1

Does a person using an unrooted Android device have any options to successfully monitor and even restrict all network access; and have assurance that they are properly configured so that any allowed connections are routed through the Orbot/Orfox bundle? [LG K20: Android 7.0] Thank You!

Improve this question

1 Answer 1

Reset to default
1

The only approach to this is to use something like a "no-root" firewall. A "no-root" firewall uses the same principle as the Orbot VPN mode, except it uses it's position to deny connections to specific apps.

In this way, you could deny connections to all apps, except for Orbot effectively only allowing apps that can locally talk to Orbot be able to reach the internet, through Tor.

This would require that the apps are natively capable of utilising either an HTTP or SOCKS proxy and it has limitations, specifically ones that OrWall attempts to prevent. For example, the VPN might not be active during boot or before Orbot starts, which is why part of the OrWall design is to insert and init script to stop connections happening before the app can initialize and reconfigure the users iptables settings.

So there isn't something that is equivalent to OrWall without root, the closest solution would be some kind of "no-root" firewall.

Improve this answer
2
  • Cacahuatl: Thank you for responding. My confusion stems from not fully understanding the method(s) required to configure "native" System apps -- specifically Android System [UID: 0000?], LG apps, and Verizon apps -- to proxy via HTTP or SOCKS as you mentioned; or if this is even possible to do with these apps. I suspect that they are gaining network access via their own stealth ports, and will disregard any such customized routing(?). "Rooting" keeps revealing itself to be the way to appease most of my concerns, but I've formed the impression that I need firmer footing along this path...
    – gofigyour
    Commented Jan 28, 2018 at 0:36
  • You can specify a proxy to use under the network connection settings, when you're configuring which wireless interface to use and that might allow some apps to use it but if they don't have native proxy support then the method simply won't work for them, they will not be able to connect to the internet.
    – cacahuatl
    Commented Jan 28, 2018 at 0:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .