WiFi tethering with OpenVPN for Android - Android Q&A, Help & Troubleshooting
Download a terminal client, e.g. ConnectBot and connect to your local shell.
Enter `su` to become root. (Double check with whoami afterwards).
Enable wifi tethering and ensure your data connection is working (connect to VPN)
Run `netcfg` and note your interface names (typically tun0 and wlan0 (ignore m.wlan0 or similar, only take the one with a real mac address), as is on my SGSII)
Double check the subnet for your wlan0 device and enter the following commands:
iptables -A POSTROUTING -s 192.168.43.0/24 -j MASQUERADE -t nat
(setup a postrouting entry for the tethered devices subnet, implementing NAT)
iptables -A FORWARD -j ACCEPT -i wlan0 -o tun0
forward packets from tethered devices across the tunnel
iptables -A FORWARD -j ACCEPT -i tun0 -o wlan0
forward packets from the tunnel to the tethered devices
Note, because you are using NAT, you will need to configure port forwards on your Android device to be able to run servers etc on tethered devices. Unlikely you'll need to worry about that though. Feedback if it worked or not. Posting this now from my home IP thanks to OpenVPN for Android and these iptable rules!
deed02392 said:
Download a terminal client, e.g. ConnectBot and connect to your local shell.
Enter `su` to become root. (Double check with whoami afterwards).
Enable wifi tethering and ensure your data connection is working (connect to VPN)
Run `netcfg` and note your interface names (typically tun0 and wlan0 (ignore m.wlan0 or similar, only take the one with a real mac address), as is on my SGSII)
Double check the subnet for your wlan0 device and enter the following commands:
iptables -A POSTROUTING -s 192.168.43.0/24 -j MASQUERADE -t nat
(setup a postrouting entry for the tethered devices subnet, implementing NAT)
iptables -A FORWARD -j ACCEPT -i wlan0 -o tun0
forward packets from tethered devices across the tunnel
iptables -A FORWARD -j ACCEPT -i tun0 -o wlan0
forward packets from the tunnel to the tethered devices
Note, because you are using NAT, you will need to configure port forwards on your Android device to be able to run servers etc on tethered devices. Unlikely you'll need to worry about that though. Feedback if it worked or not. Posting this now from my home IP thanks to OpenVPN for Android and these iptable rules!
Click to expand...
Click to collapse
I'm complete newbie here, just want to ask, is this change permanent? Can I revert back to the default iptables? How to forward using usb tethering?
quick response
deed02392 said:
Download a terminal client, e.g. ConnectBot and connect to your local shell.
Enter `su` to become root. (Double check with whoami afterwards).
Enable wifi tethering and ensure your data connection is working (connect to VPN)
Run `netcfg` and note your interface names (typically tun0 and wlan0 (ignore m.wlan0 or similar, only take the one with a real mac address), as is on my SGSII)
Double check the subnet for your wlan0 device and enter the following commands:
iptables -A POSTROUTING -s 192.168.43.0/24 -j MASQUERADE -t nat
(setup a postrouting entry for the tethered devices subnet, implementing NAT)
iptables -A FORWARD -j ACCEPT -i wlan0 -o tun0
forward packets from tethered devices across the tunnel
iptables -A FORWARD -j ACCEPT -i tun0 -o wlan0
forward packets from the tunnel to the tethered devices
Note, because you are using NAT, you will need to configure port forwards on your Android device to be able to run servers etc on tethered devices. Unlikely you'll need to worry about that though. Feedback if it worked or not. Posting this now from my home IP thanks to OpenVPN for Android and these iptable rules!
Click to expand...
Click to collapse
Hi there...
I'm a total rookie, I just follow instructions carefully.
I've been searching for a solution to this problem on my s3mini
Rooted.
I used Terminal Emulator, still my wifi connected laptop didn't connect to the internet. My openvpn log showed something like routes adding and stuff
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
still didn't work
Then I used ConnectBot to retry the same exact steps, still nothing happened
On my phone, i think the subnet is 192.168.43.1/24. Do you think that could be a reason it did not work?
I've tried so many options so far for this issue.
I really hope you come back to this thread.
I've read dozens of these threads and pages on making this work and I can't do it I just can't figure it out, is there something different on 6.0 Marshmallow I know there's no netcfg I've been using ip link show
HELP
I tried this solution to hide my tether usage from ThreeUK. While it did work I was having some evil DNS issues. I could download at a few mb/s but then would take 180 seconds to load some basic pages etc.
However, thinking upon it I realised you don't even need to use a VPN client to hide the usage, just use the same method as OP posted but send all traffic via wlan0.
Worked perfectly all week for me, streamed a good 5gb of TV and if I need a VPN I can iniate the VPN on the end device.
---------- Post added at 03:45 PM ---------- Previous post was at 03:43 PM ----------
Works with USB Tethering too, and bluetooth
Obviously change IP/Adapter names etc.
Pantho86 said:
However, thinking upon it I realised you don't even need to use a VPN client to hide the usage, just use the same method as OP posted but send all traffic via wlan0.
Click to expand...
Click to collapse
Apologies for resurrecting an old thread, but is this still working for you? Would it be possible for you to provide some instructions as it isn't clear what commands you've used.
Apologies but I cannot test it anymore as I'm not wanting to root my Nexus device, I enjoy using Android Pay & My Banking app too much.
Now if I'm remembering correctly I ran as :
Code:
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
ip rule add from 192.168.43.0/24 lookup 61
ip route add default dev rmnet0 scope link table 61
ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
The only issues I was having was when using dual-3g connections, there are 2 connections outgoing in those scenarios and sometimes Three will say "Tether limit hit", at that point just turn flight mode off/on to toggle the connection and rerun the routing.
Read the thread I linked and poke at it for a while, you should be able to get it working. This was the only way I managed to hide wifi tether usage. USB tethering for Windows & Unix is easy enough to hide with free apps, but for a chromebook or other such devices it's trickier and this is the only way.
(I had to remove the link, XDA blocked it... google wifi tether iptables and it's the thread on digiex)
OK that's great, thanks.
Pantho86 said:
I tried this solution to hide my tether usage from ThreeUK. While it did work I was having some evil DNS issues. I could download at a few mb/s but then would take 180 seconds to load some basic pages etc.
However, thinking upon it I realised you don't even need to use a VPN client to hide the usage, just use the same method as OP posted but send all traffic via wlan0.
Worked perfectly all week for me, streamed a good 5gb of TV and if I need a VPN I can iniate the VPN on the end device.
---------- Post added at 03:45 PM ---------- Previous post was at 03:43 PM ----------
Works with USB Tethering too, and bluetooth
Obviously change IP/Adapter names etc.
Click to expand...
Click to collapse
Hey... I was just wondering how you modified the original commands to get tethering to work undetected without VPN. I've been trying to figure this out for weeks!
Related
Stealthy free USB Tether technique using IPTABLES
Ok, let me start by saying this Photon has a LOT of potential... Anyways, a little tinkering and hacking and I noticed a few interesting little tidbits. First, the easy to use Phone Portal feature look rather interesting. Pretty interesting how we can just automagically surf a web page put out by the phone... Oh wait, that would require DHCP and a USBnet Modem wouldn't it? Kinda. It does use a Motorola Network driver to mimick something similar to the linux usbnet drivers. So as long as you have your Motorola drivers installed on the PC, it'll still launch this portal. Now I already knew that iptables was installed. So the question now is can this interface be NAT'ed to allow internet access through the phone without installing any software? The answer, yes. First root the phone and then when you're logged in you'll want to do the following: Code: mount -o remount,rw /dev/block/mmcblk0p12 /system echo 1 > /proc/sys/net/ipv4/ip_forward [I]#Temporarily allow packet forwarding[/I] [I]# Permanently allow packet forwarding[/I] vi /etc/sysctl.conf [I]# uncomment the line #net.ipv4.ip_forward=1[/I] vi /etc/rc.local [I]# Add the following lines after the line that reads iptables -A OUTPUT -p tcp --dport 8085 -d localhost -m owner ! --uid-owner adas -j REJECT[/I] iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE iptables -A FORWARD -i ppp0 -o usb0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i usb0 -o ppp0 -j ACCEPT mount -o remount,ro /dev/block/mmcblk0p12 /system Note: You may need to set the default route of 192.168.16.2 on your computer. You'll also want to set your DNS servers to 4.4.4.4 and 8.8.8.8 (Google) so that you can do DNS queries. DHCP config coming soon once I figure it out. Once this modification is done, all you need to do is have your phone in the Motorola Phone Portal Mode and plug it into your computer. Your computer will automatically recognize the network connection, utilize DHCP, and establish an internet connection. Hoozah, USB tethering with no apps, no fuss, and ... no $30 a month.
Good post, now I wonder if we can get this working with Ubuntu. I don't have the ability to try yet. But I may later tonight. Thanks for the heads up.
These are shell commands, its not as simple as you'd think to build an aol to do this. And I would guess it only has to be done once unless the phone resets this stuff on reboot... Sent from my MB855 using xda premium
Yep, only needs to be done once. That's why I put the "temporarily changes" and the "permanently changes" in there. A note though, local.rc does get updated during patches, so if you take an OTA upgrade, you'll need to redo these steps to get it working again. No more or less so than you would if you needed to recover root. One of the reasons I posted this here... that way it's documented and if I forget in the future, I can search this site to learn how it's done again.
khawk said: Ok, let me start by saying this Photon has a LOT of potential... Anyways, a little tinkering and hacking and I noticed a few interesting little tidbits. First, the easy to use Phone Portal feature look rather interesting. Pretty interesting how we can just automagically surf a web page put out by the phone... Oh wait, that would require DHCP and a USBnet Modem wouldn't it? Kinda. It does use a Motorola Network driver to mimick something similar to the linux usbnet drivers. So as long as you have your Motorola drivers installed on the PC, it'll still launch this portal. Now I already knew that iptables was installed. So the question now is can this interface be NAT'ed to allow internet access through the phone without installing any software? The answer, yes. First root the phone and then when you're logged in you'll want to do the following: Code: mount -o remount,rw /dev/block/mmcblk0p12 /system echo 1 > /proc/sys/net/ipv4/ip_forward [I]#Temporarily allow packet forwarding[/I] [I]# Permanently allow packet forwarding[/I] vi /etc/sysctl.conf [I]# uncomment the line #net.ipv4.ip_forward=1[/I] vi /etc/rc.local [I]# Add the following lines after the line that reads iptables -A OUTPUT -p tcp --dport 8085 -d localhost -m owner ! --uid-owner adas -j REJECT[/I] iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE iptables -A FORWARD -i ppp0 -o usb0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i usb0 -o ppp0 -j ACCEPT mount -o remount,ro /dev/block/mmcblk0p12 /system Note: You may need to set the default route of 192.168.16.2 on your computer. Once this modification is done, all you need to do is have your phone in the Motorola Phone Portal Mode and plug it into your computer. Your computer will automatically recognize the network connection, utilize DHCP, and establish an internet connection. Hoozah, USB tethering with no apps, no fuss, and ... no $30 a month. Click to expand... Click to collapse Hi, I tried everything you've said and can't seem to get an internet connection via tether. First of all, what exactly do you mean, "Note: You may need to set the default route of 192.168.16.2 on your computer"? Do you mean in the IPv4 settings for the Motorola USB Modem on the laptop, to set the Default Gateway and DNS to 192.168.16.2? If so, I've tried this, and still can't see to get an internet connection. What happens is it tries to load a page, then comes back with an error that it cannot resolve a DNS. Has anyone else had success with this? I'm pretty sure I've edited the files exactly as he's suggested here...
BallCity said: Hi, I tried everything you've said and can't seem to get an internet connection via tether. First of all, what exactly do you mean, "Note: You may need to set the default route of 192.168.16.2 on your computer"? Do you mean in the IPv4 settings for the Motorola USB Modem on the laptop, to set the Default Gateway and DNS to 192.168.16.2? If so, I've tried this, and still can't see to get an internet connection. What happens is it tries to load a page, then comes back with an error that it cannot resolve a DNS. Has anyone else had success with this? I'm pretty sure I've edited the files exactly as he's suggested here... Click to expand... Click to collapse I revised the original post to include DNS config. Opps, overlooked that one.
Can you please specifically show which settings to change in Windows 7 to change the default route and DNS servers? I THINK I've changed the settings in the correct place but my computer does not get an internet connection.
gollyzila said: Can you please specifically show which settings to change in Windows 7 to change the default route and DNS servers? I THINK I've changed the settings in the correct place but my computer does not get an internet connection. Click to expand... Click to collapse Something as follows: * Put the phone into Motorola Phone Portal mode [After making the edits outlined above] * Goto: Control Panel\Network and Internet\Network Connections * Right-Click and Click Properties on Motorola USB Networking Driver (With a name something like Local Area Connection ##) * Click on "Internet Protocol Version 4 (TCP/IPv4) and then click the 'Properties' Button * Set it up to look like this: h_ttp://i.imgur.com/8w1S0.png [Won't let me post outside links, so you can figure out how to make that work.] All done! I've gotten it working now. I think the issue I had before was with the edits I made. Initially I tried editing the files using Root Explorer's built-in text editor. Since then I've just used ADB to pull them to my computer to edit, then push the edited files over to the SD card via ADB, then moved them to the /etc/ folder with Root Explorer. Hope that helps someone... But to confirm, I've gotten it working using those edits that the OP had posted, and used the IPv4 settings posted above. No comment yet on speed or anything. It does appear as though 4G stays connected, though.
Can anyone confirm this still works with the 2.3.4-4.5.1A-1_SUN-198_6-CM SBF? Windows 7 sees the connection but there is no internet access. Are the mount commands required or can I just make the edits to the files (root explorer) and reboot the phone?
Mahna Mahna said: Can anyone confirm this still works with the 2.3.4-4.5.1A-1_SUN-198_6-CM SBF? Windows 7 sees the connection but there is no internet access. Are the mount commands required or can I just make the edits to the files (root explorer) and reboot the phone? Click to expand... Click to collapse It doesn't seem to work for me on this update, either. Same issue, W7 sees the connection but I also don't get internet access. Using Google's DNS as well. I'm not sure what changed... Anyone else try this and/or know of a fix?
BallCity said: It doesn't seem to work for me on this update, either. Same issue, W7 sees the connection but I also don't get internet access. Using Google's DNS as well. I'm not sure what changed... Anyone else try this and/or know of a fix? Click to expand... Click to collapse Seems that they did something in the firmware to disable the packet forwarding. I haven't had a lot of time to check this more closely. Would be interesting to see what the differences in the kernel config are between this build and the previous one.
[Q] Networking question
Hi All, I have a stupid Juniper VPN device at work which does not support 64 bit linux clients using netconnect. I have found ways around this previously, but now we are setting up 2 factor auth which throws a lot of javascript into the mix, making the scripts I used pretty much obsolete. The Junos pulse client works well for android, so I am thinking I want to use an android device as a router. Connecting to the VPN and using wifi tethering does not work, same with USB tethering does not work, and those are not exactly what I want anyway. So basically I want to be able to connect my android device to my wifi here at home, connect to the VPN on it, run a script to do my setup on the Android device, lastly add a route on my client pc to tunnel through the android device. here is what I tried so far on the device: Code: echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE iptables -P FORWARD ACCEPT iptables -t nat -I POSTROUTING -s 192.168.0.0/16 -d 10.0.0.0/8 -j MASQUERADE ip rule add from all to 10.0.0.0/8 fwmark 0x3c lookup 60 and on the client PC: Code: route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.1.29 where 192.168.1.29 is the IP of my android device, and 10.0.0.0/8(I know its lazy) is the IP range I want to go through tun0 on the device. This is however not working. The only thing I need to do on a standard linux box to do this would be: Code: echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -I POSTROUTING -s 192.168.0.0/16 -d 10.0.0.0/8 -j MASQUERADE And setup the same route command on the client but point it at the linux box instead. This currently works, but when we decide to flip the switch and use the 2 factor auth only I will not be able to make it work on a standard linux box, but 2 factor does work on android via the Junos app. I fear I am missing something simple in Android land, please help...
[Q]Android OpenVPN gateway for USB tether
Now before I get flamed for a duplicate post, I have already searched this topic. I found 2 threads here, one of which has a few different methods, and a few others elsewhere on the net. I've tried all of them, literally. Every guide I could find relating to passing USB Tethered traffic through my phone's OpenVPN connection. I figure I must be doing something wrong somewhere in my iptables. Some info about my setup: Phone: Samsung Galaxy S5 - Rooted via Towelroot, SuperUser updated, RootCheck confirmed rooted Interfaces from 'netcfg': wifi = wlan0, usb tether = rndis0, Cellular data = rmnet0, OpenVPN tunnel = tun0 VPN network = 10.0.1.0/24 USB Tethered network = 192.168.42.0/24 Wifi Tethered network = 192.168.43.0/24 LAN network (on other side of VPN) = 10.0.0.0/8 Firewall/OpenVPN server = pfSense OS of Client attempting to connect through VPN = Windows 7 I am trying to use my phone as an OpenVPN gateway because I require a connection to my home network, and I have insufficient permission to install the OpenVPN client on the machine I am trying to connect back home with. Even though I cannot install the OpenVPN client/Tun/tap network interface, it does allow my phone's rndis interface to be installed. And this is what I have tried so far: iptables -- flush iptables -A POSTROUTING -o tun0 -j MASQUERADE -t nat iptables -A FORWARD -i tun0 -o rndis0 -m state --state RELATED,ESTABLISHED -j RETURN iptables -A FORWARD -i rndis0 -o tun0 -m state --state INVALID -j DROP iptables -A FORWARD -i rndis0 -o tun0 -j RETURN And This: iptables --flush iptables -A POSTROUTING -s 192.168.42.0/24 -j MASQUERADE -t nat iptables -A FORWARD -j ACCEPT -i rndis0 -o tun0 iptables -A FORWARD -j ACCEPT -i tun0 -o rndis0 Neither one seems to work. I tried the former earlier and couldnt tell if it worked or just screwed everything up, as I couldnt connect to anything on my home LAN or the internet. Any help is greatly appreciated. I don't know if I need to add a rule on the pfSense firewall to handle traffic from 192.168.42.0/24 or not, I havn't seen that mentioned anywhere.
Hey, I know this is a little old, but did you get anywhere? I'm too trying to get traffic from the tethered device to be routed via the phone's VPN connection. Thanks
[SOLVED] Weird NAT issues when trying to tether via VPN
Hi, I recently wrote a program in C/C++ which allows me to tunnel over ICMP (my carrier stupidly allows ICMP traffic over 3g with the right APN ) All works fine if im using it from the phone, using the NDK compiled binary. Also works fine if im not running the tunnel from my phone and just tethering via usb/wifi/bt and running the tunnelling program on the device tethered to my s3 What I'm trying to achieve is: run the tunnelling prog on the phone, and set up some iptables rules to forward rndis0/wlan0/bt-pan to tun0 so that I can use the tunnelled connection simultaneously on the phone and on whatever other devices are tethered to the phone. Problem is, whilst running the program on the phone, I can access all sites/ips fine, but the connection provided to the tethered devices with the iptables rules is flaky at best, and simply will not connect to some sites at all Possibly netmask issue? Assuming my default gateway on the phone is set to the tunnel endpoint, here are the iptables rules I am using to NAT the tetherable interfaces: iptables -F natctrl_FORWARD iptables -A FORWARD -o tun0 -i bt-pan -s 192.168.44.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -A FORWARD -o tun0 -i wlan0 -s 192.168.43.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -A FORWARD -o tun0 -i rndis0 -s 192.168.42.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -t nat -F POSTROUTING iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE strangely I can ping ok, and access sites like google and facebook but most other sites will not load. Have done tracepath so I know the packets are going through the tunnel. Anyone able to shed any light on this? Alternatively, could it be possible to edit the default tethering scripts on the s3 to use the tun0 device instead of rmnet0 ? Will search them and try Going to roll my NDK executable into a shared library and make it into a paid app. Used 10gb in 2 days on a SIM which has never and will never have credit. Also works whilst roaming! Jamie
Issue was that the MTU of wlan0/bt-pan/rndis0 was larger than that of the tunnel, causing packets to fragment. Lowered mtu and problem solved, working beautifully now
HOTSPOT iptables in CYNOGENMOD12.1
Dear developer community - first of all my warmest thanks for sharing this OS. Even if now after lineage it is a bit old, it fits perfecty my needs, is rooted and with xprivacy as app firewall and TWRP the ideal companion. I needed to secure the mobile - and a first action reading ip lists to block landed to a shell loop asserting iptables -w -A INPUT -s $ip -j DROP iptables -w -A OUTPUT -j DROP -d $ip for each $ip in the ip lists. This prevents - in the mobile phone itself - from connecting to/from those IPs. HOWEVER, Starting the HOTSPOT creates a NAT and a wlan0 interface offering connections using 192.168.43.0/24 addresses to clients. Unfortunately the protection achieved via the upper rules does not apply to the hotspot connection. What should be added to iptables in order to extend the protection to every client connecting with the hotspot? Thanks a lot in advance. PS: attached my standard-after-boot iptable rules situation (probably with xprivacy rules) - after boot but before the protection loop (see above) be launched (unfortunately there is no iptable-save ... on that OS) - using iptables -L -nvx