[Nexus 5 Q&A, Help & Troubleshooting] wizechatmgr:
I'm trying to figure out what resource the carrier would be utilizing to modify the firewall rules on my phone... This worked quite some time ago. Reverted to latest stock. Doesn't work without root, and doesn't work with root. I lack the necessary experience with iptables to delete all the rules and set them up correctly. This isn't one of those add ,dun to the APN issues, been there done that. Also have tried setting the global config for that, no dice. I believe they're modifying the firewall on the phone and I'll be darned if I can figure out how they're doing it.

TXT dump of iptables --list below

Any idea folks?

Chain INPUT (policy ACCEPT)

target prot opt source destination

bw_INPUT all -- anywhere anywhere

fw_INPUT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)

target prot opt source destination

oem_fwd all -- anywhere anywhere

fw_FORWARD all -- anywhere anywhere

bw_FORWARD all -- anywhere anywhere

natctrl_FORWARD all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

oem_out all -- anywhere anywhere

fw_OUTPUT all -- anywhere anywhere

st_OUTPUT all -- anywhere anywhere

bw_OUTPUT all -- anywhere anywhere

Chain bw_FORWARD (1 references)

target prot opt source destination

Chain bw_INPUT (1 references)

target prot opt source destination

all -- anywhere anywhere ! quota globalAlert: 2097152 bytes

bw_costly_rmnet0 all -- anywhere anywhere

all -- anywhere anywhere owner socket exists

Chain bw_OUTPUT (1 references)

target prot opt source destination

all -- anywhere anywhere ! quota globalAlert: 2097152 bytes

bw_costly_rmnet0 all -- anywhere anywhere

all -- anywhere anywhere owner socket exists

Chain bw_costly_rmnet0 (2 references)

target prot opt source destination

bw_penalty_box all -- anywhere anywhere

REJECT all -- anywhere anywhere ! quota rmnet0: 9223372036854775807 bytes reject-with icmp-port-unreachable

Chain bw_costly_shared (0 references)

target prot opt source destination

bw_penalty_box all -- anywhere anywhere

Chain bw_happy_box (0 references)

target prot opt source destination

Chain bw_penalty_box (2 references)

target prot opt source destination

Chain fw_FORWARD (1 references)

target prot opt source destination

Chain fw_INPUT (1 references)

target prot opt source destination

fw_standby all -- anywhere anywhere

Chain fw_OUTPUT (1 references)

target prot opt source destination

fw_standby all -- anywhere anywhere

Chain fw_dozable (0 references)

target prot opt source destination

RETURN all -- anywhere anywhere owner UID match 0-9999

DROP all -- anywhere anywhere

Chain fw_standby (2 references)

target prot opt source destination

DROP all -- anywhere anywhere owner UID match u0_a0

DROP all -- anywhere anywhere owner UID match u0_a9

DROP all -- anywhere anywhere owner UID match u0_a10

DROP all -- anywhere anywhere owner UID match u0_a13

DROP all -- anywhere anywhere owner UID match u0_a14

DROP all -- anywhere anywhere owner UID match u0_a16

DROP all -- anywhere anywhere owner UID match u0_a17

DROP all -- anywhere anywhere owner UID match u0_a18

DROP all -- anywhere anywhere owner UID match u0_a19

DROP all -- anywhere anywhere owner UID match u0_a21

DROP all -- anywhere anywhere owner UID match u0_a22

DROP all -- anywhere anywhere owner UID match u0_a23

DROP all -- anywhere anywhere owner UID match u0_a24

DROP all -- anywhere anywhere owner UID match u0_a25

DROP all -- anywhere anywhere owner UID match u0_a26

DROP all -- anywhere anywhere owner UID match u0_a27

DROP all -- anywhere anywhere owner UID match u0_a28

DROP all -- anywhere anywhere owner UID match u0_a31

DROP all -- anywhere anywhere owner UID match u0_a33

DROP all -- anywhere anywhere owner UID match u0_a34

DROP all -- anywhere anywhere owner UID match u0_a37

DROP all -- anywhere anywhere owner UID match u0_a38

DROP all -- anywhere anywhere owner UID match u0_a39

DROP all -- anywhere anywhere owner UID match u0_a40

DROP all -- anywhere anywhere owner UID match u0_a44

DROP all -- anywhere anywhere owner UID match u0_a46

DROP all -- anywhere anywhere owner UID match u0_a47

DROP all -- anywhere anywhere owner UID match u0_a48

DROP all -- anywhere anywhere owner UID match u0_a50

DROP all -- anywhere anywhere owner UID match u0_a51

DROP all -- anywhere anywhere owner UID match u0_a52

DROP all -- anywhere anywhere owner UID match u0_a53

DROP all -- anywhere anywhere owner UID match u0_a54

DROP all -- anywhere anywhere owner UID match u0_a56

DROP all -- anywhere anywhere owner UID match u0_a57

DROP all -- anywhere anywhere owner UID match u0_a59

DROP all -- anywhere anywhere owner UID match u0_a61

DROP all -- anywhere anywhere owner UID match u0_a67

DROP all -- anywhere anywhere owner UID match u0_a68

DROP all -- anywhere anywhere owner UID match u0_a69

DROP all -- anywhere anywhere owner UID match u0_a70

DROP all -- anywhere anywhere owner UID match u0_a71

DROP all -- anywhere anywhere owner UID match u0_a74

DROP all -- anywhere anywhere owner UID match u0_a76

DROP all -- anywhere anywhere owner UID match u0_a77

DROP all -- anywhere anywhere owner UID match u0_a78

DROP all -- anywhere anywhere owner UID match u0_a79

DROP all -- anywhere anywhere owner UID match u0_a80

DROP all -- anywhere anywhere owner UID match u0_a81

DROP all -- anywhere anywhere owner UID match u0_a82

DROP all -- anywhere anywhere owner UID match u0_a84

DROP all -- anywhere anywhere owner UID match u0_a85

DROP all -- anywhere anywhere owner UID match u0_a86

DROP all -- anywhere anywhere owner UID match u0_a89

Chain natctrl_FORWARD (1 references)

target prot opt source destination

DROP all -- anywhere anywhere

Chain natctrl_tether_counters (0 references)

target prot opt source destination

Chain oem_fwd (1 references)

target prot opt source destination

Chain oem_out (1 references)

target prot opt source destination

Chain st_OUTPUT (1 references)

target prot opt source destination

Chain st_clear_caught (2 references)

target prot opt source destination

Chain st_clear_detect (0 references)

target prot opt source destination

REJECT all -- anywhere anywhere connmark match 0x2000000/0x2000000 reject-with icmp-port-unreachable

RETURN all -- anywhere anywhere connmark match 0x1000000/0x1000000

CONNMARK tcp -- anywhere anywhere u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x0&0xffff0000=0x16030000&&0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x4&0xff0000=0x10000" CONNMARK or 0x1000000

CONNMARK udp -- anywhere anywhere u32 "0x0>>0x16&0x3c@0x8&0xffff0000=0x16fe0000&&0x0>>0x16&0x3c@0x14&0xff0000=0x10000" CONNMARK or 0x1000000

RETURN all -- anywhere anywhere connmark match 0x1000000/0x1000000

st_clear_caught tcp -- anywhere anywhere state ESTABLISHED u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x0&0x0=0x0"

st_clear_caught udp -- anywhere anywhere

Chain st_penalty_log (0 references)

target prot opt source destination

CONNMARK all -- anywhere anywhere CONNMARK or 0x1000000

NFLOG all -- anywhere anywhere

Chain st_penalty_reject (0 references)

target prot opt source destination

CONNMARK all -- anywhere anywhere CONNMARK or 0x2000000

NFLOG all -- anywhere anywhere

REJECT all -- anywhere anywhere reject-with icmp-port-unreachable