Block internet access before firewall starts at boot
Things have changed, DroidWall is no more maintained, rooting techniques have to be changed with Android 5 and 6 releases; particularly SELinux has to be taken care of, and there is always init.d support available with Magisk. But the question still stands valid.

Android depends on Linux kernel's builtin firewall which can be controlled with iptables. Default policy is ACCEPT which can be set to DROP on boot, unless all rules are loaded. This can be done with a simple init.d script or directly from Android's init services:

# /system/etc/init/firewall_policy.rc

on post-fs-data
    exec u:r:magisk:s0 -- /system/bin/iptables -P OUTPUT DROP


After boot, set policy back to ACCEPT. AFWall+ does this automatically.