NetBlock is a per-application firewall that manages IPv4 and IPv6 output rules by Android UID through a root-module WebUI.
UID-Based Network Control
Block selected user or system applications without routing all device traffic through a local VPN.
Per-App Toggles
Lists installed user and system packages and updates the selected block state directly from the WebUI.
Rule Recovery
A background service checks the firewall every 30 seconds and rebuilds its chains if another component removes them.
Backup and Restore
Exports the configured block list as JSON in Downloads and can import it later from the same interface.
How the Firewall Works
NetBlock creates dedicated chains for iptables and ip6tables, inserts them at the start of each OUTPUT chain, and adds a DROP rule for every selected UID. Its persistent state is stored at /data/adb/netblock/blocked_uids.txt as UID and package-name pairs. The service validates the chains periodically and reapplies the saved list when necessary.
Installation
- Install the release ZIP from the modules page of Magisk, KernelSU, KernelSU Next, or APatch.
- Reboot the device after the manager reports a successful installation.
- Open NetBlock from the root manager's WebUI entry.
- Select user or system applications and enable the required block toggles.
Magisk does not provide a native module WebUI. Its users need a compatible standalone KernelSU WebUI host and must grant that host root access before opening the interface.
WebUI Controls
Refresh and Verify
Reload the package list or request an immediate check that the IPv4 and IPv6 chains are active.
Clear and Transfer
Remove all restrictions in one action, or export and restore the selection for maintenance and migration.
Limits and Interactions
The kernel must provide the iptables owner matcher, and another firewall can reorder or replace the same OUTPUT rules. NetBlock controls locally generated traffic only; it is not a VPN, DNS filter, tracker classifier, or guarantee that a blocked app cannot exchange data through another process with a different UID.