{"id":240,"date":"2025-06-21T10:55:52","date_gmt":"2025-06-21T10:55:52","guid":{"rendered":"https:\/\/www.fmidnight.com\/cyberdisk\/?p=240"},"modified":"2025-07-01T19:19:40","modified_gmt":"2025-07-01T19:19:40","slug":"datura-firewall","status":"publish","type":"post","link":"https:\/\/www.fmidnight.com\/cyberdisk\/datura-firewall\/","title":{"rendered":"Datura Firewall"},"content":{"rendered":"\n
\n
\n
Software<\/td>Datura Firewall<\/td><\/tr>
Type<\/td>Application Firewall<\/td><\/tr>
Tag<\/td>Security<\/a>. Privacy<\/a><\/td><\/tr>
Platform<\/td>Android<\/a><\/td><\/tr>
Privacy Rating<\/td>\u2b50\u2b50\u2b50\u2b50\u2b50<\/td><\/tr>
License Model<\/td>Free – Open Source<\/td><\/tr>
Links<\/td>calyxos.org<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n\n
\n
\"\"<\/figure>\n<\/div>\n<\/div>\n\n\n\n
\n

Privacy Pros: Perfect app for blocking internet access of apps that try to phone home every 5 seconds.<\/p>\n\n\n\n

Privacy Cons: None<\/p>\n\n\n\n

Privacy Tips: If using a VPN, turn off all access to apps except through the VPN. This acts as a second failsafe on top of Always On and Global VPN. Also set app defaults to deny, so that new apps have to request access.<\/p>\n<\/blockquote>\n\n\n\n

The firewall could generally be considered to be composed of 3 layers for each of its features. A UI layer, the frameworks layer (see https:\/\/developer.android.com\/guide\/platform#api-framework<\/a>), and the netd layer (see https:\/\/developer.android.com\/guide\/platform#native-libs<\/a>).<\/p>\n\n\n\n

UI<\/h3>\n\n\n\n

This is the layer visibly exposed to users (toggles, text, \u2026). It is responsible for passing down information (global toggle switched or app restriction applied, in which case it sends the UID of the app and the policy or rule related to the feature) about a user\u2019s selection to the frameworks for processing.<\/p>\n\n\n\n

Frameworks<\/h3>\n\n\n\n

Responsible for the first level of processing (e.g. sanity checks, state machine, \u2026), managing the dynamics of a feature (e.g. app in background) and passing down the inputs to netd to apply policies and rules.<\/p>\n\n\n\n

Netd<\/h3>\n\n\n\n

At its core, the firewall makes use of standard Linux networking utilities to process traffic (see https:\/\/source.android.com\/devices\/architecture\/hidl\/network-stack<\/a>). Netd is responsible for the last level of processing and calls the networking utilities, passing in the input for any operation.<\/p>\n\n\n\n

Features<\/h2>\n\n\n\n

Per-interface network usage restrictions<\/h3>\n\n\n\n