Download a terminal client, e.g. ConnectBot and connect to your local shell.
Enter `su` to become root. (Double check with whoami afterwards).
Enable wifi tethering and ensure your data connection is working (connect to VPN)
Run `netcfg` and note your interface names (typically tun0 and wlan0 (ignore m.wlan0 or similar, only take the one with a real mac address), as is on my SGSII)
Double check the subnet for your wlan0 device and enter the following commands:
iptables -A POSTROUTING -s 192.168.43.0/24 -j MASQUERADE -t nat
(setup a postrouting entry for the tethered devices subnet, implementing NAT)
iptables -A FORWARD -j ACCEPT -i wlan0 -o tun0
forward packets from tethered devices across the tunnel
iptables -A FORWARD -j ACCEPT -i tun0 -o wlan0
forward packets from the tunnel to the tethered devices
Note, because you are using NAT, you will need to configure port forwards on your Android device to be able to run servers etc on tethered devices. Unlikely you'll need to worry about that though. Feedback if it worked or not. Posting this now from my home IP thanks to OpenVPN for Android and these iptable rules!
deed02392 said:
Download a terminal client, e.g. ConnectBot and connect to your local shell.
Enter `su` to become root. (Double check with whoami afterwards).
Enable wifi tethering and ensure your data connection is working (connect to VPN)
Run `netcfg` and note your interface names (typically tun0 and wlan0 (ignore m.wlan0 or similar, only take the one with a real mac address), as is on my SGSII)
Double check the subnet for your wlan0 device and enter the following commands:
iptables -A POSTROUTING -s 192.168.43.0/24 -j MASQUERADE -t nat
(setup a postrouting entry for the tethered devices subnet, implementing NAT)
iptables -A FORWARD -j ACCEPT -i wlan0 -o tun0
forward packets from tethered devices across the tunnel
iptables -A FORWARD -j ACCEPT -i tun0 -o wlan0
forward packets from the tunnel to the tethered devices
Note, because you are using NAT, you will need to configure port forwards on your Android device to be able to run servers etc on tethered devices. Unlikely you'll need to worry about that though. Feedback if it worked or not. Posting this now from my home IP thanks to OpenVPN for Android and these iptable rules!
Click to expand...
Click to collapse
I'm complete newbie here, just want to ask, is this change permanent? Can I revert back to the default iptables? How to forward using usb tethering?
quick response
deed02392 said:
Download a terminal client, e.g. ConnectBot and connect to your local shell.
Enter `su` to become root. (Double check with whoami afterwards).
Enable wifi tethering and ensure your data connection is working (connect to VPN)
Run `netcfg` and note your interface names (typically tun0 and wlan0 (ignore m.wlan0 or similar, only take the one with a real mac address), as is on my SGSII)
Double check the subnet for your wlan0 device and enter the following commands:
iptables -A POSTROUTING -s 192.168.43.0/24 -j MASQUERADE -t nat
(setup a postrouting entry for the tethered devices subnet, implementing NAT)
iptables -A FORWARD -j ACCEPT -i wlan0 -o tun0
forward packets from tethered devices across the tunnel
iptables -A FORWARD -j ACCEPT -i tun0 -o wlan0
forward packets from the tunnel to the tethered devices
Note, because you are using NAT, you will need to configure port forwards on your Android device to be able to run servers etc on tethered devices. Unlikely you'll need to worry about that though. Feedback if it worked or not. Posting this now from my home IP thanks to OpenVPN for Android and these iptable rules!
Click to expand...
Click to collapse
Hi there...
I'm a total rookie, I just follow instructions carefully.
I've been searching for a solution to this problem on my s3mini
Rooted.
I used Terminal Emulator, still my wifi connected laptop didn't connect to the internet. My openvpn log showed something like routes adding and stuff
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
still didn't work
Then I used ConnectBot to retry the same exact steps, still nothing happened
On my phone, i think the subnet is 192.168.43.1/24. Do you think that could be a reason it did not work?
I've tried so many options so far for this issue.
I really hope you come back to this thread.
I've read dozens of these threads and pages on making this work and I can't do it I just can't figure it out, is there something different on 6.0 Marshmallow I know there's no netcfg I've been using ip link show
HELP
I tried this solution to hide my tether usage from ThreeUK. While it did work I was having some evil DNS issues. I could download at a few mb/s but then would take 180 seconds to load some basic pages etc.
However, thinking upon it I realised you don't even need to use a VPN client to hide the usage, just use the same method as OP posted but send all traffic via wlan0.
Worked perfectly all week for me, streamed a good 5gb of TV and if I need a VPN I can iniate the VPN on the end device.
---------- Post added at 03:45 PM ---------- Previous post was at 03:43 PM ----------
Works with USB Tethering too, and bluetooth
Obviously change IP/Adapter names etc.
Pantho86 said:
However, thinking upon it I realised you don't even need to use a VPN client to hide the usage, just use the same method as OP posted but send all traffic via wlan0.
Click to expand...
Click to collapse
Apologies for resurrecting an old thread, but is this still working for you? Would it be possible for you to provide some instructions as it isn't clear what commands you've used.
Apologies but I cannot test it anymore as I'm not wanting to root my Nexus device, I enjoy using Android Pay & My Banking app too much.
Now if I'm remembering correctly I ran as :
Code:
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
ip rule add from 192.168.43.0/24 lookup 61
ip route add default dev rmnet0 scope link table 61
ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
The only issues I was having was when using dual-3g connections, there are 2 connections outgoing in those scenarios and sometimes Three will say "Tether limit hit", at that point just turn flight mode off/on to toggle the connection and rerun the routing.
Read the thread I linked and poke at it for a while, you should be able to get it working. This was the only way I managed to hide wifi tether usage. USB tethering for Windows & Unix is easy enough to hide with free apps, but for a chromebook or other such devices it's trickier and this is the only way.
(I had to remove the link, XDA blocked it... google wifi tether iptables and it's the thread on digiex)
OK that's great, thanks.
Pantho86 said:
I tried this solution to hide my tether usage from ThreeUK. While it did work I was having some evil DNS issues. I could download at a few mb/s but then would take 180 seconds to load some basic pages etc.
However, thinking upon it I realised you don't even need to use a VPN client to hide the usage, just use the same method as OP posted but send all traffic via wlan0.
Worked perfectly all week for me, streamed a good 5gb of TV and if I need a VPN I can iniate the VPN on the end device.
---------- Post added at 03:45 PM ---------- Previous post was at 03:43 PM ----------
Works with USB Tethering too, and bluetooth
Obviously change IP/Adapter names etc.
Click to expand...
Click to collapse
Hey... I was just wondering how you modified the original commands to get tethering to work undetected without VPN. I've been trying to figure this out for weeks!
Hi All,
I have a stupid Juniper VPN device at work which does not support 64 bit linux clients using netconnect. I have found ways around this previously, but now we are setting up 2 factor auth which throws a lot of javascript into the mix, making the scripts I used pretty much obsolete. The Junos pulse client works well for android, so I am thinking I want to use an android device as a router. Connecting to the VPN and using wifi tethering does not work, same with USB tethering does not work, and those are not exactly what I want anyway.
So basically I want to be able to connect my android device to my wifi here at home, connect to the VPN on it, run a script to do my setup on the Android device, lastly add a route on my client pc to tunnel through the android device. here is what I tried so far on the device:
Code:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -P FORWARD ACCEPT
iptables -t nat -I POSTROUTING -s 192.168.0.0/16 -d 10.0.0.0/8 -j MASQUERADE
ip rule add from all to 10.0.0.0/8 fwmark 0x3c lookup 60
and on the client PC:
Code:
route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.1.29
where 192.168.1.29 is the IP of my android device, and 10.0.0.0/8(I know its lazy) is the IP range I want to go through tun0 on the device. This is however not working.
The only thing I need to do on a standard linux box to do this would be:
Code:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -I POSTROUTING -s 192.168.0.0/16 -d 10.0.0.0/8 -j MASQUERADE
And setup the same route command on the client but point it at the linux box instead. This currently works, but when we decide to flip the switch and use the 2 factor auth only I will not be able to make it work on a standard linux box, but 2 factor does work on android via the Junos app.
I fear I am missing something simple in Android land, please help...
I have modified this script to make my wifi hotspot run through my VPN connection but every time my internet connection changes towers, or changes from LTE to 3G and vice versa, or my vpn disconnects and reconnects, this script has to be run again or my tethering activity stops going through my vpn. I think if I make this script loop every 10 seconds my problem will be solved (Not ideal I know, but I am desperately noobish). Does anyone know what to add to the script to make it loop with a timer? Or any suggestions for a better way to accomplish what I am trying to do?
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
ip rule add from 192.168.1.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.1.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
Someone at stackoverflow answered my question.
Here is a working timer loop. Now my wifi hotspot through vpn is reconfigured when my network reconnects and cycles.
while sleep 10; do
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
ip rule add from 192.168.1.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.1.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
done
Hi, I recently wrote a program in C/C++ which allows me to tunnel over ICMP (my carrier stupidly allows ICMP traffic over 3g with the right APN )
All works fine if im using it from the phone, using the NDK compiled binary.
Also works fine if im not running the tunnel from my phone and just tethering via usb/wifi/bt and running the tunnelling program on the device tethered to my s3
What I'm trying to achieve is: run the tunnelling prog on the phone, and set up some iptables rules to forward rndis0/wlan0/bt-pan to tun0 so that I can use the tunnelled connection simultaneously on the phone and on whatever other devices are tethered to the phone.
Problem is, whilst running the program on the phone, I can access all sites/ips fine, but the connection provided to the tethered devices with the iptables rules is flaky at best, and simply will not connect to some sites at all
Possibly netmask issue?
Assuming my default gateway on the phone is set to the tunnel endpoint, here are the iptables rules I am using to NAT the tetherable interfaces:
iptables -F natctrl_FORWARD
iptables -A FORWARD -o tun0 -i bt-pan -s 192.168.44.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o tun0 -i wlan0 -s 192.168.43.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o tun0 -i rndis0 -s 192.168.42.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
strangely I can ping ok, and access sites like google and facebook but most other sites will not load.
Have done tracepath so I know the packets are going through the tunnel.
Anyone able to shed any light on this?
Alternatively, could it be possible to edit the default tethering scripts on the s3 to use the tun0 device instead of rmnet0 ? Will search them and try
Going to roll my NDK executable into a shared library and make it into a paid app.
Used 10gb in 2 days on a SIM which has never and will never have credit. Also works whilst roaming!
Jamie
Issue was that the MTU of wlan0/bt-pan/rndis0 was larger than that of the tunnel, causing packets to fragment. Lowered mtu and problem solved, working beautifully now
Hello!
I have rooted device and need to prevent VPN connection traffic leak. So, in terminal I put this script.
Code:
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s 192.168.43.0/24 -j ACCEPT
iptables -A INPUT -s XX.XX.XX.XX -j ACCEPT
iptables -A INPUT -s XXX.XXX.XXX.XXX -j ACCEPT
iptables -A INPUT -s YYY.YYY.YYY.YYY-j ACCEPT
iptables -P INPUT DROP
All works good, OpenVPN connects to servers, but, in google chrome no one website open. Every time I get "You are offline"