Rules not taking effect under ICS

[GoogleCodeExporter]

What steps will reproduce the problem?
1. Set mode to blacklist
2. Select apps to block, enable firewall &apply rules
3. Run blocked apps

What is the expected output? What do you see instead?
Block not taking effect; ads still showing in them

What version of the product are you using? On what operating system?
1.5.7 on Ice Cream Sandwich

Please provide any additional information below.
droidwall chain must be INSERTED to beginning of OUTPUT chain to work, not 
ADDed to the end.

Original issue reported on code.google.com by buu...@gmail.com on 20 Dec 2011 at 12:22

[GoogleCodeExporter]

I can confirm I've issues with ads coming through on new installed (blocked) 
apps.
Also blocking the standard browser does not work, it still reaches the internet 
without issues.

I don't think this was the case on 3.0, now I've 4.0.3 (rooted official image)
I've not investigated on the rules yet but I think there might be an issue.

Original comment by nol...@gmail.com on 21 Dec 2011 at 9:31

[GoogleCodeExporter]

Interesting... I use ICS 4.0.3 on my Nexus S and it works perfectly. I will 
investigate

Original comment by rodrigo...@gmail.com on 21 Dec 2011 at 11:52

[GoogleCodeExporter]

I have also avast mobile beta which has firewall, though this is not related to 
droidwall. Droidwall and avast both dont seem to work after applying rules. Is 
this somehow related?

Original comment by ftpkal...@gmail.com on 21 Dec 2011 at 5:55

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

The problem seem to be related to "Set mobile data limit" setting. Enabling 
this option will allow internet access to all applications regardless of the 
Droid Wall settings. Disabling it will restore Droid Wall functionality. The 
issue is not related to Droid Wall, the same thing happens with Avast.

Original comment by mih...@gmail.com on 24 Dec 2011 at 9:32

[GoogleCodeExporter]

I would like to see Droidwall able to work with ICS mobile data limit. I would 
attempt this myself but I never properly learned Java programming, but I do 
know iptables rules (no pun intended).

attached is a few dumps of iptables on my Galaxy Nexus. I restricted background 
data on two apps, hence contents in penalty box. 

"neat" is with both droidwall and mobile data limit ("limit") disabled. 
"limit" is with only limit on. 
"droidwall" is with only droidwall on.
"droidwalllimit" is with both on.

The problem is with chain "costly_rmnet0" and how ICS handles it. In the main 
OUTPUT chain, rule to go there is second in position; that to droidwall is 
last. the "costly" rule has "goto" set, and with an ACCEPT rule at its end, 
means iptables stops parsing rules before reaching the droidwall chain. The 
simple way around is to insert droidwall's rule in position 1. This makes 
sense, as droidwall users will expect rules there to take precedence, having 
set them up themselves.

Original comment by buu...@gmail.com on 25 Dec 2011 at 5:21

Attachments:

• ipt.neat.txt
• ipt.limit.txt
• ipt.droidwall.txt
• ipt.droidwalllimit.txt

[GoogleCodeExporter]

Another interesting note is that ICS always insert the mobile data limit rules 
into position 2 of INPUT and OUTPUT chains. Usually the first rule is related 
to data usage warning. Looks like Google left a gap for us to put our own rules 
first. 

Original comment by buu...@gmail.com on 25 Dec 2011 at 5:32

[GoogleCodeExporter]

I had the same problem on my Nexus S with ICS but i have fixed it by this way : 
http://blog.skyplabs.net/index.php/2011/12/29/probleme-dutilisation-de-droidwall
-depuis-la-version-4-dandroid/

This article is in french (beaucause it's my native language) but i think it's 
not too hard to understand with the screenshots and the code.

Original comment by skyper...@gmail.com on 29 Dec 2011 at 12:50

[GoogleCodeExporter]

Work for me :) galaxy nexus 4.0.2

add two command to custom script

$IPTABLES -D OUTPUT -j droidwall
$IPTABLES -I OUTPUT 2 -j droidwall

Original comment by datle...@gmail.com on 27 Mar 2012 at 11:44

[GoogleCodeExporter]

thanks guys...

add two command to custom script works on Galaxy S2-ZSLPE

$IPTABLES -D OUTPUT -j droidwall
$IPTABLES -I OUTPUT 2 -j droidwall

Original comment by andrewke...@gmail.com on 28 Mar 2012 at 8:36