Block internet access before firewall starts at boot I have an old Android phone with Ice Cream Sandwich and DroidWall as a firewall, which makes sure that apps can't use the 3G unless I enable it for that app. DroidWall starts on boot but there is a very brief time before it starts when any app can use the internet.

What I would like to do is stop all incoming and outgoing internet access until DroidWall automatically runs on boot to put the firewall rules in place. DroidWall allows running a script when it starts so conceivably I could undo the block-everything rules when it starts. The phone is rooted but doesn't have a /etc/init.d/. 

Basically I want to make sure there is not even a second that traffic can get out before the firewall. 3G is expensive but I need it so I can't turn it off.
Things have changed, DroidWall is no more maintained, rooting techniques have to be changed with Android 5 and 6 releases; particularly SELinux has to be taken care of, and there is always init.d support available with Magisk. But the question still stands valid.

Android depends on Linux kernel's builtin firewall which can be controlled with iptables. Default policy is ACCEPT which can be set to DROP on boot, unless all rules are loaded. This can be done with a simple init.d script or directly from Android's init services:

# /system/etc/init/firewall_policy.rc

on post-fs-data
    exec u:r:magisk:s0 -- /system/bin/iptables -P OUTPUT DROP


After boot, set policy back to ACCEPT. AFWall+ does this automatically.