利用Iptables实现网络黑白名单防火墙怎么设置防火墙主要由服务访问规则、验证工具、包过滤和应用网关4个部分组成，防火墙就是一个位于计算机和它所连接的网络之间的软件或硬件。
这篇文章主要介绍了详解Android 利用Iptables实现网络黑白名单(防火墙),小编觉得挺不错的，现在分享给大家，也给大家做个参考。
一起跟随小编过来看看吧具体步骤二、Iptables网络黑白名单(防火墙)实现细节因为考虑到一些权限的问题所以在实现方法上采用的是创建一个systemserver来运行这些方法。
并提供出manager到三方应用，这样在调用时可以排除一些权限的限制。
同时本文只是做一个简单的参考概述，所以在后文中只提供了增加黑白名单的方法和iptables规则，并没有提供相应的删除规则等，原理类似大家可自行补充添加。
2.1、创建systemserver2.1.1、在/system/sepolicy/service.te中添加type fxjnet_service, system_api_service, system_server_service, service_manager_type;2.2.2、在/system/sepolicy/service_contexts中添加如下，fxjnet u:object_r:fxjnet_service:s02.2.3、在frameworks/base/core/java/android/content/Context.java中添加也可以不添加这个，只不过为了后面调用方便所以添加了。
如果跳过此步，那么后面出现Context.FXJNET_SERVICE的地方都用字串代替即可。
public static final String FXJNET_SERVICE="fxjnet";2.2.4、在/frameworks/base/core/java/android/app/SystemServiceRegi stry.java的静态代码块中添加如下代码注册service。
registerService(Context.FXJNET_SERVICE, FXJNETManager.class,new CachedServiceFetcher() {@Overridepublic FXJNETManager createService(ContextImpl ctx) {IBinder b = ServiceManager.getService(Context.FXJNET_SERVICE);IFXJNETService service = IFXJNETService.Stub.asInterface(b);return new FXJNETManager(ctx, service);}});2.2.5、在frameworks/base/services/java/com/android/server/SystemS erver.java中添加如下代码，将service加入systemserver中。
ServiceManager.addService(Context.FXJNET_SERVICE, new FXJNETService());2.2.6 、AIDL文件package android.os;interface IFXJNETService{void addNetworkRestriction(List ipName,int type);}2.2.7、提供给外部的FXJNETManagerpackage android.app;import android.os.IFXJNETService;import android.os.RemoteException;import android.content.Context;public class FXJNETManager{IFXJNETService mService;public FXJNETManager(Context ctx,IFXJNETService service){mService=service;}public void addNetworkRestriction(List ipName,int type) {try{mService.addNetworkRestriction(ipName,type); }catch (RemoteException e){}}//end addNetworkRestriction}2.2.8、系统服务即AIDL的实现server package com.android.server;import android.os.IFXJNETService;import java.io.File;import java.io.FileOutputStream;import java.io.IOException;public class FXJNETService extends IFXJNETService.Stub {final File file = new File("/data/fxj/", "firewall.sh");/*** 增加{网络IP访问}黑白名单数据*/public void addNetworkRestriction(List ipName,int type) {String str= getIPlist(type,ipName);setiptablesRestriction();}//构建Iptables的规则，1-黑名单;2-白名单private String getIPlist(int type,List iplist){ StringBuilder sb = new StringBuilder();sb.append("echo runscript start\n"); sb.append("iptables -F OUTPUT\n"); if (type == 1){if (iplist != null && iplist.size() > 0){ for (int i = 0 ; i < iplist.size() ;i++){String ipname = iplist.get(i);sb.append("echo blacklist mode\n"); sb.append("iptables -I OUTPUT -d ");sb.append(ipname);sb.append(" -j DROP\n");}}}else if (type == 2){if (iplist != null && iplist.size() > 0){for (int i = 0 ; i < iplist.size() ; i++){String ipname =iplist.get(i);sb.append("echo whitelist mode\n");sb.append("iptabless -P OUTPUT DROP\n");sb.append("iptables -I OUTPUT -d ");sb.append(ipname);sb.append(" -j ACCEPT\n");}}}sb.append("run script end\n");return sb.toString();}private void setiptablesRestriction(String ipName){final FXJScriptRunner runner = new FXJScriptRunner(file,ipName,new StringBuilder());new Thread(new Runnable() {@Overridepublic void run() {runner.run();}}).start();}}2.2.9、运行IPTABLES脚本命令的工具类package com.android.server; import java.io.File;import java.io.FileOutputStream;import java.io.IOException;import java.io.InputStream;import java.io.OutputStreamWriter;import android.os.FileUtils;import android.os.SystemProperties; import android.util.Log;public class FXJScriptRunner extends Thread{ private final File file;private final String script;private final StringBuilder res;public int exitcode = -1;private final String TAG = "ScriptRunner" ;public ScriptRunner(File file, String script, StringBuilder res,boolean asroot) {this.file = file;this.script = script;this.res = res;}@Overridepublic void run() {// TODO Auto-generated method stubtry {file.delete();file.createNewFile();final String abspath = file.getAbsolutePath();// make sure we have execution permission on the script fileFileUtils.setPermissions(abspath, 00700, -1, -1);Runtime.getRuntime().exec("chmod 777 " + abspath).waitFor();//给创建的sh文件设置权限// Write the script to be executedfinal OutputStreamWriter out = new OutputStreamWriter(new FileOutputStream(file));if (new File("/system/bin/sh").exists()) {out.write("#!/system/bin/sh\n");}out.write(script);if (!script.endsWith("\n"))out.write("\n");out.write("exit 0\n");out.flush();out.close();//通过SystemProperties.set("ctl.start", "fxjmotnitor")执行service，来运行脚本，//fxjmotnitor为service名称,可以根据自己的爱好随便叫SystemProperties.set("ctl.start", "fxjmotnitor");} catch (Exception ex) {if (res != null)res.append("\n" + ex);} finally {//destroy();}}}补充阅读：防火墙主要使用技巧一、所有的防火墙文件规则必须更改。