iptables to block the domain calendar.google.com whilst allowing play.google.com to pass through. Droidwall's set of rules are a bit too generic though, but you can most certainly set the custom script by hitting menu from within Droidwall itself and use it to suit your custom needs :)

The IP address for calendar.google.com is 173.194.33.37. and for play.google.com is 173.194.33.37. Sure they are the same, but you need to find out what port is the calendar using, same for play.

# Block all connections in the TCP port nn for calendar!
$IPTABLES -A "droidwall" -p TCP --destination "173.194.33.37" --destination-port nn -j "droidwall-reject"

Linky here that explains how to do add custom script.