Controlling how apps access the internet is one of the most effective ways to protect your privacy, reduce background data usage, and save battery life on Android. While modern Android settings offer basic data restrictions, they often lack granular control over system services, Wi-Fi connections, VPNs, and background network requests.
This blog post provides a detailed, beginner-friendly guide to AFWall+ (Android Firewall+), one of the most trusted open-source firewall applications available for rooted Android devices. In this post, you will learn what AFWall+ is, its key features, system requirements, download options, step-by-step installation instructions, daily usage tips, troubleshooting solutions, and answers to frequently asked questions.
Table of Contents
What is AFWall+?
AFWall+ (Android Firewall+) is a free, open-source firewall application designed specifically for rooted Android devices. It functions as a graphical front-end for Linux’s powerful iptables network filtering system.
Unlike standard non-root firewall apps that rely on local VPN connections to filter traffic, AFWall+ operates directly at the Linux kernel level. This means it can completely block or allow network traffic for any app or system process before data leaves your phone. It allows you to define specific rules for different connection types, including Wi-Fi, mobile networks, roaming data, VPNs, local area networks (LAN), and Tor routing.
Features of AFWall+
AFWall+ offers a comprehensive suite of security and network management capabilities:
- Granular Network Filtering: Allow or block internet access for individual applications across Wi-Fi, mobile data (2G/3G/4G/5G), roaming, VPNs, LANs, tethering hotspots, and Tor.
- Whitelist and Blacklist Modes: Choose between allowing only selected apps (Whitelist mode) or blocking only selected apps (Blacklist mode).
- Profile Management: Create and save custom profiles (such as Home, Work, Public Wi-Fi, or Travel) and switch between them instantly.
- IPv4 and IPv6 Support: Full compatibility with both IPv4 and IPv6 protocols to ensure complete network protection.
- Custom Scripting: Advanced users can execute custom shell and iptables scripts during startup or shutdown for customized routing rules.
- Startup Protection: Applies firewall rules early in the boot sequence to prevent apps from leaking data before the phone fully loads.
- Tasker and Locale Integration: Automate rule changes based on your location, connected Wi-Fi SSID, or time of day.
- Security Lock: Protect app settings using a PIN, pattern, fingerprint, or password to prevent unauthorized changes.
- Import and Export Rules: Backup your rule configurations to local storage or cloud backups and restore them whenever needed.
- Network Logging and Alerts: Track blocked connection attempts with real-time notifications and integrated connection logs.
Requirements
Before installing AFWall+, ensure your Android device meets the following requirements:
- Root Access: Root permissions are mandatory. AFWall+ requires superuser access (via Magisk, LineageOS su, or SuperSU) to modify kernel-level iptables rules.
- Android Version: Supports Android 5.0 (Lollipop) up to Android 14 and newer. Legacy versions are available for Android 4.x (v2.9.9) and Android 2.x (v1.3.4.1).
- Supported Architectures: Compatible with ARM, ARM64, x86, and x86_64 processors.
- Storage Space: Requires approximately 15 MB for the application package and around 5 MB for binary storage.
Download
AFWall+ is completely open-source and free to download under the GNU General Public License v3.0 (GPLv3). You can obtain the official APK file from several trusted sources:
- GitHub Releases: Download the latest stable and beta APK releases directly from the AFWall+ GitHub Repository.
Note: A paid Unlocker key is also available on Google Play or via donations to unlock extra features like advanced password settings and custom profile widgets.
How to Install
Follow these steps to safely install and authorize AFWall+ on your rooted device:
- Verify Root: Ensure your device is properly rooted and that your root manager (such as Magisk) is operational.
- Download the APK: Download the installer from GitHub, F-Droid, or the Google Play Store.
- Install the Application: Open the downloaded APK file and follow the on-screen prompts to complete installation.
- Grant Superuser Access: Launch AFWall+ for the first time. When the root permission prompt appears from Magisk or SuperSU, select Grant or Allow.
- Initial Setup: The app will check for compatible iptables and BusyBox binaries on your system. Keep the default settings unless you have custom binaries installed.
How to Use
Using AFWall+ is straightforward once you understand how rule columns work.
- Select Your Operating Mode: Tap the menu icon and navigate to mode settings. By default, AFWall+ operates in Whitelist mode, which blocks all apps from the internet unless you check their boxes. This is the safest mode for privacy.
- Configure App Permissions: On the main screen, you will see a list of installed apps alongside column checkboxes representing different connection types:
- LAN: Local Network connections
- Wi-Fi: Wireless internet access
- Cellular: Mobile data connection
- Roaming: Data access while roaming
- VPN: Traffic routed through a active VPN connection
- Tor: Traffic routed through Tor
- Set Rules for Essential System Services: Make sure critical system components (like NTP for time synchronization or DNS/DHCP services under UID 0/1000) are given network access if needed; otherwise, internet resolution or time sync may stop working.
- Apply Rules and Enable Firewall:
- Check the boxes for the apps you want to grant internet access to.
- Tap the Apply button (or checkmark icon) to write the rules to iptables.
- Toggle the main firewall switch to Enabled. A green shield indicator confirms that the firewall is active.
- Add Widgets for Quick Access: Place an AFWall+ widget on your home screen to enable or disable the firewall or toggle between profiles with a single tap.
Credits
AFWall+ is a community-driven open-source project that relies on work from multiple developers and open-source packages:
- Original Concept: Derived from DroidWall, originally created by Rodrigo Rosauro.
- Lead Developer and Maintainer: Umakanthan Chandran (ukanth).
- Core Open-Source Dependencies:
- iptables (Linux Firewall Framework – GPL v2)
- BusyBox (Unix Utilities – GPL v2)
- libsuperuser / libsu (Root Access Management – Apache 2.0)
- Material Dialogs & DBFlow (UI and Database Management – MIT License)
- Community Translators: Dozens of volunteer translators contributing through Crowdin.
Troubleshooting
If you encounter issues while using AFWall+, try these proven troubleshooting steps:
- Apps leaking data on boot: Go to Preferences > Experimental and enable Fix startup data leak or increase the Startup delay timer to ensure rules apply before apps launch.
- Media streaming or radio apps stop working: Ensure that system services like Media Server (UID 1013) are checked and allowed in your rule list.
- Internet completely blocked after uninstalling or crashes: If internet traffic remains blocked, open a terminal app (like Termux) and execute su -c “iptables -F” to clear all iptables rules.
- Conflicts with WireGuard or VPNs: Open AFWall+ Preferences > Rules/Connectivity and turn on VPN control. If using WireGuard, rename your WireGuard tunnel interface in its config file to start with the tun prefix (e.g., tunmy-interface) so AFWall+ can auto-detect it.
- How to submit bug reports: Enable the Log Service under Preferences > Log Preferences. If an issue persists, generate a log file and open a ticket on the AFWall+ GitHub Issues page.
FAQs
No. AFWall+ requires direct access to Linux iptables, which is only accessible with superuser (root) permissions. Non-rooted users must rely on VPN-based firewall apps instead.
AFWall+ is strictly a network firewall, not an antivirus or ad blocker. However, blocking internet access for specific apps will stop them from downloading ads or sending telemetry data.
No. In fact, AFWall+ usually improves battery life. Because iptables operates inside the Linux kernel, filtering requires virtually no CPU overhead, and blocking unnecessary background synchronization saves battery power.
In Whitelist mode, internet access is denied to all apps by default, and you manually check the apps you want to allow. In Blacklist mode, all apps can access the internet by default, and you check only the apps you want to block.
Conclusion
AFWall+ remains one of the most powerful privacy tools available for rooted Android smartphones. By delivering low-level kernel filtering through iptables, it gives you complete control over which applications can send or receive data over Wi-Fi, mobile networks, and VPNs. Whether your goal is to prevent background tracking, conserve mobile data, or stop unauthorized connections, AFWall+ delivers robust security without compromising system performance.
Have questions, suggestions, or tips about configuring AFWall+ on your Android device? Please leave a comment below!
