Afwall: WIFI tethering doesn't work

[takiainen]

Phone: Oneplus One
ROM: Android Oreo, microg lineage (clean flashed, no GAPPS, no mods).

Afwall doesn't let through WIFI tethering traffic despite whitelisting "-11 tethering". Tried also with "-12 Linux kernel" since it was mentioned in other similar issues, but it does not work.

If I disable Afwall, tethering works fine.

I have latest F-Droid Afwall version 3.0.3. My friend has version number 2.9.9, and his WIFI tethering works fine (also Lineage rom 8, also OneplusOne).

[tlpbu]

Identical situation for me - always have to disable Afwall+ for tethering period.

[yoshi7]

I had to activate "Enable inbound connections" under Preferences -> Experimental.

[takiainen]

I cannot get it work with "inbound connections" either.

[tlpbu]

I can confirm that wifi tethering does not work even with "Enable inbound connections" under Preferences -> Experimental activated and phone restart afterwards.

I have Oneplus One with LineageOS but this is probably not important because I have had this issue for years one multiple devices and Android OS variations.
Would be great to finally solve this problem of having to manually disable firewall during wifi tethering.

Do not have opportunity to verify now but AFAIR USB tethering works with Afwall+ enabled - problem lies only with wifi tethering.

[ukanth]

I never had issues with Wifi Tether/Bluetooth hotspot. It will work if you don't route the traffic from the source( means VPN or TOR). If it still doesn't, attach the rules when the tether doesn't work along with logs (firewall logs)

Thanks.

[9662]

What is it that doesn't work? Does the wifi connection authenticate? Does the DHCP negotiation succeed? Does DNS resolving work?

What does the log say?

In my case, I was unable to get the DHCP negotiation working. It turns out I need to give "Applications running as root" wifi access, else DHCP gets blocked. Afterwards, I can remove the access and things keep working (presumably until the next DHCP refresh, I haven't checked).

[takiainen]

The iptables rule given here solves this issue for me: https://github.com/ukanth/afwall/issues/965

It seems that afwall's UID was incorrect. Here are the iptables rules copied from above:

!/system/bin/sh

IPTABLES=/system/bin/iptables
IP6TABLES=/system/bin/ip6tables

$IPTABLES -I afwall-wifi-tether -p udp -m owner --uid-owner 1052 -m udp --sport 67 --dport 68 -j RETURN
$IPTABLES -I afwall-wifi-tether -p udp -m owner --uid-owner 1052 -m udp --sport 53 -j RETURN
$IPTABLES -I afwall-wifi-tether -p tcp -m owner --uid-owner 1052 -m tcp --sport 53 -j RETURN

$IP6TABLES -I afwall-wifi-tether -p udp -m owner --uid-owner 1052 -m udp --sport 67 --dport 68 -j RETURN
$IP6TABLES -I afwall-wifi-tether -p udp -m owner --uid-owner 1052 -m udp --sport 53 -j RETURN
$IP6TABLES -I afwall-wifi-tether -p tcp -m owner --uid-owner 1052 -m tcp --sport 53 -j RETURN

[9662]

What application runs as UID 1052?

[JasMan78]

Same issue here with Google Pixel 3 with security patches from 07/2019.

When wifi tethering is enabled the client becomes an IP address, but is not able to resolve any DNS names.
The firewall log shows that process "Unknown(1052)" was blocked. When I open the details of this entry I can see that not the DNS request from the client is blocked, but the response from Android.
Here's an example:

29-07-2019 08;42:27(wlan1) Destination:192.168.43.168:57871 Host: Source:192.168.43.250:53 Protocol:UDP

Not sure how to export the whole firewall log.
Find attached the export of my AFwall rules.

AFwall_Rules.txt