I have an old Android phone with Ice Cream Sandwich and DroidWall as a firewall, which makes sure that apps can't use the 3G unless I enable it for that app. DroidWall starts on boot but there is a very brief time before it starts when any app can use the internet.

What I would like to do is stop all incoming and outgoing internet access until DroidWall automatically runs on boot to put the firewall rules in place. DroidWall allows running a script when it starts so conceivably I could undo the block-everything rules when it starts. The phone is rooted but doesn't have a /etc/init.d/.

Basically I want to make sure there is not even a second that traffic can get out before the firewall. 3G is expensive but I need it so I can't turn it off.

  • Would it suffice if an automation app disables the mobile data during shutdown and enables it after n seconds of boot (assuming Droidwall would be started by than)?
    – Firelord
    May 3, 2017 at 21:38
  • @Firelord Is there a flag I can set to make sure it always starts with mobile data disabled, and do you know how I can enable it after the script runs?
    – newguy
    May 4, 2017 at 16:34

1 Answer 1


Things have changed, DroidWall is no more maintained, rooting techniques have to be changed with Android 5 and 6 releases; particularly SELinux has to be taken care of, and there is always init.d support available with Magisk. But the question still stands valid.

Android depends on Linux kernel's builtin firewall which can be controlled with iptables. Default policy is ACCEPT which can be set to DROP on boot, unless all rules are loaded. This can be done with a simple init.d script or directly from Android's init services:

# /system/etc/init/firewall_policy.rc

on post-fs-data
    exec u:r:magisk:s0 -- /system/bin/iptables -P OUTPUT DROP

After boot, set policy back to ACCEPT. AFWall+ does this automatically.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .