How to access internet through android's shared wi-fi but with VPN.
Android share wifi with VPN.
1. On phone settings find USB tethering. // It doesn't allow to share VPN connection.
2. I need VPN thetering App like Every Proxy.
VPN over USB tethering
Use a proxy server app (no root)
1. Set proxy on Android for example 192.168.1.7:2080. On laptop set Firefox Socks5 proxy.
2. Try Every proxy // doesn't work
3. Android proxy server app with Network share tunnel additionaly installed.
3.1 Try proxy is working
3.1.1 Ping the phone to ensure its connected.
3.1.2 $ curl -v -x http://192.168.1.2:8080 http://1.1.1.1
3.2 Sharing is not working. Probably I should use rooted device.
Rooted
4. Could I create some virtual machine on my laptop with rooted android and install some VPN from google store and root required app to share my VPN connection with core laptop linux system?
4.1 Download Android from android-x86.org
4.2 Create VM in VirtualBox:
- Type: Linux, Version: Linux 2.6/3.x/4.x (64-bit)
- RAM: 2048+ MB
- Video: VBoxVGA (not VMSVGA), enable 3D acceleration
- Network: **Bridged Adapter** (critical for host↔VM communication)
- Storage: Attach the Android-x86 ISO
4.3 Check you have root access. Inside Android VM, open Terminal Emulator: Type $ su // If you get a # prompt (not $), you're rooted
5. $ echo 1 > /proc/sys/net/ipv4/ip_forward // to redirect traffic, does not survive reboot
5.1. $ for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > "$f"; done
6. $ iptables -t nat -I POSTROUTING 1 -o tun0 -s 192.168.1.0/24 -j MASQUERADE // to verify $ iptables -t nat -L POSTROUTING -n -v | grep tun0
7. Allow Forwarding: LAN ↔ VPN
$ iptables -I FORWARD 1 -i wlan0 -o tun0 -s 192.168.1.0/24 -j ACCEPT
$ iptables -I FORWARD 2 -i tun0 -o wlan0 -d 192.168.1.0/24 -m state --state RELATED,ESTABLISHED -j ACCEPT or even better $ iptables -I FORWARD 2 -i tun0 -o wlan0 -d 192.168.1.0/24 -j ACCEPT
7.0 Neutralize Android's tethering NAT chain (prevents override/conflict)
iptables -t nat -F tetherctrl_nat_POSTROUTING
iptables -t nat -X tetherctrl_nat_POSTROUTING 2>/dev/null
7.1. Neutralize firewall
$ iptables -F tetherctrl_FORWARD 2>/dev/null
$ iptables -F bw_FORWARD 2>/dev/null // to verify $ iptables -L FORWARD -n -v --line-numbers | head -4
7.2. Add high-priority rule: force client subnet to use 'main' table because pockets were not reaching FORWARD chain before. You can check it with $ watch -n 1 'iptables -L FORWARD -n -v -x --line-numbers | head -3'
$ ip rule add from 192.168.1.0/24 lookup main priority 50 // to verify $ ip rule show | grep "192.168.1"
8. $ ip route add default via 100.99.5.12 dev tun0 or better $ ip route add default dev tun0 // Not survive reboot
8.1. Ensure main table has route to LAN via wlan0: $ ip route show table main | grep 192.168.1.0/24 || ip route add 192.168.1.0/24 dev wlan0 scope link table main
8.2. Add default route if it is not exists yet in
$ ip route show should demonstrate:
default dev tun0 scope link
192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.124
10. To debug $ tcpdump -i tun0 -n src 192.168.1.69 and $ tcpdump -i tun0 -n dst 192.168.1.69
12. Add high-priority rule: force LAN-destined traffic to use main table: $ ip rule add to 192.168.1.0/24 lookup main priority 100 // Now works
CASE 2.
13. I have changed VPN client and my previous setup stopped to work.
13.1. And even $ tcpdump stopped to work it just freezes.
13.2. We won't set the $ ip rule in this case. We will check $ ip rule with VPN on and off and note what rules fwmarks VPN added.
13.3. I see new:
12000 from all fwmark 0x0/0x20000 iif lo uidrange 0-99999 lookup tun0
12000 from all fwmark 0xc006e/0xcffff lookup tun0
13000 from all fwmark 0x1006e/0xcffff iif lo uidrange 0-99999 lookup tun0
13000 from all fwmark 0x1006e/0xcffff iif lo uidrange 0-0 lookup tun0
14000 from all iif lo oif tun0 uidrange 0-99999 lookup tun0
21000 from all fwmark 0x6e/0x1ffff lookup wlan0
We see here fwmark 0xc006e/0xcffff it is our mark. But it changes every connection.
We set $ iptables -t mangle -A PREROUTING -i wlan0 -s 192.168.1.0/24 -j MARK --set-xmark 0xc006e/0xcfff after this $ tcpdump -i tun0 started to work and we see ICMP pockets are going in and out. But tun0 -> wlan0 is not going.
Were set also $ iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
And we do not set any $ ip route add ... in this configuration
13.4. To make pockets run from tun0->wlan0
$ iptables -t mangle -A POSTROUTING -o tun0 -j CONNMARK --save-mark
$ iptables -t mangle -A PREROUTING -i tun0 -j CONNMARK --restore-mark
// Now it works
14. After reboot all stopped to work. tun0 get pockets but they were not MASQUERADED (had local net ip). Try:
iptables -t nat -F
iptables -t nat -X
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
echo 1 > /proc/sys/net/netfilter/nf_conntrack_max
echo 0 > /proc/sys/net/netfilter/nf_conntrack_max
echo 65536 > /proc/sys/net/netfilter/nf_conntrack_max
IP MASQUERADE started to work after this