Picked up AFWall+ today when heard it is the fork of Droidwall (which had been sold off to Avast). Bonus is that AFWall+ has an entry for "(Tethering) - DHCP+DNS services". Problem is that entry doesn't work unless I also allow "(root) - Applications running as root". ("Doesn't work"=connecting device gives error "Avoided poor internet connection".)

I believe the following script would still require root to be allowed, but unsure.

$IPTABLES -A "afwall-wifi" -p TCP --destination-port 67 -j RETURN || exit
$IPTABLES -A "afwall-wifi" -p UDP --destination-port 67 -j RETURN || exit

(Built from: DroidWall and Wireless Tethering and https://github.com/ukanth/afwall/wiki/CustomScripts )

The goal is to not blanket whitelist all Root apps, but still allow DCHP/DNS out over the Wi-Fi interface (phone as wifi hot spot).

Is this even possible? If so, how so?

(Sprint Samsung Galaxy S III SPH-L710 running Avatar nightly_3.1-658-20130823-NIGHTLY-d2spr , based on CM 10.1 , android 4.2.2 )


On my stock Android 4.2.1, I don't need to allow (Tethering) - DNS+DHCP service, let alone (root) - Applications running as root for DHCP/DNS over Wifi hostpot in AFwall+. My system can get the IP easily but would not connect to internet unless I change my system's DNS setting to some public DNS like It is a fix that I once saw on a forum.

That said, my system would not receive the IP from my other two devices running Android 4.4.4 if I don't allow (Tethering) - DNS+DHCP service. Even then, I still have to tweak that DNS setting to browse the Internet on my system.

I don't know the reason for such behavior, but never ever I needed to allow (root) - Applications running as root or those IP-tables rules you mentioned.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.