[Security Discussion] Applied Protocol:
here is a full iptables script

#!system/bin/sh
###################################
#
# File name paranoidfw.sh
# Iptables secure paranoid Firewal script for Android
# Loging Everything With DNS protection
# By Applied Protocol
#
###################################
#

IPTABLES=system/bin/iptables
IP6TABLES=system/bin/ip6tables

# DNS servers
DNS_SERVER="1.1.1.1 1.0.0.1"
DNS_SERVER6="2606:4700:4700::1001 2606:4700:4700::1111"

# Block IP
BAD_IP=" "
BAD_DNS="39.39.39.39 182.176.100.141"

### INPUT Chain

# Start with New Rules
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -X
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -F -t mangle
$IPTABLES -t mangle -X
$IP6TABLES -F
$IP6TABLES -F -t nat
$IP6TABLES -X
$IP6TABLES -P INPUT DROP
$IP6TABLES -P OUTPUT DROP
$IP6TABLES -P FORWARD DROP
$IP6TABLES -F -t mangle
$IP6TABLES -t mangle -X

## Connection Tracking
$IPTABLES -A INPUT -m state --state INVALID -j NFLOG --log-prefix "DROP INVALID" --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IP6TABLES -A INPUT -m state --state INVALID -j NFLOG --log-prefix "DROP INVALID" --log-ip-options --log-tcp-options
$IP6TABLES -A INPUT -m state --state INVALID -j DROP
$IP6TABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

### INPUT Chain

## Block IP
for ip in $BAD_IP
do
$IPTABLES -A INPUT -s $ip -m state --state NEW -j NFLOG --log-prefix "DROP Bad IP NEW" --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -s $ip -m state --state NEW -j DROP
$IPTABLES -A INPUT -s $ip -m state --state ESTABLISHED,RELATED -j NFLOG --log-prefix "DROP Bad IP EST" --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -s $ip -m state --state ESTABLISHED,RELATED -j DROP
done

## Block Bad DNS
for ip in $BAD_DNS
do
$IPTABLES -A INPUT -p udp -s $ip --dport 53 -m state --state NEW -j NFLOG --log-prefix "DROP Bad DNS NEW" --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -p udp -s $ip --dport 53 -m state --state NEW -j DROP
$IPTABLES -A INPUT -p tcp -s $ip --dport 53 -m state --state NEW -j NFLOG --log-prefix "DROP Bad DNS NEW" --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -p tcp -s $ip --dport 53 -m state --state NEW -j DROP
$IPTABLES -A INPUT -p udp -s $ip --dport 53 -m state --state ESTABLISHED,RELATED -j NFLOG --log-prefix "DROP Bad DNS EST" --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -p udp -s $ip --dport 53 -m state --state ESTABLISHED,RELATED -j DROP
$IPTABLES -A INPUT -p tcp -s $ip --dport 53 -m state --state ESTABLISHED,RELATED -j NFLOG --log-prefix "DROP Bad DNS EST" --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -p tcp -s $ip --dport 53 -m state --state ESTABLISHED,RELATED -j DROP
done

## Selected DNS
for ip in $DNS_SERVER
do
$IPTABLES -A INPUT -p tcp -s $ip --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p tcp -s $ip --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
done

for ip in $DNS_SERVER6
do
$IP6TABLES -A INPUT -p tcp -s $ip --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IP6TABLES -A INPUT -p tcp -s $ip --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
done

### default INPUT LOG rule
$IPTABLES -A INPUT ! -i lo -j NFLOG --log-prefix "DROP" --log-ip-options --log-tcp-options

## Make sure that loopback traffic is accepted
$IPTABLES -A INPUT -s 127.0.0.1 -j -j NFLOG --log-prefix "LoopBack" --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -s 127.0.0.1 -j ACCEPT

### OUTPUT Chain

## Block IP
for ip in $BAD_IP
do
$IPTABLES -A OUTPUT -d $ip -m state --state NEW -j NFLOG --log-prefix "DROP Bad REQ NEW" --log-ip-options --log-tcp-options
$IPTABLES -A OUTPUT -d $ip -m state --state NEW -j DROP
$IPTABLES -A OUTPUT -d $ip -m state --state ESTABLISHED,RELATED -j NFLOG --log-prefix "DROP Bad IP REQ EST" --log-ip-options --log-tcp-options
$IPTABLES -A OUTPUT -d $ip -m state --state ESTABLISHED,RELATED -j DROP
done

## Block Bad DNS
for ip in $BAD_DNS
do
$IPTABLES -A OUTPUT -p udp -d $ip --dport 53 -m state --state NEW -j NFLOG --log-prefix "Bad DNS NEW udp" --log-ip-options --log-tcp-options
$IPTABLES -A OUTPUT -p udp -d $ip --dport 53 -m state --state NEW -j DROP
$IPTABLES -A OUTPUT -p udp -d $ip --dport 53 -m state --state ESTABLISHED,RELATED -j NFLOG --log-prefix "DROP Bad DNS EST " --log-ip-options --log-tcp-options
$IPTABLES -A INPUT -p tcp -d $ip --dport 53 -m state --state ESTABLISHED,RELATED -j DROP
done

## Selected DNS
for ip in $DNS_SERVER
do
$IPTABLES -A OUTPUT -p udp -d $ip --dport 53 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -d $ip --dport 53 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport 53 -j NFLOG --log-prefix "Other DNS REQ" --log-ip-options --log-tcp-options
$IPTABLES -A OUTPUT -p tcp --dport 53 -j NFLOG --log-prefix "Other DNS REQ" --log-ip-options --log-tcp-options

$IPTABLES -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to-destination $ip:53
$IPTABLES -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination $ip:53
done

for ip in $DNS_SERVER6
do
$IP6TABLES -A OUTPUT -p udp -d $ip --dport 53 -m state --state NEW -j ACCEPT
$IP6TABLES -A OUTPUT -p tcp -d $ip --dport 53 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport 53 -j NFLOG --log-prefix "Other DNS REQ" --log-ip-options --log-tcp-options
$IPTABLES -A OUTPUT -p tcp --dport 53 -j NFLOG --log-prefix "Other DNS REQ" --log-ip-options --log-tcp-options
$IP6TABLES -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to-destination $ip:53
$IP6TABLES -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination $ip:53
done
exit
### EOF ###

To explain this script is mainly a DNS script it changes over your DNS requests to a different ip it does need NAT for ipv4 and ipv6 compiled in the kernel.

All logging is done with all the info of the packet (not pcap)

First define your good DNS and bad DNS and other ip to block (if blank comment it out with # in the commands below) do not use ip for DNS the loggs willnot be clear

Then we start from fresh iptables chains and zeroing the chains

next is connection tracking turned on so unsolicited requests do not work it will drop and log

Bad ip and bad DNS ip both block ip for DNS this is only port 53 it will drop and log new connections and old ones it logs them separately

Selected DNS is the preferred DNS servers only to be allowed in unless it is requested this allows only old connections

any non requested (new) connections are dropped and logged

loopback is allowed and logged also

the same idea is in the OUTPUT tables

Any other DNS requests are logged and passed on to be ip changed.

That said the script is used by checking the logs (a colored log viewer helps!) and seeing how many times the rules where hit this can be done with

iptables -L
ip6tables -L

If you do believe that someone is using NSA tech on you I would save the phone image with abd and dd and share it with the security community (first saving your data and deleting it temporary)