Afwall: v2.9.1 lan control does not work on Android 7

[Hoiss]

Hi there,

I'm using Afwall+ a long time already and I know this worked before.
Now I switched to Android 7 and use v2.9.1 and the lan control seems to block lan internal packets.
For example two Apps I'd like to give access to internal lan only:

• ES Datei Explorer to access some NAS via samba
• Yatse to access kodi remotely

If I just activate internal lan access for these apps I had access in the past, but now the apps are blocked. I also see in the log that the packets are blocked. My internal IPs are 192.148.158.*.
The log lists for
Yatse: blocked TCP 192.148.158.12:2500(16) (THIS IS MY INTERNAL LAN)
ES Datei Explorer: blocked TCP 112.80.248.60:80 (THIS IS OK)
blocked TCP 192.148.158.16:445 (THIS IS MY INTERNAL LAN)
blocked TCP 192.148.158.16:139 (THIS IS MY INTERNAL LAN)

If I enable the WLAN access both apps work. It really seems to be a problem with the lan access setting :-(

Do others also run into this problem? Is this a bug in the current version or could anyone give me a hint what might be the problem?

Thanks

[rsudev]

I also have issues with LAN-access (Android 7.0 as well), but for me it is not 100%. When I see the local packets blocked and enable WLAN for the app (apply) and disable it again (apply), it works for me.
But some time later (I assume it has to do with either switching WLAN on/off or changing the network), it stops working.
So somehow it seems the rules are not applied correctly when changing the WLAN interface in Android 7.0.
If I can contribute with logs/information/tests to resolve it, I'd be more than happy.

[Hoiss]

I did not see this behaviour but I rarely use the apps with these lan only settings. But this is something I can try at home again.
Let me know if more information is needed to solve this issue.

[Superwallah]

I have the same issue using "davdroid". I have allowed only LAN traffic. Traffic to a server in the same sub net like the default gateway on port 5006 is blocked by AFWall+.
Allowing full WiFi access allows this traffic again.

[Hoiss]

I think all apps with "only LAN traffic allowed" setting are affected.
Unfortunately I suppose the chances that this issue will be fixed soon are not very high - I mean, the latest considerable code checkin was some time ago and there are lots of open issues...
I also don't know a good alternative, therefore we might have to live with the fact that you can't block apps to reach the WWW, as long as you want them to access an internal LAN.

[ukanth]

It can be fixed if you are willing to help reporting. I can't magically fix without proper logs . Please attach iptables rules from (firewall rules-export) and attach ipv4 log here.

I don't consider looking at the bugs which is not reported properly.
https://github.com/ukanth/afwall/wiki/HOWTO-Report-Bug

[sgse]

Do you read, https://github.com/ukanth/afwall/wiki/HOWTO-Report-Bug#sending-bug-report
I will only help. :)

[ukanth]

@Hoiss , Please attach full information and not parts. Not sure why are you splitting it up ?

[Hoiss]

ukanth, I just wanted to help a bit and compress the info to the most relevant for you.
Understood you don't like that, save that work next time.
IPv4rules.zip

Still valid is the log
AppID : 10169
App Name: Yatse
[TCP] 192.148.158.12:2500
AppID : 10173
App Name: ES Datei Explorer
[TCP] 192.148.158.16:445
[TCP] 192.148.158.16:139

[ukanth]

@Hoiss , Can you follow these steps and post the rules ?

• Firewall rules - > flush rules
• Main menu -> Apply

[Hoiss]

Here it is:
IPv4rules.zip

[ukanth]

Thanks, Is it same behavior with above steps ?

[ukanth]

When you flush the rules, you LAN should work as expected

Chain afwall-wifi-fork (2 references)
pkts bytes target prot opt in out source destination
0 0 afwall-wifi-lan all -- * * 0.0.0.0/0 192.148.158.0/24
0 0 afwall-wifi-wan all -- * * 0.0.0.0/0 !192.148.158.0/24

after reboot, it's not setting. Please follow these steps and let me know if this works or not ?

• disable ipv6
• apply the rules
• reboot the phone

and check if LAN works or not, look for above chain.

And at last try this build

https://www.dropbox.com/s/162k55hr6ed1vm9/AFWall%2B%202.9.2-BETA-TEST2.apk?dl=0

and see if it works.

[Hoiss]

To your first comment:
After I reached my home it worked.
To your second comment:
This unfortunately doesn't work...

Your beta-test2 version gave me the rest for today. I just enabled the LAN access for Yatse, but couldn't connect. The log told me there is nothing blocked. But nothing else was activated and everything really is blocked. Additionally I lost all settings now and end up kind of frustrated.

[Hoiss]

ukanth, I still do not get why it worked once. I enabled and disabled the ipv6 support, rebooted, flushed the rules and applied them during flight mode, in wifi mode and mobile data. Tried everything several times these days.
But I always ended with afwall blocking the lan accesses at home.
I know this sounds weird and I agree it is, because it worked the first time I tried your steps, but cant reproduce it any more 😞

I just could imagine that while constructing the IP tables the Lan internal address is somehow not available from nougat?

[ukanth]

Try 2.9.2, it should work fine, Please reopen if it doesn't work