I know of no way to restrict an app to the 3G network (as opposed to 2G/4G), but there are several solutions to restrict apps to either WiFi or mobile networks (or keep/allow them from/to both). Examples include DroidWall - Android Firewall1 (which you already mentioned, but which is discontinued), its successor AFWall+2, its fork Android Firewall3 (gone), ...
If you have Android ICS, you can set the "Restrict background data" setting for each app. Go to Settings > Data usage, select the Mobile tab, then scroll down and select the app that you want to restrict. You can set the option at the bottom of the page that appears.
If an app is built properly, setting this option will disallow the widgets and ...
You can use rules like this in your custom scripts:
$IPTABLES -A "droidwall-wifi" -m owner --uid-owner 12345 --destination "192.168.1.0/24" -j RETURN
Instead of 12345, you need to specify the UID assigned to the app; you can find that UID in the list of apps in DroidWall.
Remember that UIDs are assigned dynamically, and if the app is removed, the UID ...
Mobiwol is an Android firewall application that does not require root. They somehow use the VPN interface for firewalling (without actually connecting you to a VPN server).
We've used technology available to us from within the VPN packaging
module offered by Android to be able to gain visibility to your
applications' network activities
I tried it and ...
I had the same problem with wifi tethering after I installed Droidwall. Though the wifi connection was successful but I got no internet access.
I got it working simply by adding the DNS in my laptop. Hope, it works for you or anyone facing the same problem.
Change/Add DNS 126.96.36.199 and 188.8.131.52 in your PC/Laptop. That's it.
The other answers are correct in that setting firewall rules requires root. And if you have root, you could simply deny internet permissions for a specific app without even needing a firewall (Permissions Denied or built-in with a CyanogenMod rom).
However, there is something you can do to partially circumvent the problem. Using Set DNS, you can change your ...
Might be worth a shot to try this:
$IPTABLES -A "afwall-reject" -m mac --mac-source 00:00:00:00:00:00 -j DROP
the switches in iptables are case-sensitive.
Replace 00:00:00:00:00:00 that with the MAC address of the BSSID that is transmitting wifi beacon packets, and password protect it to prevent mitigation attempts in trying to override it.
You can use adguard for this purpose which has the capability of both a firewall and an adblocker. It sets up a local vpn for non rooted phones. It also has a proxy mode. ( inorder to use with other vpns).
You likely blocked the downloads by not whitelisting com.android.providers.downloads
From Question 58 of app FAQ
What do I need to do to get Google Play Store to work?
You need to whitelist the following: com.google.android.gms (Google Play Services for authorization) + com.android.providers.downloads (For Downloads) + com.android.vending (this is ...
It's possible, but far from easy to achieve. There are multiple approaches we can use to block (or at least try to block) incoming traffic.
But blocking one way traffic doesn't make sense in most cases. An app sending TCP packets but not receiving back responses will consider itself disconnected from internet. However, you may try for your particular case ...
I found this app "Onavo". I did not try it but maybe you want to ;)
I read that you can set the limit in the data usage settings. But i don't find the settings, maybe because I use stock rom.
Hope this answer could help you.
On my stock Android 4.2.1, I don't need to allow (Tethering) - DNS+DHCP service, let alone (root) - Applications running as root for DHCP/DNS over Wifi hostpot in AFwall+. My system can get the IP easily but would not connect to internet unless I change my system's DNS setting to some public DNS like 184.108.40.206. It is a fix that I once saw on a forum.
I don't know how Android Firewall app worked, but it's simple to achieve with iptables; thanks to Linux kernel. Since Android uses default policy ACCEPT, drop any unwanted packets:
~# iptables -I INPUT ! -i lo -m conntrack ! --ctstate ESTABLISHED,RELATED -j DROP
~# iptables -I FORWARD -j DROP
This will also block incoming connections from tethered devices ...
It is normal to disable Droidwall, for the reason that it blocks any incoming packets for port 67, to allow Wifi Tethering to work. Or quite simply, allow a custom script that matches the port number 67 which is dhcp to pass through.
FYI about Droidwall - the functionality and development efforts have been discontinued and the author sold it off to Avast.
With respect to MediaTek's "Common Data Service" I worry about it. Reviewing what rights it has in... [Menu button -> Manage Applications -> Common Data Service] shows that it has all rights, basically.
And I've just setup the ADB (Android Debug Bridge), connected my phone to my computer and ran the following command from a prompt:
adb shell am start -a ...
I had the same problem. To find which app you need to allow you can turn on firewall logs in AFWall+. The log gives a log when traffic is blocked and shows which app was blocked.
Enable AFWall+ (if you had it disabled temporarily)
Menu->Firewall logs->Menu->Clear log
Disable and then enable WiFi to trigger the log
I finally solved this problem in the case of very strange and share my experience here; maybe useful for someone with same or similar problem:
After a few days struggling with this, Using AFWall+ enabled on my restored official stock android, I tried to change Wifi settings (got to wifi->advanced->[disabled most of Samsung/Google features being there] plus ...
I don't think it's possible to change this without recompiling the ROM. You can't change the UID of apps after they're installed because they won't be able to access their files any more, and because it will confuse the app permissions system.
Maybe there's some other way around the problem with Xposed, but I don't know about that. It might be possible for ...
The solution that Dan Hulme has provided is right and I'd like to make it clearer: You have to re-compile the ROM but wait! Open the source for EngineerMode and look for something in AndroidManifest.xml like sharedUserId="android.uid.system" and change it to something else.
That's the fundament of a shared user ID. You must modify the app so that it doesn't ...
Quoting the NetGuard FAQ on that topic:
Can I use another VPN application while using NetGuard?
If the VPN application is using the VPN service, then no, because NetGuard needs to use this service. Android allows only one application at a time to use this service.
NetGuard is a firewall application, so there is no intention to add VPN support. ...
Is the problem caused because GlassWire reports false positives?
You are correct. This question appears to me related to understanding of OSI Model. NetGuard is based on VPN which makes use of TUN interface at OSI layer 3, while GlassWire collects data from NetworkStatsManagr which is something within Android's Java runtime e.g. the creation of sockets ...
Guess you didn't read this explanation by developer regarding system apps. You need to consciously blacklist them if you want, by default they are white listed.
Google Partner Setup
No one seems to know what this does and what data it transmits/receives
Market Feedback agent
If blocked, cannot use Google to submit feedback to app ...
The link you have provided is not setting up SOCKS but a transparent proxy i.e. it takes TCP/UDP traffic and SOCKSify it before sending through shadowsocks tunnel. But you need to make your traffic SOCKS-aware before directing towards SOCKS proxy. Either configure individual apps (which have built-in support for SOCKS) or enforce proxy system-wide ...
I observed that on my device Lenovo A3000 log_other_mode increases proportionally with Switch Off time when charging, about 4 MB/hour. Important to know: I dampened
the two micros with PlayDo..now they creating just continious 'cracks' like a geiger counter.
You can erase log_other_mode to its bone to 4 kB
There is no file size change, when switched on.
You can acces the common data service menu on any MTK device.
You can open MTK engineer mode first by dialing the number *#*#3646633#*#* or by using the app MobileUncle Tools.
In engineer mode, go 1st tab to the right and click CDS information.
I am not an expert, but with CDS and MTK engineer mode you can use all kinds of backdoors.
I discovered it ...
fwmark stands for Firewall Mark, which can be better described as a "netfilter mark", according to a quote in this article (also my reference).
Simplifying stuff a lot:
fwmark is a "stamp" on TCP/IP packets put there by the kernel. mark refers to the command line entity (whatever that is, refer the linked article for details). These are used by Linux ...