Develop Bugs

[kernel] Do we need data security (aka a working firewall)?

Dear kernel developer,
do you have a firewall on your destop computer?
I think, the answer is "yes, of course!"
Why don't you wan't a firewall for your phone?
Your answere: "It is linux, we don't need it!"
Sure?
In contrast to the "safe a.p.p.l.e market" we are free to get our application from everywhere...
But every person with minimum programming skills is able to use tools like "apktool", "smali/baksmali" to modify existing applications.
Why not integrate some spy functions (send private photos, use camera and microphone, send phonebook and email-adresses).
Solution:
There is always a FREE program to disallow or allow applications the use of wifi or mobile data connections:
DROIDWALL ( h ttp://code.google.com/p/droidwall/ )
But this superb program need some special compiling parameters in the kernel compilation process.
(Something like 'iptables', 'multiport', 'iprange' and 'ipowner')
I found only one working kernel+rom, which is DroidWall compatible: "Six O´Clock A.M." from user 'oclock',
( h ttp://android.modaco.com/content/htc-desire-desire-modaco-com/312051/oclock-custom-rom/ )
This is a fine and stable release, but it is a v2.1 rom (not froyo).
Please, please froyo-kernel-developer: get the right parameters for kernel compilation, so we can use DroidWall.
So everybody can decide by himself, which application is allowed to send data to wifi or mobile data connection.
Kind Regards

i knew linux didnt need an antivirus, thought it still needed a firewall...
since ive always had one set up on my linux installs... but then again, im a linux noob.

What about using the phone as a hardware firewall for your laptop when on public wifi?
I'd have no use for it personally but I am sure others might.

You do not NEED a firewall on your computer. You need a firewall between your computer and the internet. If your computer has a public routable IP then you need a software firewall. If you have a hardware firewall that is a good known brand and it is not OLD then this will be fine providing you do not illegally download software - generally. And therefore there is no requirement for a software firewall.
You need a firewall to deny traffic to port's (and IP addresses) that are not closed by default. These open ports potentially open a security risk providing there is an exploit for said port.
Please inform us of which ports are open on our Android phones? I mean open for inbound communication of which did not get opened due to software making an outbound connection.
I can do an NMAP to my desire over wifi sometime this week to discover... But right now I can pretty much say you do not need a firewall on your phone. It will only cause you problems with software needing the internet. And besides, our phone ISPs put us on a private network - they dont usually allow connections between hosts / customers, and we sit behind a corporate type hardware firewall...

iptables
Actually Andorid has a Firewall installed, its called iptables.
It's not a personal firewall... but thous are just to get money from PPL without any advanced security... Linux does, by design not have open ports... like windows where you need a program to close what shouldn't be open anyway... And when you Install an APP you see what the APP wants to do, if it wants access to your contacts or internet or what else... so there is absolutely no need for a user scaring Personal Firewall

kuhine said:
So everybody can decide by himself, which application is allowed to send data to wifi or mobile data connection.
WiHerr
Click to expand...
Click to collapse
OK, a classic firewall is looking only to the used network-ports and allow or disallow the communication: this type of firewall can not make a difference between a good and bad data transmission (for example the firewall built-in in our wifi-routers).
But extented versions of firewalls have a built-in behavior control of applications:
I want to decide, which application is allowed to communicate WITHOUT ANY USERCONTROL over Wifi or a mobile data connection and which one not.
- I want to stop (possible) spyware from sending my private data out
- I want to stop software looking to their developers server an stop working when the developer say "stop, buy the new the new version - the old one is out of order yet"
And in linux there is a system function, which has the information, which network sockets are owned by which application (ipuser?).
There are only a few parameters to set when compiling a new kernel, to activate these functions
Please look to the Droidwall site and the screenshot of the software.
Regards

safttuete said:
Actually Andorid has a Firewall installed, its called iptables.
Click to expand...
Click to collapse
That is the point, but IPTABLES is not working on allmost all android kernels, except the oclock roms. Or am I wrong?
Droidwall is only a graphical frontend for iptables! Not more.
Everytime when we install new software (i.e. out of the android market), we get a list displayed of what the program likes to do. And there is allmost "unrestrictive network use" for even the smallest witgets... I want to decline this network use, but it is a "take all or nothing" thing.
I'm not a modern facebook/twitter user: take all my data... here a some more private details... and here are photos and addresses from all my friends, too.
What is so scary to select out some applications from sending data?
And with a working iptables we can do so.
Dramatical continuance...
the real reason could be: there are some application installed on the phone, which must not re-check their licenses on every use...
(only to save mobile data volume... without switching to flight mode)

I think an app that can edit the given permissions would be much more useful than a firewall. But I haven't found something like that yet.

@kuhine
I think nearly every custom ROM has iptables, CM has it for sure. I don't know about ipuser though.
uTauro said:
I think an app that can edit the given permissions would be much more useful than a firewall. But I haven't found something like that yet.
Click to expand...
Click to collapse
It's impossible for now. Android convention is to give all required permissions to an app or don't install it at all, so apps aren't designed to support lack of permissions. Most of them will probably FC, even if you will block out some minor feature.

Hello all,
today I saw the message, that a wallpaper app sent private information to their server in china:
h t t p ://mobile.venturebeat.com/2010/07/28/android-wallpaper-app-that-steals-your-data-was-downloaded-by-millions/
In the meantime I choose this rom with "DROIDWALL" firewall support:
[ROM-FroYo AOSP] OpenDesire v2.3a
And I found a new free firewall program named "ANDFIRE", but I didn't test it yet.

kuhine said:
And I found a new free firewall program named "ANDFIRE", but I didn't test it yet.
WiHerr
Click to expand...
Click to collapse
Checked ANDFIRE out. Seems to work fine on my DeFrost 2.2c release. Will check it out further. Interface looks very similar to DroidWall and that also seems to work fine on my device.
Will have to investigate further, but it's a good idea to get it working.

suffer not adware to live
kuhine said:
That is the point, but IPTABLES is not working on allmost all android kernels, except the oclock roms.
Click to expand...
Click to collapse
If the kernel features you need are not an option consider a less horrible option:
LBE privacy guard

kuhine said:
That is the point, but IPTABLES is not working on allmost all android kernels, except the oclock roms. Or am I wrong?
Droidwall is only a graphical frontend for iptables! Not more.
Everytime when we install new software (i.e. out of the android market), we get a list displayed of what the program likes to do. And there is allmost "unrestrictive network use" for even the smallest witgets... I want to decline this network use, but it is a "take all or nothing" thing.
I'm not a modern facebook/twitter user: take all my data... here a some more private details... and here are photos and addresses from all my friends, too.
What is so scary to select out some applications from sending data?
And with a working iptables we can do so.
WiHerr
Dramatical continuance...
the real reason could be: there are some application installed on the phone, which must not re-check their licenses on every use...
(only to save mobile data volume... without switching to flight mode)
Click to expand...
Click to collapse
May be you should have a look for LBE privacy....

[Q] Safe surfing over open wifi spots?

When your out traveling you often connect to different wifi spots(restaurants, hotel,...) and you never know how what happens behind.
Is there a way to use your phone on Internet in a safe way? Like a switch on your home screen you can turn the it on/off easly? I guess you need an app, a vpn or a server of some sort??

What do you mean with "in a safe way" ?
For example gmail uses a cripted (SSL) channel to read/send email. Is SSL "enough" safe for you ?
Using a "public" hotspot is not less "safe" than acecss your online backing form a pc at office. Is it possible for the "neworking guy" to see that you are accessing an online bank? Yes, for sure. Could he read your PIN/passwd and steal your money ? If your bank has a decent website (HTTPS) probably not (or not so easily..).
Do you wnat to be "safe" to read an online newspaper for last headnews?

Tor, private VPN
Sent from my i9250

kliw said:
For example gmail uses a cripted (SSL) channel to read/send email. Is SSL "enough" safe for you ?
Click to expand...
Click to collapse
With the easy availability of Jasager routers and how simple SSL-stripping is, no, SSL isn't safe enough on a public wifi.
As bk said, either use Orbot (TOR's Android implimentation) or a private VPN that provides endpoint-to-endpoint encryption.

I usually tend not to do any super personal stuff over public wifi - that means access gmail, google drive, etc.
I tend to stick to browsing websites for reading and that's it.
Chances are, if it's in a known location of a big business you probably have nothing to worry about.
A mom-and-pop coffee shop, or a crummy hotel wifi access point I'd be skeptical of the security enforced.

Here you go..
http://forum.xda-developers.com/showthread.php?t=1350941

akira02rex said:
Chances are, if it's in a known location of a big business you probably have nothing to worry about.
Click to expand...
Click to collapse
Actually, a big business's wifi is probably less safe. Anyone who wants a large number of targets at once just needs a Jasager router, the ability to launch a de-auth attack (not difficult at all), and a local Starbucks.

Vpn on wp7.5 found

Dear Fnds
I have tried with free vpn on my samsund focus cellar data
it get connected but phone cannot get ip itself which is alloted by free vpn servers
if any one can find the solution pls update

I am not sure I understood what you meant.
Vpn ? Could it be possible you meant APN ? Vpn is not supported in windows phone atm.

It appears to be a USA-based VPN service which the OP is attempting to use as an APN for the phone (which is a clever way to do a VPN... if it works). It sort of looks like it's working, even (see last screenshot). It's probably not useful as a general-purpose VPN client, but it could be used for getting stuff which is not available outside the US.

GoodDayToDie said:
It appears to be a USA-based VPN service which the OP is attempting to use as an APN for the phone (which is a clever way to do a VPN... if it works). It sort of looks like it's working, even (see last screenshot). It's probably not useful as a general-purpose VPN client, but it could be used for getting stuff which is not available outside the US.
Click to expand...
Click to collapse
exactly you are right sir

GoodDayToDie said:
It appears to be a USA-based VPN service which the OP is attempting to use as an APN for the phone (which is a clever way to do a VPN... if it works). It sort of looks like it's working, even (see last screenshot). It's probably not useful as a general-purpose VPN client, but it could be used for getting stuff which is not available outside the US.
Click to expand...
Click to collapse
exactly
you are right sir
It was working to some extend.

[Q] AT&T Detected Tether Apps?

So today I got the letter in the mail from AT&T telling me that I need to stop tethering or that I'll lose my old grandfathered in unlimited data plan and be moved to plan that supports tethering and a data cap.
I called the number they gave me to get some info on what they were going to say they told me very generally that they have detected tethering and that if I don't stop by the end of the month, they will bump my plan. She gave me a laundry list of things that are considered tethering, from wifi hotspots to getting internet access for a gaming console.
I pressed very hard to find out what exactly I have done that they register as tethering more than anything I wanted specifics. She told me several times that they couldn't give out specifics as that is proprietary information. When I suggested that this might just them trying to force me onto a more expensive plan since they were unable to give me any proof that I had been tethering, she paused and said that she's wait while I look in my phone for tethering apps. I told her I don't have any tethering apps and she told me to look again. After some back and forth, she told me that the mere existence of a tethering app on the phone was considered tethering.
Beyond the issue of tethering at the moment I'm bothered that they even know what apps are on my phone and that they might use the existence of an app as justification to alter my service.
Has anyone heard of the carrier looking at apps like this before? From a privacy standpoint, I'd like to see if there is some way to keep their nose out of my business. Anyone know of a way to keep AT&T out of my phone?

If you were to have a tethering app on your phone (and of course, you don't), what would it be? i.e., if AT&T can detect certain apps, what, do you suppose (without admitting anything incriminating), are the apps they're talking about?
I can't imagine they'd be crazy enough to surreptitiously audit the content of a subscriber's phone, and then tacitly admit to it with this sort of inquiry. But I could imagine that they can detect tethering "signatures" via snooping network traffic. For example, if you tether to a PC and use that to browse the internet, the user agent will look different than when the phone's browser is being used. Or if you left a tethering session running and they saw your phone pulling down updates for Microsoft Windows, that'd sure be a dead giveaway. There's little if any reason to pull anything off Windows Update with a phone. They could maybe get away with detecting that sort of thing since they wouldn't be looking at data content, just whether or not the data source was consistent with a smartphone or not...

willp2 said:
So today I got the letter in the mail from AT&T telling me that I need to stop tethering or that I'll lose my old grandfathered in unlimited data plan and be moved to plan that supports tethering and a data cap.
I called the number they gave me to get some info on what they were going to say they told me very generally that they have detected tethering and that if I don't stop by the end of the month, they will bump my plan. She gave me a laundry list of things that are considered tethering, from wifi hotspots to getting internet access for a gaming console.
I pressed very hard to find out what exactly I have done that they register as tethering more than anything I wanted specifics. She told me several times that they couldn't give out specifics as that is proprietary information. When I suggested that this might just them trying to force me onto a more expensive plan since they were unable to give me any proof that I had been tethering, she paused and said that she's wait while I look in my phone for tethering apps. I told her I don't have any tethering apps and she told me to look again. After some back and forth, she told me that the mere existence of a tethering app on the phone was considered tethering.
Beyond the issue of tethering at the moment I'm bothered that they even know what apps are on my phone and that they might use the existence of an app as justification to alter my service.
Has anyone heard of the carrier looking at apps like this before? From a privacy standpoint, I'd like to see if there is some way to keep their nose out of my business. Anyone know of a way to keep AT&T out of my phone?
Click to expand...
Click to collapse
Are you on stock AT&T rom?
Sent from my SAMSUNG-SGH-I317 using XDA Premium HD app

While I hope for their own sake that they aren't auditing software on the devices, I suppose they could be watching what people download. For instance, some tethering apps are just not available in the Play store if you are coming from AT&T or Sprint. I could see that perhaps in one of the many TOS agreements I clicked OK on without reading there was something that said they could sniff around my phone.
I assumed they would be looking at traffic, but after being quite vague over and over again, she was very specific about a tethering app. Agreed that as soon as a PC goes online it creates all kinds of traffic that wouldn't look like a smart phone.
I am using the stock / not rooted AT&T ROM at this point. I normally root right away, but I haven't really had a need on this one.
I would root and use a different ROM if I felt like it would keep their noses out of my junk. Even if I was tethering, I'm not using a crazy amount of data so I find the whole thing pretty silly.
Now I am thinking that if they do change my tethering plan without my permission, I have to assume that I can break my contract if I want and move elsewhere. Just not sure where I could get another Note II with unlimited data at a decent price.

willp2 said:
While I hope for their own sake that they aren't auditing software on the devices, I suppose they could be watching what people download. For instance, some tethering apps are just not available in the Play store if you are coming from AT&T or Sprint. I could see that perhaps in one of the many TOS agreements I clicked OK on without reading there was something that said they could sniff around my phone.
I assumed they would be looking at traffic, but after being quite vague over and over again, she was very specific about a tethering app. Agreed that as soon as a PC goes online it creates all kinds of traffic that wouldn't look like a smart phone.
I am using the stock / not rooted AT&T ROM at this point. I normally root right away, but I haven't really had a need on this one.
I would root and use a different ROM if I felt like it would keep their noses out of my junk. Even if I was tethering, I'm not using a crazy amount of data so I find the whole thing pretty silly.
Now I am thinking that if they do change my tethering plan without my permission, I have to assume that I can break my contract if I want and move elsewhere. Just not sure where I could get another Note II with unlimited data at a decent price.
Click to expand...
Click to collapse
Also make sure you DONT use internet explorer that is a NO NO for tethering with AT&T they see the browser agent and KNOW that`s not possible without tethering.

hyelton said:
Also make sure you DONT use internet explorer that is a NO NO for tethering with AT&T they see the browser agent and KNOW that`s not possible without tethering.
Click to expand...
Click to collapse
Prove I haven't just changed my agent string to make the stupid app server think I'm on a windows desktop and using IE.
One of my friends pinged me 2 days ago. He got the friendly text stating tethering isn't allowed without a tether plan. No tethering on his part, just a lot of vevo traffic.
-----
I would love to help you, but help yourself first: ask a better question
http://www.catb.org/~esr/faqs/smart-questions.html

You could setup a linux machine at home and keep that running. Setup an SSH tunnel from your phone to your home linux box and tunnel all the tethering traffic through that. To AT&T that would just look like an encrypted ssh connection.

You could also run a Windows virtual machine on your phone. It's already been done.

Darkshado said:
You could also run a Windows virtual machine on your phone. It's already been done.
Click to expand...
Click to collapse
That wouldn't help. FIrst, I don't think there are any hardware network drivers for windows for the Note II, so it wouldn't be able to get internet. Second, If he did have internet, he would still run into the same issue of unencrypted traffic being sniffed by at&t. Sure he could setup an ssh tunnel from windows, but at that point it's just silly to run windows on the note just to encrypt traffic.

I assume one could use any VPN like the SSH tunnel or something like hotspot shield or similar as long as all traffic is forced through the tunnel and there really would be no way for anyone to tell what you are doing.

willp2 said:
I assume one could use any VPN like the SSH tunnel or something like hotspot shield or similar as long as all traffic is forced through the tunnel and there really would be no way for anyone to tell what you are doing.
Click to expand...
Click to collapse
YA, thats the idea. As long as traffic is encrypted somehow there is little that AT&T can sniff.

DeMiNe0 said:
That wouldn't help. FIrst, I don't think there are any hardware network drivers for windows for the Note II, so it wouldn't be able to get internet. Second, If he did have internet, he would still run into the same issue of unencrypted traffic being sniffed by at&t. Sure he could setup an ssh tunnel from windows, but at that point it's just silly to run windows on the note just to encrypt traffic.
Click to expand...
Click to collapse
I think he was perhaps referring to why there was traffic that looks like it originated from a PC coming from my phone. So if someone was running a VM on the phone itself it would produce some PC looking traffic. If that was the idea there, I assume tethering to a VM is still tethering?

Yeah: Provided you can run Qemu or Virtualbox you can run Windows in it, and it will have network access just like any VM would from a full sized computer. My point is that you can make a non-tethered phone generate the very same sort of IP traffic a computer would.
Heck, if the Fujitsu LOOX F-07C can run on AT&T, you don't even need a VM to generate connections to Windows Update and a desktop IE user agent!

I got the same message last week. I don't tether at all. I'm on cleanrom 4.5. Tried to request what apps they suspect me of using but wouldn't tell me either. I know all the apps I have on my phone as I keep things very simple. I will admit I do use a lot of data (4-4.5 gigs in 2 weeks lol)
I use Pandora and tunein app to stream music all the time. Only thing that I recently did out of the normal routine was use the desktop view on Google chrome. Would that give a different browser signature?

pyo said:
I got the same message last week. I don't tether at all. I'm on cleanrom 4.5. Tried to request what apps they suspect me of using but wouldn't tell me either. I know all the apps I have on my phone as I keep things very simple. I will admit I do use a lot of data (4-4.5 gigs in 2 weeks lol)
I use Pandora and tunein app to stream music all the time. Only thing that I recently did out of the normal routine was use the desktop view on Google chrome. Would that give a different browser signature?
Click to expand...
Click to collapse
Yes, it would show a user-agent string without indicating mobile. But not likely something to trigger a tether notice, as I use desktop view all the time. It's likely the high data usage that makes them think tether.
-----
I would love to help you, but help yourself first: ask a better question
http://www.catb.org/~esr/faqs/smart-questions.html

willp2 said:
So today I got the letter in the mail from AT&T telling me that I need to stop tethering or that I'll lose my old grandfathered in unlimited data plan and be moved to plan that supports tethering and a data cap.
I called the number they gave me to get some info on what they were going to say they told me very generally that they have detected tethering and that if I don't stop by the end of the month, they will bump my plan. She gave me a laundry list of things that are considered tethering, from wifi hotspots to getting internet access for a gaming console.
I pressed very hard to find out what exactly I have done that they register as tethering more than anything I wanted specifics. She told me several times that they couldn't give out specifics as that is proprietary information. When I suggested that this might just them trying to force me onto a more expensive plan since they were unable to give me any proof that I had been tethering, she paused and said that she's wait while I look in my phone for tethering apps. I told her I don't have any tethering apps and she told me to look again. After some back and forth, she told me that the mere existence of a tethering app on the phone was considered tethering.
Beyond the issue of tethering at the moment I'm bothered that they even know what apps are on my phone and that they might use the existence of an app as justification to alter my service.
Has anyone heard of the carrier looking at apps like this before? From a privacy standpoint, I'd like to see if there is some way to keep their nose out of my business. Anyone know of a way to keep AT&T out of my phone?
Click to expand...
Click to collapse
To the OP, did you tether ever?
I am worried that innocent people will lose their unlmtd plan? We need to find out if their detection system is wrong?

Wait, I signed up for 2 lines around 3 or 4 months sgo and they said because I got the max 6gigs of data a month I could tether all I want. I haven't for more than 10 minutes but I have noticed that AT&T sales reps speak in half truths. I was told if I paid the 10 a month for insurance I could break it by throwing it at someone" Well I added my 2nd line 10 days later and only then found out about a $200 deductible. I was definitely never told about a high deductible upon signing with them. I dont hold back though. I had all prorated charges waived.
Sent from my SAMSUNG-SGH-I317 using Xparent Skyblue Tapatalk 2

DeMiNe0 said:
You could setup a linux machine at home and keep that running. Setup an SSH tunnel from your phone to your home linux box and tunnel all the tethering traffic through that. To AT&T that would just look like an encrypted ssh connection.
Click to expand...
Click to collapse
That's exactly what I do and no problems thus far

Tethering detection has been discussed many times. The consensus is that they detect tethering by examining the TTL (Time-To-Live) value in the packet. When you tether a device, it shows a different TTL value than the one used in data packets sent by the phone and that's what they look for. There are other tricky things they can examine in the packet headers that can be used to detect tethering, but those are more complicated and take more effort on the part of the the wireless provider.
From what I read, it looks like SSH tunneling over a VPN would allow you to tether without detection, but I haven't heard of any definitive test on this. The biggest problem I see with that approach is that it really slows down your connection.
Here's a very technical paper that discusses tethering and methods to defeat it: Tethering Camouflage
These guys created a test app that rewrites packet data to hide tethering. In the article, they compare their method to using a VPN, which they imply will do the trick. Their opinion is that wireless providers will eventually give up on trying to enforce tethering restrictions because people will find ways to defeat it and it will cost them more than it's worth.

cyrano821 said:
That's exactly what I do and no problems thus far
Click to expand...
Click to collapse
Same here got an ipcop firewall with open VPN Created certs for my mac and Android devices and no issues as of yet.

Private DNS ad-blocking

I used to always unlock bootloaders, install TWRP, flash clean Android and load up AdAway until my latest S20 acquisition. The intention was to wait out the 2yr warranty period and then do it until I learned that ad blocking was possible using the Private DNS setting.
Over the first days of using my new S20 I was really shocked at the volume of crap blasting at me that AdAway was blocking in the past, so trying out Private DNS was a welcome relief (dns.adguard.com).
It's only been a few days since I've done this and I just applied the setting to the wife's (stock) Huawei P20 Pro, and yes a large volume of ads are now missing, a sight for very sore eyes.
Just wondering if others have had positive and/or negative experiences using Private DNS for ad blocking. I saw Pixel 2s were rebooting but I'm sure the latest versions of Android would have sorted this by now. I haven't experienced anything untoward so far but I'm a very light user and only had the phone 4 days.

Works great for me! No more Blokada, DNS66, et al. Been using this since my Note 9.
Install youtube vanced and you're all set.

Tried dns.adguard.com before but some ads were still going through so i stuck to blokada, but now it seems to work fine, no more vpn icon

Used AdAway on rooted devices too ... with dns.adguard.com i had no problems while using it .... if you want, try this.. dns.keweon.center ..which i currently use...also excellent DNS

No need to use VPN Ad blockers.
Instead of dns.adguard.com use nextdns.io
Get free account and configure it as You want, with many filters full loging etc. It's better than AdAway.
Then You can set private dns to Your custom nextdns config.

krogoth said:
No need to use VPN Ad blockers.
Instead of dns.adguard.com use nextdns.io
Get free account and configure it as You want, with many filters full loging etc. It's better than AdAway.
Then You can set private dns to Your custom nextdns config.
Click to expand...
Click to collapse
Thanks for this tip.
I've just set it up after a week of quite successful dns.adguard.com ad blocking but I really like the enormous flexibility of nextdns.io and its (potential) threat protection, as well as the logging (in CH) and analytics. Reminds me of OpenDNS but with ad blocking as well!
I have recommended it to a friend with two younger boys, he might appreciate the content filtering side for them, but generally the one thing that has irked me about smartphones is the potential for accidentally landing on a new malware site even if it is unlikely to infect Android.

The problem with the any DNS or VPN based blocking method: Chrome will randomly stop functioning whenever I am connected to any wifi network.
It will just stop loading random sites, not show all pictures in Google Image search, not show anything anymore when you click back and forward or just stop loading anything at all.
Go to mobile connection, it immediately works. Disable the DNS/VPN blocker, it immediately works.
Reconnect wifi, it will work again for a while. Can be two days, can be ten minutes. It's completely random.
I am not able to figure out ANY reason why this is happening.
I know Chrome has its own DNS resolver and you should disable it when using DNS based blocking methods (disable async dns resolver and clear dns cache), and while this fixes the problem that not all ads are blocked in a reliable way, it doesn't fix the wifi connection loss.
Using DNS or VPN based blockers only cause problems in Chrome, no other app.
I know I could just switch browsers, its just that I use Chrome on desktop as well and like the synced bookmarks.
Does anyone have any idea why using a VPN/DNS based adblocker would cause Chrome to specifically stop working randomly only in a wifi network, but not via mobile?
I have had this issue over several devices and Android versions for years now and I can't figure it out.

fBx said:
Does anyone have any idea why using a VPN/DNS based adblocker would cause Chrome to specifically stop working randomly only in a wifi network, but not via mobile?
Click to expand...
Click to collapse
Does it happen only on your home network? If so, are you using additional adblockers such as Pi-hole or dns.adguard..com as your router's default DNS?
Interesting that it happens only with mobile Chrome. Just another reason to stop using Chrome....

just use Disconnect Pro instead, Adblock through KNOX.

Sorry guys you all lying to urselfs... best adblock is still only via root available! Energized or AdAway is where it's at.

chieco said:
Sorry guys you all lying to urselfs... best adblock is still only via root available! Energized or AdAway is where it's at.
Click to expand...
Click to collapse
Thanks captain obvious! Now go root my north american snapdragon s20...

Adguard for Android is nice, not the app store version either. It's on adguard.com
Sent from my SM-G988U using Tapatalk

[email protected] said:
just use Disconnect Pro instead, Adblock through KNOX.
Click to expand...
Click to collapse
This is a fantastic solution!

[email protected] said:
just use Disconnect Pro instead, Adblock through KNOX.
Click to expand...
Click to collapse
Thank you for this! I missed adhell so much since it worked through Knox as well. Right now I'm running private dns on my phone from adguard and I'm going to use this app along with it as well.

Just go buy a Raspberry Pi Zero W and throw an SD card into it, install Pihole on it and VPN into your home network. Most modern routers have a VPN server built into them, Samsung phones all have a VPN client built in, and you can get a Pi Zero for $10 (or under $20 bundled with an MicroSD if you don't have one lying around from an old phone).
No root or special software on the phone end needed, and once the Pi is set up it's plug and play.
---------- Post added at 05:51 PM ---------- Previous post was at 05:40 PM ----------
sublimaze said:
Does it happen only on your home network? If so, are you using additional adblockers such as Pi-hole or dns.adguard..com as your router's default DNS?
Interesting that it happens only with mobile Chrome. Just another reason to stop using Chrome....
Click to expand...
Click to collapse
Chrome is purposely crippled to do this - there's even a dev flag to disable the behavior. It's the main reason I stopped using it and disabled it entirely. I went to Samsung's browser and have actually been really happy with it - the dark mode actually makes all web sites dark, even the ones that don't work with Chrome's.

Thank you.

Do you see any issues accessing very secure sites like banks thru the DNS blocks?

sublimaze said:
Does it happen only on your home network? If so, are you using additional adblockers such as Pi-hole or dns.adguard..com as your router's default DNS?
Interesting that it happens only with mobile Chrome. Just another reason to stop using Chrome....
Click to expand...
Click to collapse
rustyram02 said:
Do you see any issues accessing very secure sites like banks thru the DNS blocks?
Click to expand...
Click to collapse
If the blocker is doing its job correctly, it shouldn't have issues with any legit site. This actually protects you since most of the blockers also block malicious domains so if you accidentally click a phishing link it *might* keep you from getting to it.
The problems you WILL see if that sponsored results in search engines will stop working, because they route through an ad site rather than directly to the thing you want to go to. Once you get used to ignoring the top few results in Google, it's not so bad. There's also the issue of sites that block you if they detect an ad blocker. Most sites aren't smart enough to be able to detect a DNS based blocker, but if they are you will either not be able to use the site, or you'll need to turn the DNS blocker off or whitelist the site while you do.

Illrigger said:
If the blocker is doing its job correctly, it shouldn't have issues with any legit site. This actually protects you since most of the blockers also block malicious domains so if you accidentally click a phishing link it *might* keep you from getting to it.
The problems you WILL see if that sponsored results in search engines will stop working, because they route through an ad site rather than directly to the thing you want to go to. Once you get used to ignoring the top few results in Google, it's not so bad. There's also the issue of sites that block you if they detect an ad blocker. Most sites aren't smart enough to be able to detect a DNS based blocker, but if they are you will either not be able to use the site, or you'll need to turn the DNS blocker off or whitelist the site while you do.
Click to expand...
Click to collapse
Yeah I stopped clicking the top search results a long time ago. I was an avid AdGuard user, but their app used too much battery. I changed my default DNS to dns.adguard.com and it blocks ads as well as their app, without the battery hit.

In 2017, I purchased two Adguard lifetime licences for $10/each ($20 total), one of my best purchased ever! Now the same license is $70/each.
Have not had a need to root and still no ads on our phones for years now!