AFwall+: Why does the Kernel need an internet connection all the time?

Question

Since I started using AFWall+ (a firewall based on iptables) on Android, I was wondering why the Linux kernel tries to connect to the internet all the time?

Allthough blocking the kernel I didn't recognize any disadvantages or issues.

A short answer is given here on the FAQs page of AFWall+.

It says that the kernel does not communicate directly, it only pass packet information from some applications and something about policy routing based on fwmark.

What does it mean? What is fwmark? Can somebody translate it into simple language for noobs? Is it better to allow the kernel to connect over TCP?

Answer 1

fwmark stands for Firewall Mark, which can be better described as a "netfilter mark", according to a quote in this article (also my reference).

Simplifying stuff a lot:

fwmark is a "stamp" on TCP/IP packets put there by the kernel. mark refers to the command line entity (whatever that is, refer the linked article for details). These are used by Linux Virtual Servers to coordinate routing from different IP addresses used by the virtual servers to the same real server (the actual server machine).

I have next to no idea why an Android device would need that. It is probably a holdover from the mainstream Linux kernel features integrated by the developer into the Android kernel.