[Feature Request] Allow only specific IPs/Ports by App

[TuxFighter]

First of All, thanks for that nice App for Android.

One thing I currently miss at most is the possiblity to allow a specific app only to connect to a specific IP/Port. For example if I got a FTP client, which should only connect to ftp.mydomain.com, but not to a other domains/IPs.

This would also be usefull to get rid of the fact, that much apps talking home. So to stick with the explaination above, we can be somewhat safer, that their isn´t any other connection from the app, which might smuggling any data to any other servers. This could really fight the fact that there are currently to much apps in the android ecosystem which are doing this.

For me it is really one of the most important feature for a firewall.

Thanks forward.

[phragment]

I'd love to see this feature, but I'm not sure how to implement this on Android, typically used on desktop is the owner match extension:
https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#OWNERMATCH

[cernekee]

One thing I currently miss at most is the possiblity to allow a specific app only to connect to a specific IP/Port. For example if I got a FTP client, which should only connect to ftp.mydomain.com, but not to a other domains/IPs.

One challenge is that "ftp.mydomain.com" might not always resolve to the same IP address, so it's hard to write a netfilter rule that works reliably. Also, depending on the Android OS version, allowing DNS resolution could be tricky (or a hole).

Another concern is that many users want their FTP client to be able to connect to arbitrary sites.

Maybe for this case, it would be better to search F-Droid for an open source client instead of using proprietary software that you do not trust? This is what showed up in a quick search (I haven't tried either one):

https://f-droid.org/repository/browse/?fdfilter=ftp&fdid=com.ghostsq.commander
https://f-droid.org/repository/browse/?fdfilter=ftp&fdid=org.brandroid.openmanager

I'd love to see this feature, but I'm not sure how to implement this on Android, typically used on desktop is the owner match extension:

AFWall uses the owner match extension to apply different rules to different apps.

[phragment]

If I get this correctly a AFWall Blacklist for one app is a "owner UID match u0_a??" iptables rule.
Is there an easy way to get the uid for an app? I presume it is static (per installation) and I would be able to write the rule as custom script.
Many thanks in advance!

[cernekee]

Easiest method (through the GUI) is to enable "Show UID for apps" in the AFWall preferences. Or from adb/terminal:

shell@android:/ $ dumpsys package dev.ukanth.ufirewall | grep userId           
    userId=10007 gids=[1015, 3003, 1028]

It is static as long as the package remains installed.

[ukanth]

Duplicate of #15