[Security Discussion] Mr.LOVER:
while i was asking the dev of xprivacy to include a function in xprivacy to force apps to use certain dns, thanks to a guy [MENTION=4293606]DualJoe[/MENTION] who told me to put this script in afwall,

$IPTABLES -t nat -D OUTPUT -p tcp --dport 53 -j DNAT --to-destination 208.67.222.222:53 || true
$IPTABLES -t nat -D OUTPUT -p udp --dport 53 -j DNAT --to-destination 208.67.222.222:53 || true
$IPTABLES -t nat -I OUTPUT -p tcp --dport 53 -j DNAT --to-destination 208.67.222.222:53
$IPTABLES -t nat -I OUTPUT -p udp --dport 53 -j DNAT --to-destination 208.67.222.222:53

i saw that above two lines are same as you included in your script but in kitkat it doesn't force opendns with only two lines, i included last two lines in your script for afwall and now my dns is always forced to opendns :)

so change your script to include those two extra lines, it's working now.

I'm using it on note 2, DN4 rom which is kitkat 4.4.4

here is the full script i am using.

# Necessary at the beginning of each script!
IP6TABLES=/system/bin/ip6tables
IPTABLES=/system/bin/iptables

## Force DNS (in this Case [OpenDNS](http://www.opendns.com/))
$IPTABLES -t nat -D OUTPUT -p tcp --dport 53 -j DNAT --to-destination 208.67.222.222:53 || true
$IPTABLES -t nat -D OUTPUT -p udp --dport 53 -j DNAT --to-destination 208.67.222.222:53 || true
$IPTABLES -t nat -I OUTPUT -p tcp --dport 53 -j DNAT --to-destination 208.67.222.222:53
$IPTABLES -t nat -I OUTPUT -p udp --dport 53 -j DNAT --to-destination 208.67.222.222:53

# Deny IPv6 only connections
$IP6TABLES -P INPUT DROP
$IP6TABLES -P OUTPUT DROP

#
# Google
$IPTABLES -A "afwall" --destination "8.8.8.8/32" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "8.8.4.4/32" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "64.233.0.0/16" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "66.102.0.0/16" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "66.249.0.0/16" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "72.14.0.0/16" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "74.125.0.0/16" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "173.194.0.0/16" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "209.85.0.0/16" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "216.239.0.0/16" -j "afwall-reject" || exit

#
# Others
$IPTABLES -A "afwall" --destination "23.4.92.33/32" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "23.32.0.0/11" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "23.64.0.0/14" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "23.253.56.120/32" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "64.207.128.0/18" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "68.232.32.0/20" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "91.103.140.0/24" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "104.16.0.0/12" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "104.64.0.0/10" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "116.214.0.0/16" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "118.214.0.0/16" -j "afwall-reject" || exit
$IPTABLES -A "afwall" --destination "198.232.125.88/32" -j "afwall-reject" || exit

#
# Turla
$IPTABLES -A "afwall" --destination "80.248.65.183/32" -j "afwall-reject" || exit

#
# Google
$IPTABLES -I INPUT -s 8.8.8.8/32 -j DROP || exit
$IPTABLES -I INPUT -s 8.8.4.4/32 -j DROP || exit
$IPTABLES -I INPUT -s 64.233.0.0/16 -j DROP || exit
$IPTABLES -I INPUT -s 66.102.0.0/16 -j DROP || exit
$IPTABLES -I INPUT -s 66.249.0.0/16 -j DROP || exit
$IPTABLES -I INPUT -s 72.14.0.0/16 -j DROP || exit
$IPTABLES -I INPUT -s 74.125.0.0/16 -j DROP || exit
$IPTABLES -I INPUT -s 173.194.0.0/16 -j DROP || exit
$IPTABLES -I INPUT -s 209.85.0.0/16 -j DROP || exit
$IPTABLES -I INPUT -s 216.239.0.0/16 -j DROP || exit

#
# Others
$IPTABLES -I INPUT -s 23.4.92.33/32 -j DROP || exit
$IPTABLES -I INPUT -s 23.32.0.0/11 -j DROP || exit
$IPTABLES -I INPUT -s 23.64.0.0/14 -j DROP || exit
$IPTABLES -I INPUT -s 23.253.56.120/32 -j DROP || exit
$IPTABLES -I INPUT -s 64.207.128.0/18 -j DROP || exit
$IPTABLES -I INPUT -s 68.232.32.0/20 -j DROP || exit
$IPTABLES -I INPUT -s 91.103.140.0/24 -j DROP || exit
$IPTABLES -I INPUT -s 104.16.0.0/12 -j DROP || exit
$IPTABLES -I INPUT -s 104.64.0.0/10 -j DROP || exit
$IPTABLES -I INPUT -s 116.214.0.0/16 -j DROP || exit
$IPTABLES -I INPUT -s 118.214.0.0/16 -j DROP || exit
$IPTABLES -I INPUT -s 198.232.125.88/32 -j DROP || exit

#
# Turla
$IPTABLES -I INPUT -s 80.248.65.183/32 -j DROP || exit

Edit:

you should also tell people to save the firewall script file as .sh file, and when put in /data/local/ it must be called in afwall custom script, so suppose my script name is firewallscript.sh and i put it in /data/local/

then i have to write this line in firewall custom script.

. /data/local/firewallscript.sh