[Xperia Z3 Q&A, Help & Troubleshooting] petriasikainen:
I'm having some wierd connection problems. DNS names are not resolved.

My phone is unlocked z3, rooted and installed DRM patch.

After debugging this connection issue, first I found dns blocking rules on iptables chain and reason for those rules was /data/system/apfd/prototype-prot_updatechain.script what contains lot's of entries like:

*filter
: OUTPUT_prototype-prot_INSERT - [0:0]
: OUTPUT_prototype-prot_APPEND - [0:0]
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |07|digi-wo|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |09|winrumors|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0b|pointgphone|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0b|gsmhelpdesk|02|nl --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0e|allaboutphones|02|nl --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0b|unwiredview|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0d|mobile-review|02|ru --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |05|wired|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0c|mobilecrunch|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |09|seinsider|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |05|mobil|02|nu --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0c|phonesreview|02|co|02|uk --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |02|3g|02|co|02|uk --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0a|xperiablog|03|net --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |05|xblog|02|gr --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |03|zol|03|com|02|cn --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |04|smhn|04|info --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |06|ameblo|02|jp --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0a|youserblog|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |06|webkit|03|org --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |09|devicemag|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |05|esato|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |06|forums|06|se-nse|03|net --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |12|myandroidlife4ever|08|blogspot|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |07|kunkoku|08|livedoor|03|biz --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |09|html5test|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0c|sonyericsson|02|co|02|jp --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |06|eprice|03|com|02|hk --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0f|android-schweiz|02|ch --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0a|androinica|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |08|nixanbal|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |08|semcblog|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |06|mobile|08|engadget|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |08|mobile01|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |09|pocketnow|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |06|eprice|03|com|02|cn --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |09|xperiax10|03|net --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |07|android|05|tgbus|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |0d|mobile-review|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |03|mpw|02|jp --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |08|gsmarena|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |09|droidnytt|02|no --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |06|eprice|03|com|02|tw --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |08|swedroid|02|se --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |07|gizmodo|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |05|rbmen|08|blogspot|02|jp --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |05|forum|0a|gsmhosting|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |06|forum7|08|hkgolden|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |05|mobil|02|se --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |04|spec|03|org --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |05|forum|0e|xda-developers|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |05|sebbs|05|it168|03|com --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |06|juggly|02|cn --algo bm -j DROP
-A OUTPUT_prototype-prot_APPEND -p udp --dport 53 -m string --hex-string |05|index|02|hu --algo bm -j DROP
COMMIT

If I flush iptables chain with

iptables -F OUTPUT_prototype-prot_APPEND

all connections are working fine.

But after reboot, rules come back. And connection issues.

I have tried to remove prototype-prot_updatechain.script from root command line, but it come back after boot.

Tried to modify rules on file, but it contents get restored on reboot.

So my question's are:

1. How to get rid of those iptable rules?

2. What purpose /system/bin/apfd serve on lollipop?