Skip to content

[ISSUE] using "active rules" option breaks applying rules since 4.0.2 #1496

Open
Open
[ISSUE] using "active rules" option breaks applying rules since 4.0.2#1496

Description

@toohazy
toohazy
opened on Aug 6, 2026

Describe the bug
EDIT: this seems to be working fine again with latest 4.1.0 which I just got the update for from Google play after making this post, but the "other issues" I mention at the bottom (changing number of rules, no captiveportallogin still exist)

Using "active rules" to re-apply firewall settings on connection change is broken starting with 4.0.2
In 4.0.1 enabling this setting then enabling hotspot with wifi connection also active works fine, but starting 4.0.2 if this setting is enabled and then hotspot is started with wifi already on and connected, then the the app will attempt to re-apply the rules but will always fail

Firewall Logs
The app log is always empty for me, so I'm including device log filtered for afwall

08-07 01:31:38.204 I/AFWall  (17703): Tether change captured.
08-07 01:31:38.204 D/AFWall  (17703): Network change scheduled with 2000ms delay: TETHER_STATE_CHANGED
08-07 01:31:40.207 I/AFWall  (17703): Applying rules after debounce (2003ms): TETHER_STATE_CHANGED
08-07 01:31:40.212 D/AFWall  (17703): DNS servers IPv4: [192.168.1.1]
08-07 01:31:40.212 D/AFWall  (17703): DNS servers IPv6: []
08-07 01:31:40.212 I/AFWall  (17703): Getting interface details...
08-07 01:31:40.212 I/AFWall  (17703): Now assuming wifi connection (bluetooth-tethered: no, usb-tethered: no)
08-07 01:31:40.212 I/AFWall  (17703): IPv4 LAN netmasks on wlan0: 192.168.91.192/24, 192.168.1.18/24
08-07 01:31:40.212 I/AFWall  (17703): IPv6 LAN netmasks on wlan0: fe80::89e:8ff:fe40:1b54/64, fe80::e448:5fff:fe3b:f34f/64
08-07 01:31:40.212 D/AFWall  (17703): TETHER_STATE_CHANGED applying rules
08-07 01:31:40.212 I/AFWall  (17703): Selected Profile: AFWallPrefs
08-07 01:31:40.212 I/AFWall  (17703): Applying regular rules for reason: TETHER_STATE_CHANGED
08-07 01:31:40.212 I/AFWall  (17703): Using fastApply
08-07 01:31:40.212 I/AFWall  (17703): Setting OUTPUT chain to DROP
08-07 01:31:40.212 I/AFWall  (17703): Applying custom rules
08-07 01:31:40.212 I/AFWall  (17703): Forcing configuration: true
08-07 01:31:40.214 D/AFWall  (17703): DNS servers IPv4: [192.168.1.1]
08-07 01:31:40.214 D/AFWall  (17703): DNS servers IPv6: []
08-07 01:31:40.214 I/AFWall  (17703): Setting OUTPUT chain to ACCEPT
08-07 01:31:40.215 I/AFWall  (17703): Found system binary: /system/bin/iptables
08-07 01:31:40.215 I/AFWall  (17703): Setting OUTPUT chain to DROP
08-07 01:31:40.215 I/AFWall  (17703): Applying custom rules
08-07 01:31:40.215 I/AFWall  (17703): Forcing configuration: false
08-07 01:31:40.215 I/AFWall  (17703): Setting OUTPUT chain to ACCEPT
08-07 01:31:40.215 I/AFWall  (17703): Found system binary: /system/bin/ip6tables
08-07 01:31:40.291 I/AFWall  (17703): Using full Apply
08-07 01:31:40.291 I/AFWall  (17703): Applying IPv4 rules
08-07 01:31:40.291 D/AFWall  (17703): assertBinaries() called - Entry point
08-07 01:31:40.291 D/AFWall  (17703): assertBinaries() - currentVer=20260130, storedVer=20260130, wasAlreadyInstalled=true
08-07 01:31:40.291 D/AFWall  (17703): assertBinaries() - Verifying existing binaries...
08-07 01:31:40.291 D/AFWall  (17703): verifyBinaries() called - Starting verification
08-07 01:31:40.292 D/AFWall  (17703): verifyBinaries() - Binary directory: /data/user/0/dev.ukanth.ufirewall/app_bin
08-07 01:31:40.292 D/AFWall  (17703): verifyBinaries() - Checking busybox: exists=true, canExecute=true, canRead=true, size=2295680 bytes
08-07 01:31:40.292 D/AFWall  (17703): verifyBinaries() - Testing busybox functionality with 'echo test'
08-07 01:31:40.293 W/AFWall  (17703): Busybox execution test failed due to Android security restrictions (expected behavior)
08-07 01:31:40.293 W/AFWall  (17703): Binary will be available for root execution. Skipping direct execution test.
08-07 01:31:40.293 D/AFWall  (17703): verifyBinaries() - Checking other required binaries
08-07 01:31:40.293 D/AFWall  (17703): verifyBinaries() - Checking iptables: exists=true, canExecute=true
08-07 01:31:40.293 D/AFWall  (17703): verifyBinaries() - Checking ip6tables: exists=true, canExecute=true
08-07 01:31:40.293 D/AFWall  (17703): Binary verification successful - All checks passed
08-07 01:31:40.293 D/AFWall  (17703): assertBinaries() - Verification passed, returning true (no reinstall needed)
08-07 01:31:40.293 I/AFWall  (17703): Forcing configuration: true
08-07 01:31:40.295 D/AFWall  (17703): DNS servers IPv4: [192.168.1.1]
08-07 01:31:40.295 D/AFWall  (17703): DNS servers IPv6: []
08-07 01:31:40.295 I/AFWall  (17703): Constructing rules for v4
08-07 01:31:40.295 D/AFWall  (17703): Adding NFLOG rule to reject chain: -A afwall-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.295 D/AFWall  (17703): Adding final REJECT rule: -A afwall-reject -j REJECT
08-07 01:31:40.295 D/AFWall  (17703): Populating individual reject chain: afwall-3g-home-reject
08-07 01:31:40.295 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-3g-home-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.295 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-3g-home-reject -j REJECT
08-07 01:31:40.295 D/AFWall  (17703): Populating individual reject chain: afwall-3g-roam-reject
08-07 01:31:40.295 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-3g-roam-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.295 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-3g-roam-reject -j REJECT
08-07 01:31:40.295 D/AFWall  (17703): Populating individual reject chain: afwall-wifi-wan-reject
08-07 01:31:40.295 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-wifi-wan-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.295 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-wifi-wan-reject -j REJECT
08-07 01:31:40.295 D/AFWall  (17703): Populating individual reject chain: afwall-wifi-lan-reject
08-07 01:31:40.295 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-wifi-lan-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.295 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-wifi-lan-reject -j REJECT
08-07 01:31:40.295 D/AFWall  (17703): Populating individual reject chain: afwall-vpn-reject
08-07 01:31:40.295 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-vpn-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.295 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-vpn-reject -j REJECT
08-07 01:31:40.295 D/AFWall  (17703): Populating individual reject chain: afwall-tether-reject
08-07 01:31:40.295 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-tether-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.295 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-tether-reject -j REJECT
08-07 01:31:40.295 I/AFWall  (17703): Forcing configuration: true
08-07 01:31:40.298 D/AFWall  (17703): DNS servers IPv4: [192.168.1.1]
08-07 01:31:40.298 D/AFWall  (17703): DNS servers IPv6: []
08-07 01:31:40.298 I/AFWall  (17703): Found system binary: /system/bin/iptables
08-07 01:31:40.311 I/AFWall  (17703): Successfully applied IPv4 rules
08-07 01:31:40.311 I/AFWall  (17703): Applying IPv6 rules
08-07 01:31:40.311 D/AFWall  (17703): assertBinaries() called - Entry point
08-07 01:31:40.311 D/AFWall  (17703): assertBinaries() - currentVer=20260130, storedVer=20260130, wasAlreadyInstalled=true
08-07 01:31:40.311 D/AFWall  (17703): assertBinaries() - Verifying existing binaries...
08-07 01:31:40.311 D/AFWall  (17703): verifyBinaries() called - Starting verification
08-07 01:31:40.311 D/AFWall  (17703): verifyBinaries() - Binary directory: /data/user/0/dev.ukanth.ufirewall/app_bin
08-07 01:31:40.311 D/AFWall  (17703): verifyBinaries() - Checking busybox: exists=true, canExecute=true, canRead=true, size=2295680 bytes
08-07 01:31:40.311 D/AFWall  (17703): verifyBinaries() - Testing busybox functionality with 'echo test'
08-07 01:31:40.312 W/AFWall  (17703): Busybox execution test failed due to Android security restrictions (expected behavior)
08-07 01:31:40.312 W/AFWall  (17703): Binary will be available for root execution. Skipping direct execution test.
08-07 01:31:40.312 D/AFWall  (17703): verifyBinaries() - Checking other required binaries
08-07 01:31:40.312 D/AFWall  (17703): verifyBinaries() - Checking iptables: exists=true, canExecute=true
08-07 01:31:40.313 D/AFWall  (17703): verifyBinaries() - Checking ip6tables: exists=true, canExecute=true
08-07 01:31:40.313 D/AFWall  (17703): Binary verification successful - All checks passed
08-07 01:31:40.313 D/AFWall  (17703): assertBinaries() - Verification passed, returning true (no reinstall needed)
08-07 01:31:40.313 I/AFWall  (17703): Forcing configuration: false
08-07 01:31:40.313 I/AFWall  (17703): Constructing rules for v6
08-07 01:31:40.313 D/AFWall  (17703): Adding NFLOG rule to reject chain: -A afwall-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.313 D/AFWall  (17703): Adding final REJECT rule: -A afwall-reject -j REJECT
08-07 01:31:40.313 D/AFWall  (17703): Populating individual reject chain: afwall-3g-home-reject
08-07 01:31:40.313 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-3g-home-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.313 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-3g-home-reject -j REJECT
08-07 01:31:40.313 D/AFWall  (17703): Populating individual reject chain: afwall-3g-roam-reject
08-07 01:31:40.313 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-3g-roam-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.313 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-3g-roam-reject -j REJECT
08-07 01:31:40.313 D/AFWall  (17703): Populating individual reject chain: afwall-wifi-wan-reject
08-07 01:31:40.313 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-wifi-wan-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.313 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-wifi-wan-reject -j REJECT
08-07 01:31:40.313 D/AFWall  (17703): Populating individual reject chain: afwall-wifi-lan-reject
08-07 01:31:40.313 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-wifi-lan-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.313 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-wifi-lan-reject -j REJECT
08-07 01:31:40.313 D/AFWall  (17703): Populating individual reject chain: afwall-vpn-reject
08-07 01:31:40.313 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-vpn-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.313 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-vpn-reject -j REJECT
08-07 01:31:40.313 D/AFWall  (17703): Populating individual reject chain: afwall-tether-reject
08-07 01:31:40.313 D/AFWall  (17703): Adding NFLOG to individual reject chain: -A afwall-tether-reject -j NFLOG --nflog-prefix "{AFL}" --nflog-group 40
08-07 01:31:40.313 D/AFWall  (17703): Adding REJECT to individual reject chain: -A afwall-tether-reject -j REJECT
08-07 01:31:40.313 I/AFWall  (17703): Forcing configuration: false
08-07 01:31:40.314 I/AFWall  (17703): Found system binary: /system/bin/ip6tables
08-07 01:31:40.325 I/AFWall  (17703): Successfully applied IPv6 rules
08-07 01:31:40.325 I/AFWall  (17703): Successfully applied all firewall rules
08-07 01:31:40.326 D/AFWall  (17703): Rules completed, refreshing FirewallService notification
08-07 01:31:40.326 D/AFWall  (17703): Refreshing FirewallService notification
08-07 01:31:40.326 I/AFWall  (17703): command '/system/bin/iptables -A afwall-wifi-fork '!' -d 192.168.91.192/24 '!' -d 192.168.1.18/24 -j afwall-wifi-wan -w 5' exited with status 2
08-07 01:31:40.326 I/AFWall  (17703): Output:
08-07 01:31:40.326 D/AFWall  (17703): Firewall ENABLED - notification text: Firewall enabled • Log monitoring
08-07 01:31:40.327 D/AFWall  (17703): Updated notification via startForeground (Android 8+): Firewall enabled • Log monitoring
08-07 01:31:40.327 D/AFWall  (17703): FirewallService notification refreshed
08-07 01:31:40.988 D/AFWall6 (17703): Rules completed, refreshing FirewallService notification
08-07 01:31:40.988 D/AFWall  (17703): Refreshing FirewallService notification
08-07 01:31:40.988 I/AFWall6 (17703): command '/system/bin/ip6tables -A afwall-wifi-fork '!' -d fe80::89e:8ff:fe40:1b54/64 '!' -d fe80::e448:5fff:fe3b:f34f/64 -j afwall-wifi-wan -w 5' exited with status 2
08-07 01:31:40.988 I/AFWall6 (17703): Output:
08-07 01:31:40.989 D/AFWall  (17703): Firewall ENABLED - notification text: Firewall enabled • Log monitoring
08-07 01:31:40.990 D/AFWall  (17703): Updated notification via startForeground (Android 8+): Firewall enabled • Log monitoring
08-07 01:31:40.990 D/AFWall  (17703): FirewallService notification refreshed
08-07 01:31:45.311 I/AFWall  (17703): State of rootShell(4): READY
08-07 01:31:46.100 E/AFWall  (17703): TETHER_STATE_CHANGED: applySavedIptablesRules() returned an error
08-07 01:31:46.102 I/AFWall  (17703): Found system binary: /system/bin/iptables
08-07 01:31:46.102 I/AFWall  (17703): Found system binary: /system/bin/ip6tables
08-07 01:31:46.103 D/AFWall  (17703): Rules completed, refreshing FirewallService notification
08-07 01:31:46.103 D/AFWall  (17703): Refreshing FirewallService notification
08-07 01:31:46.103 I/AFWall  (17703): command '/system/bin/iptables -A afwall-wifi-fork '!' -d 192.168.91.192/24 '!' -d 192.168.1.18/24 -j afwall-wifi-wan -w 5' exited with status 2
08-07 01:31:46.103 I/AFWall  (17703): Output:
08-07 01:31:46.103 D/AFWall  (17703): Firewall ENABLED - notification text: Firewall enabled • Log monitoring
08-07 01:31:46.104 D/AFWall  (17703): Updated notification via startForeground (Android 8+): Firewall enabled • Log monitoring
08-07 01:31:46.104 D/AFWall  (17703): FirewallService notification refreshed
08-07 01:31:51.104 I/AFWall  (17703): State of rootShell(4): READY
08-07 01:31:51.201 D/AFWall  (17703): Rules completed, refreshing FirewallService notification
08-07 01:31:51.201 D/AFWall  (17703): Refreshing FirewallService notification
08-07 01:31:51.204 D/AFWall  (17703): Firewall ENABLED - notification text: Firewall enabled • Log monitoring
08-07 01:31:51.206 D/AFWall  (17703): Updated notification via startForeground (Android 8+): Firewall enabled • Log monitoring
08-07 01:31:51.206 D/AFWall  (17703): FirewallService notification refreshed

Smartphone (please complete the following information):

  • Device: poco f3
  • Android OS: android 13, crdroid
  • root: magisk 29

Additional context
The total number of "rules" applied also varies greatly for, on 4.0.1 ipv4/ipv6 each has 448 rules, but if I upgrade to 4.0.2 the number will go to 482, and the latest 4.1.0 shows 465 rules, plus the fact that CaptivePortalLogin disappears and can't be found starting 4.0.2

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions