AFWall+ allow DHCP+DNS services without allow all root?

Question

Picked up AFWall+ today when heard it is the fork of Droidwall (which had been sold off to Avast). Bonus is that AFWall+ has an entry for "(Tethering) - DHCP+DNS services". Problem is that entry doesn't work unless I also allow "(root) - Applications running as root". ("Doesn't work"=connecting device gives error "Avoided poor internet connection".)

I believe the following script would still require root to be allowed, but unsure.

$IPTABLES -A "afwall-wifi" -p TCP --destination-port 67 -j RETURN || exit
$IPTABLES -A "afwall-wifi" -p UDP --destination-port 67 -j RETURN || exit

(Built from: DroidWall and Wireless Tethering and https://github.com/ukanth/afwall/wiki/CustomScripts )

The goal is to not blanket whitelist all Root apps, but still allow DCHP/DNS out over the Wi-Fi interface (phone as wifi hot spot).

Is this even possible? If so, how so?

(Sprint Samsung Galaxy S III SPH-L710 running Avatar nightly_3.1-658-20130823-NIGHTLY-d2spr , based on CM 10.1 , android 4.2.2 )

Answer 1

On my stock Android 4.2.1, I don't need to allow (Tethering) - DNS+DHCP service, let alone (root) - Applications running as root for DHCP/DNS over Wifi hostpot in AFwall+. My system can get the IP easily but would not connect to internet unless I change my system's DNS setting to some public DNS like 8.8.8.8. It is a fix that I once saw on a forum.

That said, my system would not receive the IP from my other two devices running Android 4.4.4 if I don't allow (Tethering) - DNS+DHCP service. Even then, I still have to tweak that DNS setting to browse the Internet on my system.

I don't know the reason for such behavior, but never ever I needed to allow (root) - Applications running as root or those IP-tables rules you mentioned.