[General Questions and Answers] Lusty Rugnuts:
Ok! I finally got the firewall issues sorted. Apparently AFWall+ doesn't work well with the iptables on our phone (at /system/bin/iptables and /system/bin/ip6tables), and that was causing all sorts of problems in properly flushing the iptables chains when switching AFWall+ profiles. So I set AFWall+ to use its own in-built iptables.

Under:

AFWall+ Preferences > Experimental Features > Startup directory for script, I set it to /data/adb/service.d/

AFWall+ Preferences > Profiles > I enabled multiple profiles and 'Apply rules on profile switch'.

AFWall+ Preferences > Binaries > Iptables binary, I set it to 'Built-in iptables'.

AFWall+ Preferences > Binaries > BusyBox binary, I set it to 'Built-in BusyBox'.

At the top of my .sh scripts, I'd been using (taken from here):

# NECESSARY AT THE TOP OF EACH SCRIPT!

IP6=/system/bin/ip6tables

IP4=/system/bin/iptables

I changed it to:

# NECESSARY AT THE TOP OF EACH SCRIPT!

IP6=ip6tables

IP4=iptables

And I enabled:

[-12] (tethering) - DHCP+DNS services (dev.afwall.special.tether)

... and aside from Nebulo glitching and not passing DNS requests after an AFWall+ profile change (I have to stop Nebulo and start it for it to work... a bug report is in with the app's developer), everything seems to work!

I have 4 AFWall+ firewall profiles:

Default (bluwall_basic.sh): This is my main profile. It blocks all of Google. Read further up-thread to see why I'm blocking Google unless I want to visit the Play Store (and even then, I've used MyAndroidTools to lock down Google Play Services so most of its functionality is disabled).

Google (bluwall_google.sh): Allows Google. I use this on the rare occasion when I check Google Play Store for updates. Usually I use G-Droid.

Lockdown (bluwall_lockdown.sh): All outgoing packets are dropped. I use this to catch connection attempts without transiting any data.

Testing (no .sh file used): Allows everything through the firewall.

NOTE: Do remember that you have to save these files with Unix line-ending, so Notepad isn't going to work. I use TextPad.

My firewall rules, bluwall_basic.sh:

# This file is placed in /data/local/ as bluwall_basic.sh
# This file is to be used with the AFWall+ Default profile.
# In AFWall+, under 'Set custom script', enter: '. /data/local/bluwall_basic.sh' (without the quotes)

# NECESSARY AT THE TOP OF EACH SCRIPT!
IP6=ip6tables
IP4=iptables

# ACCEPT podcast app (now that the hosts file blocks ads)
# Put the UID of your podcast app after --uid-owner
$IP4 -I OUTPUT -m owner --uid-owner 10022 -j ACCEPT
$IP6 -I OUTPUT -m owner --uid-owner 10022 -j ACCEPT

# DROP invalid packets
$IP4 -A afwall -m state --state INVALID -j DROP
$IP6 -A afwall -m state --state INVALID -j DROP

# DROP ICMP Echo (PING)
$IP4 -A afwall -p icmp --icmp-type 0 -j DROP
$IP4 -A afwall -p icmp --icmp-type 8 -j DROP
$IP6 -A afwall -p icmpv6 --icmpv6-type 128 -j DROP
$IP6 -A afwall -p icmpv6 --icmpv6-type 129 -j DROP

# DROP uPNP
$IP4 -A afwall -p udp --dport 1900 -j DROP
$IP6 -A afwall -p udp --dport 1900 -j DROP

# DROP BOGONS
$IP4 -A afwall -d 0.0.0.0/8 -j DROP
$IP4 -A afwall -d 10.0.0.0/8 -j DROP
$IP4 -A afwall -d 100.64.0.0/10 -j DROP
$IP4 -A afwall -d 169.254.0.0/16 -j DROP
$IP4 -A afwall -d 172.16.0.0/12 -j DROP
$IP4 -A afwall -d 192.0.0.0/24 -j DROP
$IP4 -A afwall -d 192.0.2.0/24 -j DROP
$IP4 -A afwall -d 192.168.0.0/16 -j DROP
$IP4 -A afwall -d 198.18.0.0/15 -j DROP
$IP4 -A afwall -d 198.51.100.0/24 -j DROP
$IP4 -A afwall -d 203.0.113.0/24 -j DROP

# DROP Multicast and IANA assigned IP addresses
$IP4 -A afwall -d 224.0.0.0/3 -j DROP

# DROP Google
# https://bgp.he.net/search?search%5Bsearch%5D=google&commit=Search
# http://etmg.altervista.org/tools/aggregate.php
# ---------------
$IP4 -A afwall -d 8.8.4.0/24 -j DROP
$IP4 -A afwall -d 8.8.8.0/24 -j DROP
$IP4 -A afwall -d 8.34.208.0/20 -j DROP
$IP4 -A afwall -d 8.35.192.0/20 -j DROP
$IP4 -A afwall -d 23.228.128.0/18 -j DROP
$IP4 -A afwall -d 23.236.48.0/20 -j DROP
$IP4 -A afwall -d 23.251.128.0/19 -j DROP
$IP4 -A afwall -d 23.255.128.0/17 -j DROP
$IP4 -A afwall -d 34.64.0.0/11 -j DROP
$IP4 -A afwall -d 34.96.0.0/12 -j DROP
$IP4 -A afwall -d 35.184.0.0/13 -j DROP
$IP4 -A afwall -d 35.192.0.0/14 -j DROP
$IP4 -A afwall -d 35.196.0.0/15 -j DROP
$IP4 -A afwall -d 35.198.0.0/16 -j DROP
$IP4 -A afwall -d 35.199.0.0/17 -j DROP
$IP4 -A afwall -d 35.199.128.0/18 -j DROP
$IP4 -A afwall -d 35.200.0.0/13 -j DROP
$IP4 -A afwall -d 35.208.0.0/12 -j DROP
$IP4 -A afwall -d 35.224.0.0/12 -j DROP
$IP4 -A afwall -d 35.240.0.0/13 -j DROP
$IP4 -A afwall -d 41.189.230.0/24 -j DROP
$IP4 -A afwall -d 41.244.244.0/24 -j DROP
$IP4 -A afwall -d 45.56.0.0/18 -j DROP
$IP4 -A afwall -d 64.9.224.0/23 -j DROP
$IP4 -A afwall -d 64.9.227.0/24 -j DROP
$IP4 -A afwall -d 64.9.228.0/23 -j DROP
$IP4 -A afwall -d 64.9.232.0/21 -j DROP
$IP4 -A afwall -d 64.9.240.0/20 -j DROP
$IP4 -A afwall -d 64.18.0.0/23 -j DROP
$IP4 -A afwall -d 64.233.160.0/19 -j DROP
$IP4 -A afwall -d 66.102.0.0/20 -j DROP
$IP4 -A afwall -d 66.249.64.0/19 -j DROP
$IP4 -A afwall -d 70.32.128.0/19 -j DROP
$IP4 -A afwall -d 72.14.192.0/18 -j DROP
$IP4 -A afwall -d 74.114.24.0/21 -j DROP
$IP4 -A afwall -d 74.125.0.0/16 -j DROP
$IP4 -A afwall -d 84.235.77.0/24 -j DROP
$IP4 -A afwall -d 85.187.222.0/24 -j DROP
$IP4 -A afwall -d 89.207.224.0/24 -j DROP
$IP4 -A afwall -d 89.207.231.0/24 -j DROP
$IP4 -A afwall -d 99.198.128.0/17 -j DROP
$IP4 -A afwall -d 103.25.178.0/24 -j DROP
$IP4 -A afwall -d 104.132.0.0/14 -j DROP
$IP4 -A afwall -d 104.154.0.0/15 -j DROP
$IP4 -A afwall -d 104.196.0.0/14 -j DROP
$IP4 -A afwall -d 107.167.160.0/19 -j DROP
$IP4 -A afwall -d 107.178.192.0/18 -j DROP
$IP4 -A afwall -d 107.188.128.0/17 -j DROP
$IP4 -A afwall -d 108.59.80.0/20 -j DROP
$IP4 -A afwall -d 108.170.192.0/18 -j DROP
$IP4 -A afwall -d 108.177.0.0/17 -j DROP
$IP4 -A afwall -d 130.211.0.0/16 -j DROP
$IP4 -A afwall -d 136.22.0.0/23 -j DROP
$IP4 -A afwall -d 136.22.64.0/20 -j DROP
$IP4 -A afwall -d 136.22.80.0/22 -j DROP
$IP4 -A afwall -d 136.22.84.0/24 -j DROP
$IP4 -A afwall -d 136.22.86.0/23 -j DROP
$IP4 -A afwall -d 136.22.88.0/22 -j DROP
$IP4 -A afwall -d 136.22.116.0/22 -j DROP
$IP4 -A afwall -d 136.22.120.0/21 -j DROP
$IP4 -A afwall -d 136.32.0.0/11 -j DROP
$IP4 -A afwall -d 136.112.0.0/12 -j DROP
$IP4 -A afwall -d 142.250.0.0/15 -j DROP
$IP4 -A afwall -d 146.88.60.0/24 -j DROP
$IP4 -A afwall -d 146.148.0.0/17 -j DROP
$IP4 -A afwall -d 162.216.148.0/22 -j DROP
$IP4 -A afwall -d 162.222.176.0/21 -j DROP
$IP4 -A afwall -d 164.40.244.0/24 -j DROP
$IP4 -A afwall -d 172.102.8.0/21 -j DROP
$IP4 -A afwall -d 172.217.0.0/16 -j DROP
$IP4 -A afwall -d 172.253.0.0/16 -j DROP
$IP4 -A afwall -d 173.194.0.0/16 -j DROP
$IP4 -A afwall -d 173.255.112.0/20 -j DROP
$IP4 -A afwall -d 185.25.28.0/23 -j DROP
$IP4 -A afwall -d 185.25.30.0/24 -j DROP
$IP4 -A afwall -d 185.97.109.0/24 -j DROP
$IP4 -A afwall -d 185.97.110.0/24 -j DROP
$IP4 -A afwall -d 185.150.148.0/22 -j DROP
$IP4 -A afwall -d 192.104.160.0/23 -j DROP
$IP4 -A afwall -d 192.119.16.0/20 -j DROP
$IP4 -A afwall -d 192.158.28.0/22 -j DROP
$IP4 -A afwall -d 192.178.0.0/15 -j DROP
$IP4 -A afwall -d 192.200.224.0/19 -j DROP
$IP4 -A afwall -d 197.199.253.0/24 -j DROP
$IP4 -A afwall -d 197.199.254.0/24 -j DROP
$IP4 -A afwall -d 199.36.154.0/23 -j DROP
$IP4 -A afwall -d 199.36.156.0/24 -j DROP
$IP4 -A afwall -d 199.192.112.0/22 -j DROP
$IP4 -A afwall -d 199.223.232.0/21 -j DROP
$IP4 -A afwall -d 207.223.160.0/20 -j DROP
$IP4 -A afwall -d 208.68.108.0/22 -j DROP
$IP4 -A afwall -d 208.81.188.0/22 -j DROP
$IP4 -A afwall -d 209.85.128.0/17 -j DROP
$IP4 -A afwall -d 209.107.176.0/20 -j DROP
$IP4 -A afwall -d 216.21.160.0/20 -j DROP
$IP4 -A afwall -d 216.58.192.0/19 -j DROP
$IP4 -A afwall -d 216.239.32.0/19 -j DROP
$IP4 -A afwall -d 216.252.220.0/22 -j DROP
$IP6 -A afwall -d 2001:4860:4805::/48 -j DROP
$IP6 -A afwall -d 2001:4860::/32 -j DROP
$IP6 -A afwall -d 2400:6280:5::/48 -j DROP
$IP6 -A afwall -d 2401:fa00:41::/48 -j DROP
$IP6 -A afwall -d 2401:fa00:43::/48 -j DROP
$IP6 -A afwall -d 2401:fa00:44::/48 -j DROP
$IP6 -A afwall -d 2401:fa00::/32 -j DROP
$IP6 -A afwall -d 2404:6800:4001::/48 -j DROP
$IP6 -A afwall -d 2404:6800:4002::/48 -j DROP
$IP6 -A afwall -d 2404:6800:4003::/48 -j DROP
$IP6 -A afwall -d 2404:6800:4004::/48 -j DROP
$IP6 -A afwall -d 2404:6800:4005::/48 -j DROP
$IP6 -A afwall -d 2404:6800:4006::/48 -j DROP
$IP6 -A afwall -d 2404:6800:4007::/48 -j DROP
$IP6 -A afwall -d 2404:6800:4008::/48 -j DROP
$IP6 -A afwall -d 2404:6800:4009::/48 -j DROP
$IP6 -A afwall -d 2404:6800:400a::/48 -j DROP
$IP6 -A afwall -d 2404:6800::/32 -j DROP
$IP6 -A afwall -d 2600:1900::/28 -j DROP
$IP6 -A afwall -d 2604:ca00:100::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:101::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:102::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:103::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:104::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:105::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:108::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:110::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:111::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:112::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:113::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:114::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:115::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:118::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:11::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:120::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:121::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:122::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:123::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:124::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:125::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:12::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:12c::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:130::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:131::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:132::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:133::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:134::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:135::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:139::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:13::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:140::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:141::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:142::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:143::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:144::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:145::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:148::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:150::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:151::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:152::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:153::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:154::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:155::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:15a::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:15b::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:15c::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:160::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:161::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:162::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:163::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:164::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:165::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:170::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:171::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:172::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:173::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:174::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:175::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:17c::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:180::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:181::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:182::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:183::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:184::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:185::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:186::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:187::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:188::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:190::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:191::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:192::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:193::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:194::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:195::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:196::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:197::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:198::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1a0::/43 -j DROP
$IP6 -A afwall -d 2604:ca00:1c0::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1c1::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1c2::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1c3::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1c4::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1c5::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1c6::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1c7::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1c8::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1d0::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1d1::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1d2::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1d3::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1d4::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1d5::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1d6::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1d7::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1d8::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1e0::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1e1::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1e2::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1e3::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1e4::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1e5::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1e6::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1e7::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1e8::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1f0::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1f1::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1f2::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1f3::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1f4::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1f5::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1f6::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:1f7::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:2::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:3::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:4::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:6:1000::/52 -j DROP
$IP6 -A afwall -d 2604:ca00:6:3000::/52 -j DROP
$IP6 -A afwall -d 2604:ca00:6:4000::/52 -j DROP
$IP6 -A afwall -d 2604:ca00:6::/52 -j DROP
$IP6 -A afwall -d 2604:ca00:7::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:8::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:d000::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f000::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f001::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f002::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f003::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f004::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f005:2::/64 -j DROP
$IP6 -A afwall -d 2604:ca00:f005:4::/64 -j DROP
$IP6 -A afwall -d 2604:ca00:f005::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f006::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f007::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f008::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f011::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f012::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f013::/48 -j DROP
$IP6 -A afwall -d 2604:ca00:f::/48 -j DROP
$IP6 -A afwall -d 2605:a600::/31 -j DROP
$IP6 -A afwall -d 2605:a601::/32 -j DROP
$IP6 -A afwall -d 2605:ef80:100::/42 -j DROP
$IP6 -A afwall -d 2605:ef80:1c0::/42 -j DROP
$IP6 -A afwall -d 2605:ef80:200::/42 -j DROP
$IP6 -A afwall -d 2605:ef80:240::/42 -j DROP
$IP6 -A afwall -d 2605:ef80:300::/40 -j DROP
$IP6 -A afwall -d 2605:ef80:400::/42 -j DROP
$IP6 -A afwall -d 2605:ef80:600::/40 -j DROP
$IP6 -A afwall -d 2605:ef80:80::/42 -j DROP
$IP6 -A afwall -d 2605:ef80:900::/40 -j DROP
$IP6 -A afwall -d 2605:ef80::/32 -j DROP
$IP6 -A afwall -d 2605:ef80::/42 -j DROP
$IP6 -A afwall -d 2605:ef80:c0::/42 -j DROP
$IP6 -A afwall -d 2607:f8b0:4000::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4001::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4002::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4003::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4004::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4005::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4006::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4007::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4008::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4009::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:400a::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:400b::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:400c::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:400d::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:400e::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:400f::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4010::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4011::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4012::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4013::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4014::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4015::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0:4016::/48 -j DROP
$IP6 -A afwall -d 2607:f8b0::/32 -j DROP
$IP6 -A afwall -d 2620:0:1000::/40 -j DROP
$IP6 -A afwall -d 2620:15c::/36 -j DROP
$IP6 -A afwall -d 2620:f0:4000::/44 -j DROP
$IP6 -A afwall -d 2620:f0:4000::/48 -j DROP
$IP6 -A afwall -d 2620:f0:4001::/48 -j DROP
$IP6 -A afwall -d 2620:f0:4002::/48 -j DROP
$IP6 -A afwall -d 2800:3f0:4001::/48 -j DROP
$IP6 -A afwall -d 2800:3f0:4002::/48 -j DROP
$IP6 -A afwall -d 2800:3f0:4003::/48 -j DROP
$IP6 -A afwall -d 2800:3f0:4004::/48 -j DROP
$IP6 -A afwall -d 2800:3f0:4005::/48 -j DROP
$IP6 -A afwall -d 2800:3f0::/32 -j DROP
$IP6 -A afwall -d 2a00:1450::/32 -j DROP
$IP6 -A afwall -d 2a00:79e0:101::/48 -j DROP
$IP6 -A afwall -d 2a00:79e0::/32 -j DROP
$IP6 -A afwall -d 2a00:79e1:abc::/46 -j DROP
$IP6 -A afwall -d 2a03:ace0:100::/40 -j DROP
$IP6 -A afwall -d 2a03:ace0:300::/40 -j DROP
$IP6 -A afwall -d 2a03:ace0::/32 -j DROP
$IP6 -A afwall -d 2c0f:fb50:4002::/48 -j DROP
$IP6 -A afwall -d 2c0f:fb50:4003::/48 -j DROP
$IP6 -A afwall -d 2c0f:fb50::/32 -j DROP
# ---------------

My firewall rules, bluwall_google.sh:

# This file is placed in /data/local/ as bluwall_google.sh
# This file is to be used with the AFWall+ Google profile.
# In AFWall+, under 'Set custom script', enter: '. /data/local/bluwall_google.sh' (without the quotes)

# NECESSARY AT THE TOP OF EACH SCRIPT!
IP6=ip6tables
IP4=iptables

# DROP invalid packets
$IP4 -A afwall -m state --state INVALID -j DROP
$IP6 -A afwall -m state --state INVALID -j DROP

# DROP unwanted ICMP packets
$IP4 -A afwall -p icmp --icmp-type 0 -j DROP
$IP4 -A afwall -p icmp --icmp-type 8 -j DROP
$IP6 -A afwall -p icmpv6 --icmpv6-type 128 -j DROP
$IP6 -A afwall -p icmpv6 --icmpv6-type 129 -j DROP

# DROP uPNP
$IP4 -A afwall -p udp --dport 1900 -j DROP
$IP6 -A afwall -p udp --dport 1900 -j DROP

# DROP BOGONS
$IP4 -A afwall -d 0.0.0.0/8 -j DROP
$IP4 -A afwall -d 10.0.0.0/8 -j DROP
$IP4 -A afwall -d 100.64.0.0/10 -j DROP
$IP4 -A afwall -d 169.254.0.0/16 -j DROP
$IP4 -A afwall -d 172.16.0.0/12 -j DROP
$IP4 -A afwall -d 192.0.0.0/24 -j DROP
$IP4 -A afwall -d 192.0.2.0/24 -j DROP
$IP4 -A afwall -d 192.168.0.0/16 -j DROP
$IP4 -A afwall -d 198.18.0.0/15 -j DROP
$IP4 -A afwall -d 198.51.100.0/24 -j DROP
$IP4 -A afwall -d 203.0.113.0/24 -j DROP

# DROP Multicast and IANA assigned IP addresses
$IP4 -A afwall -d 224.0.0.0/3 -j DROP

My firewall rules, bluwall_lockdown.sh:

# This file is placed in /data/local/ as bluwall_lockdown.sh
# This file is to be used with the AFWall+ Lockdown profile.
# In AFWall+, under 'Set custom script', enter: '. /data/local/bluwall_lockdown.sh' (without the quotes)

# NECESSARY AT THE TOP OF EACH SCRIPT!
IP6=ip6tables
IP4=iptables

# DROP all
$IP4 -A afwall -d 0.0.0.0/0 -j DROP
$IP6 -A afwall -d ::/0 -j DROP