关于广告屏蔽，阿虚已经写过不少教程了：

你可以通过装Google Play版程序、装广告屏蔽插件、可以通过安装旧版APP…等等方法来屏蔽广告

但今天我想再说一个可能被很多人忽视的屏蔽广告的办法

▍1 提一下思路

针对某些软件，比如词典、课程表、清单类软件、计算器…

其实我们还有另外一种办法屏蔽广告

阿虚说一提你可能就明白了

其实很简单，方法就六个字：禁止软件联网

毕竟广告都是联网时，才会弹出

● 1.1 举个栗子：超级课程表

最起初的超级课程表其实挺好：功能简单，实在，单纯的课程表，因为是最早一批做课程表的APP，对于高校教务系统的导入也支持的最全

可是后来，多出很多杂七杂八的功能：比如「下课聊」、「小纸条」？？

我只是很简单的想用一用最中间的那个「课程表」功能啊！！！

由于下课聊、小纸条…这种社交功能的存在，里面自然少不了打广告的

我便不敢开启通知栏提醒功能（课程提醒），否则就会收到的杂七杂八的广告弹窗了！

● 1.2 iOS

由于阿虚用的 iPhone，这里简单说一下 iOS上怎么禁止软件联网

先打开超级课程表APP » 登录APP » 导入教务系统课表

然后你就可以把这个APP禁止联网了：打开 iOS 设置 » 找到超级课程表

在超级课程表的软件设置里面，把无线数据「关闭」

这样操作之后

我依然能收到超级课程表的通知栏通知

但是收不到它APP内每天更新的杂七杂八的广告

因为打开APP不加载联网显示的内容，APP打开也不卡了

▍2 思路延伸

禁止软件联网这个思路，适合于许多本地软件（无需联网就能使用）

1. 不仅可以屏蔽广告，也能屏蔽升级。

2. 不止在手机上，电脑上一样可以。

除了手机上的：词典、计算器、清单类软件…

某些电脑上的软件也可以用这个办法来屏蔽广告：压缩软件、截图软件、本地视频播放器、CDR（不禁止联网的话，会被在线防盗版检测）

● 2.1 安卓端禁止软件联网

虽然安卓其实没必要用这个办法，毕竟安卓找安卓找去广告版APP其实很容易

但大家还是可以学一学

以小米手机演示说明一下，打开系统设置 » 更多应用 » 找到你想禁止联网的APP » 联网控制 » 关闭WLAN和数据

● 2.2 Windows端禁止软件联网

方法1

简单点的办法是用电脑管家一类的软件禁止软件联网

这类软件很多，比如：腾讯电脑管家、360电脑管家、火绒等

方法2

办法2优于上面的方法1：通过系统自带的防火墙控制程序的联网功能。

先再电脑左下角，打开控制面板

再找到防火墙设置

打开高级设置

找到软件主程序

比如：我要禁止按键精灵这款软件联网

我们先来到它F盘下的安装目录，找到它的主程序：按键精灵2014.exe

添加入站规则

跟着下面的图一步一步操作就行了。

选择程序

添加程序exe的路径

改为阻止连接

何时运用这里全部勾选上

名称什么的随便写就行

最好的话，可以把出站规则也一并添加了

而添加出站规则和添加入站规格是同样的步骤，阿虚就不重复演示了

你会发现某些软件，联网对于它们来说根本就略显多余

Merriam-Webster禁止联网后就是十分好用的词典

nPlayer禁止联网后也成了极好用的本地播放器

知道思路后，具体还是需要自己灵活使用

//作者: 家  QQ203118908


//本来打算用iptables-restore用文件形式更新防火墙规则,
//可是iptables-restore出现了bug,2013年就有人提过这个bug
//https://linux.debian.bugs.dist.narkive.com/J0hbJiR6/bug-710379-xtables-addons-common-quota2-module-iptables-save-creates-invalid-record
//又得改,坑爹

//马丹,iptables -D INPUT -lineNumber也有BUG,
//提示 index of deletion too big
//日了够了
//又得改,坑爹
// sudo iptables -D OUTPUT 1 -t nat
//
// uid=`cat /data/system/packages.list | grep com.sohu.inputmethod.sogou | busybox awk '{print $2}'`
// iptables -t filter -A OUTPUT -m owner --uid-owner=$uid -j DROP

// 以上是android iptables 屏蔽某个app网络访问的内容，

function 联网控制(appName) {
  // -A OUTPUT -m owner --uid-owner 10105 -j ACCEPT
  // -A OUTPUT -m owner --uid-owner 10105 -j DROP
  this.等待shell执行完毕的时间 = 0
  this.防火墙规则路径 = '/sdcard/iptables.txt'
  this.uid路径 = '/sdcard/' + appName + 'uidOwner.txt'
  this.appName = appName
  this.packageName = getPackageName(this.appName)
  this.执行shell = (cmd) => {
    var result = shell(cmd, true);
    console.show();
    log(result);
    if (result.code == 0) {
      toastLog("执行成功");
    } else {
      toastLog("执行失败！请到控制台查看错误信息");
    }
    sleep(this.等待shell执行完毕的时间)
  }
  this.uid = () => {
    var cmd = 'cat /data/system/packages.list | grep ' + this.packageName + ' > ' + this.uid路径
    log('cmd=', cmd)
    this.执行shell(cmd)
    // cat /data/system/packages.list | grep com.tencent.mobileqq > /sdcard/QQuidOwner.txt
    var 包含uid的文本 = files.read('/sdcard/' + appName + 'uidOwner.txt')
    log('包含uid的文本=', 包含uid的文本)
    var uidReg = new RegExp(this.packageName + '\\s*(\\d+)')
    log('uidReg=', uidReg)
    var uid = 包含uid的文本.match(uidReg)[1]
    log(uid)
    return uid
  }
  this.允许联网规则 = 'iptables -t filter -A OUTPUT -m owner --uid-owner ' + this.uid() + ' -j ACCEPT'
  this.禁止联网规则 = 'iptables -t filter -A OUTPUT -m owner --uid-owner ' + this.uid() + ' -j DROP'
  this.允许 = () => {
    this.清空该app的防火墙规则()
    this.将防火墙规则写入系统(this.允许联网规则)
  }
  this.禁止 = () => {
    this.清空该app的防火墙规则()
    this.将防火墙规则写入系统(this.禁止联网规则)
  }

  this.将防火墙规则写入系统 = (防火墙规则) => {
    var cmd = 防火墙规则
    this.执行shell(cmd)
  }
  this.导出防火墙规则 = () => {
    var cmd = 'iptables-save > ' + this.防火墙规则路径
    this.执行shell(cmd)
  }
  this.防火墙规则 = () => {
    this.导出防火墙规则()
    var 防火墙规则 = files.read(this.防火墙规则路径)
    log('防火墙规则=', 防火墙规则)
    return 防火墙规则
  }
  this.清空该app的防火墙规则 = () => {
    var 防火墙规则 = this.防火墙规则()
    // stringObject.replace(regexp/substr,replacement)
    // -A OUTPUT -m owner --uid-owner 10105 -j ACCEPT
    // -A OUTPUT -m owner --uid-owner 10105 -j ACCEPT
    // -A OUTPUT -m owner --uid-owner 10105 -j DROP
    // -A OUTPUT -m owner --uid-owner 10105 -j ACCEPT
    // -A OUTPUT -m owner --uid-owner 10105 -j ACCEPT
    // 删除之前添加的规则（iptables -A INPUT -s 192.168.1.5 -j DROP）：
    // [root@test ~]# iptables -D INPUT -s 192.168.1.5 -j DROP
    // iptables -t filter -A OUTPUT -m owner --uid-owner=$uid -j DROP
    var 要删除的规则reg = new RegExp('-A (OUT|IN)PUT -m owner --uid-owner ' + this.uid() + ' -j (ACCEPT|DROP)', 'g')
    // 要删除的规则reg= /-A OUTPUT -m owner --uid-owner 10105 -j (ACCEPT|DROP)/
    // -A OUTPUT -m owner --uid-owner 10105 -j (ACCEPT|DROP)
    // iptables -D OUTPUT -m owner --uid-owner 10105 -j ACCEPT
    log('要删除的规则reg=', 要删除的规则reg)
    var new防火墙规则 = 防火墙规则.match(要删除的规则reg, '')
    log('new防火墙规则=', new防火墙规则)
    // new防火墙规则= [
    //   '-A OUTPUT -m owner --uid-owner 10105 -j ACCEPT',
    //   '-A OUTPUT -m owner --uid-owner 10105 -j DROP'
    //               ]
    if(new防火墙规则){
      for (let i = 0; i < new防火墙规则.length; i++) {
        var 规则 = new防火墙规则[i]
        规则 = 规则.replace('-A', '-D')
        var cmd = 'iptables ' + 规则
        this.执行shell(cmd)
      }
    }
    log('清空了指定app的防火墙规则')
  }
}

// var appName = 'QQ'
// var appName = '哔哩哔哩'
var appName = '微信'
var app联网控制 = new 联网控制(appName)
// app联网控制.禁止()
app联网控制.允许()

声明

部分内容来自网络

bilibili

牙叔教程

微信公众号 牙叔教程

QQ群

747748653

#通过包名查找应用的uid
➜  apk adb shell cat /data/system/packages.xml | grep com.xzh.hbls
    <package name="com.xzh.hbls" codePath="/data/app/com.xzh.hbls-htP4fJSjJ2QQGmIifZ6xpA==" nativeLibraryPath="/data/app/com.xzh.hbls-htP4fJSjJ2QQGmIifZ6xpA==/lib" publicFlags="940064324" privateFlags="0" ft="177e2c42790" it="177e2c434ca" ut="177e2c434ca" version="80" userId="10106">
#关闭某个uid的上网权限
➜  apk adb shell iptables -I fw_OUTPUT -m owner --uid-owner 10106 -j DROP
➜  apk adb shell iptables -I fw_INPUT -m owner --uid-owner 10106 -j DROP

注意命令行中的uid需要替换，uid如下图所示

详细信息请参考： https://blog.csdn.net/cyj88jyc/article/details/87985219

为防止作者后期删除，copy一份：
iptables是Linux的一个命令行工具,通过设置一些规则可以直接把指定uid或网址的数据包从ip层过滤掉，从而实现网络防火墙的功能，这部分已经比较成熟,android或厂商只是对iptables命令进行了封装,让android app可以通过iptables命令进行防火墙设置，iptables有很多复杂的功能,我们主要看看怎么设置白名单只让指定的uid app可以联网和设置黑名单让指定的uid app不能联网,我们通过代码流程来分析,代码是mtk android8.1。

root后通过adb shell iptables -L可以查看当前的规则列表，Chain INPUT，OUTPUT就是控制数据包的输入输出，没做任何设置前应该张下面这个样子，Chain OUTPUT的数据包通过Chain fw_OUTPUT控制, Chain fw_OUTPUT的规则是空的，所以当前对网络不做限制。

$ adb shell iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
bw_INPUT all – anywhere anywhere
fw_INPUT all – anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
oem_fwd all – anywhere anywhere
fw_FORWARD all – anywhere anywhere
bw_FORWARD all – anywhere anywhere
natctrl_FORWARD all – anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
oem_out all – anywhere anywhere
firewall all – anywhere anywhere
fw_OUTPUT all – anywhere anywhere
st_OUTPUT all – anywhere anywhere
bw_OUTPUT all – anywhere anywhere

Chain fw_FORWARD (1 references)
target prot opt source destination

Chain fw_INPUT (1 references)
target prot opt source destination

Chain fw_OUTPUT (1 references)
target prot opt source destination

//android app层

INetworkManagementService networkService = INetworkManagementService.Stub.asInterface(ServiceManager.getService(Context.NETWORKMANAGEMENT_SERVICE));

public void WhiteListMode(INetworkManagementService networkService) {
    FireWallUtils.setFirewallEnabled(networkService, true);//白名单模式
    FireWallUtils.setFirewallUidRule(networkService, 0, 1016, 0); //重置vpn uid rule
    FireWallUtils.setFirewallUidRule(networkService, 0, 1016, 1); //设置vpn uid为白名单
    FireWallUtils.setFirewallUidRule(networkService, 0, 0, 0); //重置root uid rule
    FireWallUtils.setFirewallUidRule(networkService, 0, 0, 1); //设置root uid为白名单

// List whitelistApp = new ArrayList<>();
// whitelistApp.add(“com.nuts.extremspeedup”);
// PackageManager pm = mContext.getPackageManager();
// for (String pkgName : whitelistApp) {
// int uid = FireWallUtils.getUidFromPackageName(pm, pkgName);
// if (uid > 0) {
// FireWallUtils.setFirewallUidRule(networkService, 0, uid, 0); //重置 uid rule
// FireWallUtils.setFirewallUidRule(networkService, 0, uid, 1); //设置白名单
// }
// }
}

public void BlackListMode(INetworkManagementService networkService) {
    FireWallUtils.setFirewallEnabled(networkService, false); //黑名单模式
    
      List<String> whitelistApp = new ArrayList<>();
      whitelistApp.add("com.iflytek.inputmethod");//com.iflytek.inputmethod
      PackageManager pm = getPackageManager();
        for (String pkgName : whitelistApp) {
            int uid = FireWallUtils.getUidFromPackageName(pm, pkgName); //获取app的uid
            if (uid > 0) {
                FireWallUtils.setFirewallUidRule(networkService, 0, uid, 0); //重置 uid rule
                FireWallUtils.setFirewallUidRule(networkService, 0, uid, 2); //设置uid为黑名单
            }
        }
}

public void DisableMobileMode(INetworkManagementService networkService) {
    FireWallUtils.setFirewallEnabled(networkService, false); //黑名单模式
    
      List<String> whitelistApp = new ArrayList<>();
      whitelistApp.add("com.iflytek.inputmethod");//com.iflytek.inputmethod
      PackageManager pm = getPackageManager();
        for (String pkgName : whitelistApp) {
            int uid = FireWallUtils.getUidFromPackageName(pm, pkgName);
            if (uid > 0) {
                FireWallUtils.setFirewallUidChainRule(networkService, uid, 0, false); //(networkType == 1) ? WIFI : MOBILE; , 禁止此uid连mobile
            }
        }
}

import android.content.BroadcastReceiver;
import android.content.ContentResolver;
import android.content.Context;
import android.content.Intent;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageManager;
import android.os.INetworkManagementService;
import android.os.Process;
import android.os.RemoteException;
import android.os.ServiceManager;
import android.os.SystemProperties;
import android.provider.Settings;
import android.util.Log;

import java.util.ArrayList;
import java.util.List;

public class FireWallUtils {
private static final String TAG = “FireWallUtils”;

public static void setFirewallEnabled(INetworkManagementService networkService, boolean enable) {
    try {
        networkService.setFirewallEnabled(enable);
    } catch (RemoteException e) {
        Log.e(TAG, "setFirewallEnabled RemoteException e:" + Log.getStackTraceString(e));
    } catch (Exception e) {
        Log.e(TAG, "setFirewallEnabled Exception e:" + Log.getStackTraceString(e));
    }
}

public static void setFirewallUidRule(INetworkManagementService networkService, int chain, int uid, int rule) {
    try {
        networkService.setFirewallUidRule(chain, uid, rule);
    } catch (RemoteException e) {
        Log.e(TAG, "setFirewallUidRule RemoteException e:" + Log.getStackTraceString(e));
    } catch (Exception e) {
        Log.e(TAG, "setFirewallUidRule Exception e:" + Log.getStackTraceString(e));
    }
}

public static int getUidFromPackageName(PackageManager pm, String pkgName) {
    try {
        ApplicationInfo appInfo = pm.getApplicationInfo(pkgName, PackageManager.MATCH_ALL);
        if (appInfo != null) {
            return appInfo.uid;
        }
    } catch (PackageManager.NameNotFoundException e) {
        //e.printStackTrace();
    }
    return -1;
}

}

public static void setFirewallUidChainRule(INetworkManagementService networkService, int uid, int networkType, boolean allow) {
    try {
        networkService.setFirewallUidChainRule(uid, networkType, allow);
    } catch (RemoteException e) {
        Log.d(TAG, "setFirewallEnabled RemoteException e:" + Log.getStackTraceString(e));
    } catch (Exception e) {
        Log.d(TAG, "setFirewallEnabled Exception e:" + Log.getStackTraceString(e));
    }
}
public static void clearFirewallChain(INetworkManagementService networkService, String chain) {
    try {
        networkService.clearFirewallChain(chain);
    } catch (RemoteException e) {
        Log.d(TAG, "setFirewallEnabled RemoteException e:" + Log.getStackTraceString(e));
    } catch (Exception e) {
        Log.d(TAG, "setFirewallEnabled Exception e:" + Log.getStackTraceString(e));
    }
}

frameworks/base/core/java/android/os/INetworkManagementService.aidl

void setFirewallEnabled(boolean enabled);
boolean isFirewallEnabled();
void setFirewallInterfaceRule(String iface, boolean allow);
void setFirewallUidRule(int chain, int uid, int rule);
void setFirewallUidRules(int chain, in int[] uids, in int[] rules);
void setFirewallChainEnabled(int chain, boolean enable);

/**
 * agold
 * Cnfigure firewall rule by uid and chain
 * @hide
 */
void setFirewallUidChainRule(int uid, int networkType, boolean allow);

/** @} */

/**
 * agold
 * Delete all rules in  chain or all chains
 * @hide
 */
void clearFirewallChain(String chain);

frameworks/base/services/core/java/com/android/server/NetworkManagementService.java

@Override
public void setFirewallEnabled(boolean enabled) {
    enforceSystemUid();
    try {
        mConnector.execute("firewall", "enable", enabled ? "whitelist" : "blacklist");
        mFirewallEnabled = enabled;
    } catch (NativeDaemonConnectorException e) {
        throw e.rethrowAsParcelableException();
    }
}

@Override
public void setFirewallUidRule(int chain, int uid, int rule) {
    enforceSystemUid();
    synchronized (mQuotaLock) {
        setFirewallUidRuleLocked(chain, uid, rule);
    }
}

private void setFirewallUidRuleLocked(int chain, int uid, int rule) {
    if (updateFirewallUidRuleLocked(chain, uid, rule)) {
        try {
            mConnector.execute("firewall", "set_uid_rule", getFirewallChainName(chain), uid,
                    getFirewallRuleName(chain, rule));
        } catch (NativeDaemonConnectorException e) {
            throw e.rethrowAsParcelableException();
        }
    }
}

/**
 * agold
 * @Configure firewall rule by uid and chain
 * @hide
 */
public void setFirewallUidChainRule(int uid, int networkType, boolean allow) {
    android.util.Log.i("linyuan_NMS", "setFirewallUidChainRule uid = " + uid + ", networkType = " + networkType + ", allow = " + allow);
    //enforceSystemUid();
    final String MOBILE = "mobile";
    final String WIFI = "wifi";

    final String rule = allow ? "allow" : "deny";
    final String chain = (networkType == 1) ? WIFI : MOBILE;

    try {
        mConnector.execute("firewall", "set_uid_fw_rule", uid, chain, rule);
    } catch (NativeDaemonConnectorException e) {
        throw e.rethrowAsParcelableException();
    }
}

/**
 * agold
 * @Configure firewall rule by uid and chain
 * @hide
 */
public void clearFirewallChain(String chain) {
    //enforceSystemUid();
    try {
        mConnector.execute("firewall", "clear_fw_chain", chain);
    } catch (NativeDaemonConnectorException e) {
        throw e.rethrowAsParcelableException();
    }
}

system/netd/server/CommandListener.cpp

int CommandListener::FirewallCmd::runCommand(SocketClient *cli, int argc,
char **argv) {
if (argc < 2) {
cli->sendMsg(ResponseCode::CommandSyntaxError, “Missing command”, false);
return 0;
}

if (!strcmp(argv[1], "enable")) {
    if (argc != 3) {
        cli->sendMsg(ResponseCode::CommandSyntaxError,
                    "Usage: firewall enable <whitelist|blacklist>", false);
        return 0;
    }
    FirewallType firewallType = parseFirewallType(argv[2]);

    int res = gCtls->firewallCtrl.enableFirewall(firewallType);
    return sendGenericOkFail(cli, res);
}
if (!strcmp(argv[1], "disable")) {
    int res = gCtls->firewallCtrl.disableFirewall();
    return sendGenericOkFail(cli, res);
}
if (!strcmp(argv[1], "is_enabled")) {
    int res = gCtls->firewallCtrl.isFirewallEnabled();
    return sendGenericOkFail(cli, res);
}

if (!strcmp(argv[1], "set_uid_rule")) {
    if (argc != 5) {
        cli->sendMsg(ResponseCode::CommandSyntaxError,
                     "Usage: firewall set_uid_rule <dozable|standby|none> <1000> <allow|deny>",
                     false);
        return 0;
    }

    ChildChain childChain = parseChildChain(argv[2]);
    if (childChain == INVALID_CHAIN) {
        cli->sendMsg(ResponseCode::CommandSyntaxError,
                     "Invalid chain name. Valid names are: <dozable|standby|none>",
                     false);
        return 0;
    }
    int uid = atoi(argv[3]);
    FirewallRule rule = parseRule(argv[4]);
    int res = gCtls->firewallCtrl.setUidRule(childChain, uid, rule);
    return sendGenericOkFail(cli, res);
}



//agold start
if (!strcmp(argv[1], "set_uid_fw_rule")) {
    ALOGD("set_uid_fw_rule");
    if (argc != 5) {
        cli->sendMsg(ResponseCode::CommandSyntaxError,
                     "Usage: firewall set_uid_fw_rule <uid> <mobile|wifi> <allow|deny>",
                     false);
        return 0;
    }

    int uid = atoi(argv[2]);
    FirewallChinaRule chain = parseChain(argv[3]);
    FirewallRule rule = parseRule(argv[4]);

    int res = gCtls->firewallCtrl.setUidFwRule(uid, chain, rule);
    return sendGenericOkFail(cli, res);
}

if (!strcmp(argv[1], "clear_fw_chain")) {
    if (argc != 3) {
        cli->sendMsg(ResponseCode::CommandSyntaxError,
                     "Usage: firewall clear_fw_chain <chain>",
                     false);
        return 0;
    }

    FirewallChinaRule chain = parseChain(argv[2]);

    int res = gCtls->firewallCtrl.clearFwChain(chain);
    return sendGenericOkFail(cli, res);
}
//agold end

cli->sendMsg(ResponseCode::CommandSyntaxError, "Unknown command", false);
return 0;

}

system/netd/server/FirewallController.cpp

int FirewallController::enableFirewall(FirewallType ftype) {
int res = 0;
if (mFirewallType != ftype) {
// flush any existing rules
disableFirewall();

    if (ftype == WHITELIST) {
        // create default rule to drop all traffic
        std::string command =
            "*filter\n"
            "-A fw_INPUT -j DROP\n"
            "-A fw_OUTPUT -j REJECT\n"
            "-A fw_FORWARD -j REJECT\n"
            "COMMIT\n";
        res = execIptablesRestore(V4V6, command.c_str());
    }

    // Set this after calling disableFirewall(), since it defaults to WHITELIST there
    mFirewallType = ftype;
}
return res;

}

int FirewallController::disableFirewall(void) {
mFirewallType = WHITELIST;
mIfaceRules.clear();

// flush any existing rules
std::string command =
    "*filter\n"
    ":fw_INPUT -\n"
    ":fw_OUTPUT -\n"
    ":fw_FORWARD -\n"
    "COMMIT\n";

return execIptablesRestore(V4V6, command.c_str());

}

int FirewallController::setUidRule(ChildChain chain, int uid, FirewallRule rule) {
const char* op;
const char* target;
FirewallType firewallType = getFirewallType(chain);
if (firewallType == WHITELIST) {
target = “RETURN”;
// When adding, insert RETURN rules at the front, before the catch-all DROP at the end.
op = (rule == ALLOW)? “-I” : “-D”;
} else { // BLACKLIST mode
target = “DROP”;
// When adding, append DROP rules at the end, after the RETURN rule that matches TCP RSTs.
op = (rule == DENY)? “-A” : “-D”;
}

std::vector<std::string> chainNames;
switch(chain) {
    case DOZABLE:
        chainNames = { LOCAL_DOZABLE };
        break;
    case STANDBY:
        chainNames = { LOCAL_STANDBY };
        break;
    case POWERSAVE:
        chainNames = { LOCAL_POWERSAVE };
        break;
    case NONE:
        chainNames = { LOCAL_INPUT, LOCAL_OUTPUT };
        break;
    default:
        ALOGW("Unknown child chain: %d", chain);
        return -1;
}

std::string command = "*filter\n";
for (std::string chainName : chainNames) {
    StringAppendF(&command, "%s %s -m owner --uid-owner %d -j %s\n",
                  op, chainName.c_str(), uid, target);
}
StringAppendF(&command, "COMMIT\n");

return execIptablesRestore(V4V6, command);

}

//agold start
const char* FirewallController::FIREWALL = “firewall”;
const char* FirewallController::FIREWALL_MOBILE = “mobile”;
const char* FirewallController::FIREWALL_WIFI = “wifi”;
//agold end

int FirewallController::setupIptablesHooks(void) {
int res = 0;
//agold start
std::string command = “*filter\n”;
StringAppendF(&command, “-F firewall \n”);
StringAppendF(&command, “-A firewall -o ppp+ -j mobile\n”);
StringAppendF(&command, “-A firewall -o ccmni+ -j mobile\n”);
StringAppendF(&command, “-A firewall -o ccemni+ -j mobile\n”);
StringAppendF(&command, “-A firewall -o usb+ -j mobile\n”);
StringAppendF(&command, “-A firewall -o cc2mni+ -j mobile\n”);
StringAppendF(&command, “-A firewall -o wlan+ -j wifi\n”);
StringAppendF(&command, “COMMIT\n”);
res |= execIptablesRestore(V4V6, command.c_str());
//agold end
res |= createChain(LOCAL_DOZABLE, getFirewallType(DOZABLE));
res |= createChain(LOCAL_STANDBY, getFirewallType(STANDBY));
res |= createChain(LOCAL_POWERSAVE, getFirewallType(POWERSAVE));
return res;
}

//agold start
int FirewallController::setUidFwRule(int uid, FirewallChinaRule chain, FirewallRule rule) {
ALOGD(“setUidFwRule”);
std::string command = "filter\n";
char uidStr[16];
const char op;
const char* fwChain;

sprintf(uidStr, "%d", uid);

if (rule == DENY) {
    op = "-I";
} else {
    op = "-D";
}

if(chain == MOBILE) {
    fwChain = "mobile";
}else{
    fwChain = "wifi";
}

/*
if(chain == MOBILE) {
if(rule == ALLOW)
blacklistUsers.insert(uid);
else
blacklistUsers.erase(uid);
}
*/

ALOGD("setUidFwRule op = %s, chain = %s, uid = %s", op, fwChain, uidStr);
StringAppendF(&command, "%s %s -m owner --uid-owner %s -j REJECT\n", op, fwChain, uidStr);
StringAppendF(&command, "COMMIT\n");

return execIptablesRestore(V4V6, command.c_str());

}

int FirewallController::clearFwChain(FirewallChinaRule chain) {
std::string command = "filter\n";
const char fwChain;
if(chain == MOBILE) {
fwChain = “mobile”;
}else{
fwChain = “wifi”;
}
StringAppendF(&command, “-F %s \n”, fwChain);
StringAppendF(&command, “COMMIT\n”);
return execIptablesRestore(V4V6, command.c_str());
}
//agold end

运行到最后就是调用iptables命令去添加或删除一些规则，如果没有接口可以参考上面的接口增加,熟悉下iptables的规则就知道怎么添加了。

WhiteListMode函数其实就调的下面的iptables命令

adb shell iptables -A fw_INPUT -j DROP　；　// -A表示要添加规则到fw_INPUT链, -j DROP表示添加丢弃规则,丢弃所有输入包
adb shell iptables -A fw_OUTPUT -j REJECT　// -A表示要添加规则到fw_OUTPU链, -j REJECT表示添加拒绝规则,拒绝所有输出包
adb shell iptables -A fw_FORWARD -j REJECT

adb shell iptables -I fw_OUTPUT -m owner --uid-owner 1016 -j ACCEPT // -I表示插入一条规则到fw_OUTPUT链,是一条白名单规则,允许uid 1016的数据包通过

adb shell iptables -I fw_INPUT -m owner --uid-owner 1016 -j ACCEPT

调用后iptables张下面这个样子，Chain OUTPUT的数据包通过Chain fw_OUTPUT控制, Chain fw_OUTPUT的规则是reject所有数据包,只允许uid 1016 vpn。

$ adb shell iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
bw_INPUT all – anywhere anywhere
fw_INPUT all – anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
oem_fwd all – anywhere anywhere
fw_FORWARD all – anywhere anywhere
bw_FORWARD all – anywhere anywhere
natctrl_FORWARD all – anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
oem_out all – anywhere anywhere
firewall all – anywhere anywhere
fw_OUTPUT all – anywhere anywhere
st_OUTPUT all – anywhere anywhere
bw_OUTPUT all – anywhere anywhere

Chain fw_FORWARD (1 references)
target prot opt source destination
REJECT all – anywhere anywhere reject-with icmp-port-unreachable

Chain fw_INPUT (1 references)
target prot opt source destination
RETURN all – anywhere anywhere owner UID match vpn
DROP all – anywhere anywhere

Chain fw_OUTPUT (1 references)
target prot opt source destination
RETURN all – anywhere anywhere owner UID match vpn
REJECT all – anywhere anywhere reject-with icmp-port-unreachable

BlackListMode函数其实就调的下面的iptables命令

adb shell iptables -F fw_INPUT

adb shell iptables -F fw_OUTPUT //清除fw_OUTPUT链上所有规则,允许所有数据包通过

adb shell iptables -D fw_INPUT -m owner --uid-owner 10086 -j DROP // -D表示删除一条规则

adb shell iptables -I fw_OUTPUT -m owner --uid-owner 10086 -j DROP // -I表示插入一条规则到fw_OUTPUT链,是一条黑名单规则,只禁止uid 10086的数据包通过

adb shell iptables -I fw_INPUT -m owner --uid-owner 10086 -j DROP

调用后iptables张下面这个样子，Chain OUTPUT的数据包通过Chain fw_OUTPUT控制, Chain fw_OUTPUT的规则是只丢弃

uid 为u11_a83(10086)的数据包，就是前面设置的app的uid 10086

~$adb shell iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
bw_INPUT all – anywhere anywhere
fw_INPUT all – anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
oem_out all – anywhere anywhere
firewall all – anywhere anywhere
fw_OUTPUT all – anywhere anywhere
st_OUTPUT all – anywhere anywhere
bw_OUTPUT all – anywhere anywhere

Chain fw_INPUT (1 references)
target prot opt source destination
DROP all – anywhere anywhere owner UID match u11_a83

Chain fw_OUTPUT (1 references)
target prot opt source destination
DROP all – anywhere anywhere owner UID match u11_a83

如果需要单独控制wifi或移动数据，看DisableMobileMode里面setFirewallUidChainRule接口，这部分是厂商加的，如果没有可以按上面的内容进行添加，参考agold关键字，对照adb shell iptables -L的输出调试问题就不大了。

调用后iptables张下面这个样子，Chain OUTPUT的数据包通过Chain fw_OUTPUT 和Chain firewall控制, Chain fw_OUTPUT的规则为空就是不限制，Chain firewall通过mobile和wifi链控制wifi/mobile, Chain wifi为空，Chain mobile为reject owner UID match u0_a79

~$ adb shell iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
bw_INPUT all – anywhere anywhere
fw_INPUT all – anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
oem_out all – anywhere anywhere
firewall all – anywhere anywhere
fw_OUTPUT all – anywhere anywhere
st_OUTPUT all – anywhere anywhere
bw_OUTPUT all – anywhere anywhere

Chain firewall (1 references)
target prot opt source destination
mobile all – anywhere anywhere
mobile all – anywhere anywhere
mobile all – anywhere anywhere
mobile all – anywhere anywhere
mobile all – anywhere anywhere
wifi all – anywhere anywhere

Chain fw_INPUT (1 references)
target prot opt source destination

Chain fw_OUTPUT (1 references)
target prot opt source destination

Chain mobile (5 references)
target prot opt source destination
REJECT all – anywhere anywhere owner UID match u0_a79 reject-with icmp-port-unreachable

Chain wifi (1 references)
target prot opt source destination

iptables命令可以参考　https://blog.csdn.net/l1028386804/article/details/47356011

https://blog.csdn.net/reyleon/article/details/12976341

————————————————
版权声明：本文为CSDN博主「cyj88jyc」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/cyj88jyc/article/details/87985219