Database Info

Proxy PC Web Sessions Through Phone/SSH/Remote HTTP via USB

Synopsis:
Need to bypass corporate web proxy for unfiltered Internet access. Google Chrome is the preferred and tested browser, but Firefox should work as well. Corporate environment utilizes an automated global proxy setting, which must be bypassed using run-time arguments. Since I have a Squid proxy running at home on my cable connection, all I need to do is establish a port-forwarding tunnel from my phone to my house, then another from my laptop to my phone. This will allow me to browse the web and proxy any traffic through my phone to my proxy server at home, around our corporate proxy and firewall. The phone utilizes a DSL connection typically used for testing and other non-business traffic and is isolated from the corporate LAN.
Requirements:
A Web Proxy (Squid instance or other third-party available)
Atrix 2 Rooted (others not tested)
SSHDroid from Google Play
BusyBox (with ssh binary)
Google Chrome or Firefox
Putty SSH Client for Windows or other SSH client software AND a familiarization with SSH tunneling.
Procedure
On the Atrix 2, be sure 'Motorola Phone Portal' mode is configured for the USB connection. This will tell the phone to assign an IP address to the USB interface of the phone. In my case, it is 192.168.16.2. Once that is done, connect your phone to your PC via the USB cable. This may auto-launch IE on your desktop to your phone to the web portal on port 8080 and is not necessary.
On the Atrix 2, launch SSHDroid to enable inbound SSH connections. No special settings were configured in that app for any of this to work.
On your PC, manipulate your Chrome shortcut to use different proxy settings than the default. By default Chrome utilizes the Internet Settings on the PC, so this is necessary if you already have a proxy defined at the OS level. To do this, you must create a new shortcut to Chrome, then right-click on that shortcut, go to properties, and change the 'Target' field to include this information:
--proxy-server="localhost:3128" (don't forget the quotes)
Be sure to use this shortcut to launch Chrome or you will continue to use the OS-level Internet Settings.
Now, launch the Putty SSH client and create a new SSH session to your Android device. Enter the appropriate connection information, and under the Connection/SSH/tunnel section, define the port forward information for the web proxy. In my case I set it to port 3128 forwarding to 192.168.16.2:3128. Save this session. This will tell your PC when the SSH session is established to set up local TCP port 3128 to listen for requests, then forward them to the Android phone across the USB connection on the same port.
Try to connect to your SSH server on your phone. By default, the username is 'root' and password is 'admin' for SSHdroid. You should now be successfully logged into your phone.
In the Putty SSH session on your phone, you will now have to launch a command-line SSH session where you will establish the real tunnel to the real proxy server. Enter 'ssh <REMOTE SSH USERNAME>@<REMOTE SSH HOST> -L <IP OR HOSTNAME OF PROXY>:<PROXYPORT>:<USB NETWORK IP ADDRESS>:<LOCAL PROXY PORT>' (without quotes) to establish the SSH tunnel. Here is what my connection (sanitized) looks like. You can also run 'ssh -?' to get an idea of command-line options for the ssh binary.
ssh [email protected] -L 192.168.1.1:3128:192.168.16.2:3128
This will set your phone to listen on TCP port 3128 on the 192.168.16.2 interface and forward any requests to 192.168.1.1 on the same port. It is important to specify the USB interface as by default it will only set up connections on the localhost (127.0.0.1) interface, which won't accept connections from other remote hosts.
Finally, launch Chrome using the shortcut you created and you should now be sending all web traffic out the USB interface and through your phone to your remote proxy server. You can verify this by connecting to a resource such as your home Internet router on the LAN interface to verify. If you are running Squid at home, you should also be able to view your /var/log/squid/access.log and see your requests.
I have not tested remote web proxies or other methods, but in principle it should work.
Feedback and ideas for improvement are welcome!

I just USB tether and use Tunnelier (because putty does not have auto reconnect) and Proxifier (so I don't have to set the proxy settings in each application I want proxied)

Solution to Tethering + OpenVPN issues on KitKat/4.4

I was previously using a stock rooted Nexus 4 (with 4.3) with "OpenVPN Connect" (net.openvpn.openvpn) and android built-in wifi tethering to tunnel tethered clients through the OpenVPN connection. This required some iptables modifications but worked fine.
With a stock rooted Nexus 5 (with 4.4.0) and OpenVPN Connect 1.1.12, this stopped working and that was really annoying.
Part of the issue was the one described here
But it was more complicated. It seems that there are routing table issues that I had to research a bunch.
Here are the iptables commands that I already had to run even on the Nexus 4 (with 4.3), which I got from here
Code:
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
These (above) are somewhat liberal firewall rules that you may what to refine for more security.
But below are additional routing entries that I needed to add specifically for the Nexus 5 (with 4.4.0). They force tethered clients to route through the VPN, unless their traffic is a broadcast or designated for the wifi LAN. Those exceptions are required for DHCP to work on the tethered client. They assume the tethered LAN is 192.168.43.XYZ and the OpenVPN interface is tun0.
Code:
ip rule add from 192.168.43.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
This seems to all work best if I start OpenVPN after activating tethering, not before.
I'm not entirely clear whether this is a result of some change/bug in KitKat, or an incompatibility in "OpenVPN Connect", or both. I wonder if it would work ok with other OpenVPN clients like "OpenVPN for Android" (de.blinkt.openvpn)
Other Notes:
* Server is OpenVPN 2.3.2
* Server has this line set in its config:
Code:
push "redirect-gateway autolocal def1"

Running android 4.4.2 google stock image with SuperSU on LG Nexus 4. These routing commands worked great and allowed me to tunnel all WiFi tethered traffic through my VPN. Thanks for figuring this out it was bugging me!

Im stock 4.4.2 no root or anything just pure stock i download install openvpn from google play and imported my config files click connect then open PDAnet connect and the Ip is changed.

OK, so I'm having a bit of trouble understanding and implementing the fix for my nexus 5. I've already got WiFi tethering working through the sqlite db fix but now I can't get my connection to work when my VPN (PIA official app) is broadcasting. These commands you're sending, are they done on the phone terminal or computer and is that EXACTLY how theyre being entered. For rules in red where would I find the IP I would use. Thanks guys Id really appreciate any help given.

Worked!
scootley said:
This seems to all work best if I start OpenVPN after activating tethering, not before.
Click to expand...
Click to collapse
Thanks scootley! These worked me on 4.3. I activated my hotspot before OpenVPN, but I used
Code:
iptables --flush
first before entering your commands. Seems to help. My OpenVPN server config also has the following in addition to push redirect:
Code:
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway autolocal def1"
Jrock2t5 said:
OK, so I'm having a bit of trouble understanding and implementing the fix for my nexus 5. I've already got WiFi tethering working through the sqlite db fix but now I can't get my connection to work when my VPN (PIA official app) is broadcasting. These commands you're sending, are they done on the phone terminal or computer and is that EXACTLY how theyre being entered. For rules in red where would I find the IP I would use. Thanks guys Id really appreciate any help given.
Click to expand...
Click to collapse
These commands are entered on the phone. You can download Terminal Emulator or something similar through the app store.
First make sure you're connect to your hotspot from your computer. Next, let's find your local IP address. Here are the instructions for Windows:
Click on the Start menu and type cmd. When you see the cmd applications in Start menu panel, click it or just press enter.
A command line window will open. Type ipconfig and press enter.
You'll see a bunch of information, but the line you want to look for is "IPv4 Address." The number across from that text is your local IP address.
Here's how to do the same thing on a Mac:
Open System Preferences (via the Apple menu at the top lefthand corner of your screen).
When System Preferences opens, click on the icon labeled Network.
You should see a few options on the left with labels like Wi-Fi, Ethernet, Bluetooth, etc. The ones with green dots have IP addresses assigned to them. Click the one on top (if it isn't already selected) and look to the right. There should be a sentence that reads something like "Wi-Fi is connected to Chocolate and has the IP address 192.168.1.102." The number at the end of that sentence is your local IP address.

Thanks for this thread, I've nearly got tethering working through Private Internet Access/Open VPN.
When running the commands
Code:
ip rule add from 192.168.43.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
i get an error "RTNETLINK answers: File exists"
I tethered up while connected to the VPN and could ping out to external IP addresses but no DNS resolution. So in my windows settings I manually specified DNS settings and can now browse the web through the VPN on my Galaxy s4!
But how do I fix the DNS issue? I want the clients that connect to pick up the DNS settings that actually work, without having to manually specify.
Thanks for any help

Vpn problem
Hi I havent tried the above options..yet
I have a sgs3 sgh-t999 . a comercial vpn account with the xxx.ovpn cert files.
after getting the details entered into open vpn and importing the cert file all is good untill I go to connect [see attachment]
phone is v4.3, baseband mjc, kernel v 3.0.31, rom S3rx v3.0 1-27-14
any suggestions on how to proceed?

RXP said:
Thanks for this thread, I've nearly got tethering working through Private Internet Access/Open VPN.
When running the commands
Code:
ip rule add from 192.168.43.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
i get an error "RTNETLINK answers: File exists"
I tethered up while connected to the VPN and could ping out to external IP addresses but no DNS resolution. So in my windows settings I manually specified DNS settings and can now browse the web through the VPN on my Galaxy s4!
But how do I fix the DNS issue? I want the clients that connect to pick up the DNS settings that actually work, without having to manually specify.
Thanks for any help
Click to expand...
Click to collapse
1) RTNETLINK answers: File exists
This just means you already ran the command before during this reboot session and it's saved into the route table. If you restart your phone, and run the commands again, it will go through first time, but repeated commands will yield same error. Should be normal. Table clears on reboot.
2) Please see the thread at http://forum.xda-developers.com/galaxy-s2/help/solved-wifi-hotspot-issue-samsung-t1689242
It seems like in order for OpenVPN DNS push to work, you have to change your APN settings on your phone to have it automatically register and push out to your other devices. I had the same problem and came across this during a search.

Massive thanks to the OP for posting this here and to everyone helping out in this thread.
The above rules route wifi tethered traffic via the vpn but I was wondering if there are similar rules to route usb tether too?
Cheers

It seems to work once, but when Data connection is lost or openvpn reconnects, wifi tathering stops working, need to do everything again (switch all off, connect to 3G, vpn, create wifi hotspot and apply fix script). And somehow DNS doesn't work. Tryed on Galaxy S5, LG L70, both on 4.4.2
But in general, this workaround is working, just needs a little bit of tweaking

This is fantastic.
For those of you using VPN on your phone as well, does it seem to stay connected? My VPN (OpenVPN) was flawless on 4.3 ... I mean smooth as ice with no disconnects.
When I upgraded to Kitkat, I wanted to immediately hide in a hole from embarrassment. Only after trying to connect and stay connected did I start to read around to check what the heck was going on. Biggest mistake ever. But then again, who would have thought right? I mean come on...who would have thought it would make using VPN a nightmare after an update that's suppose to be improved? Whatever...
Anyhow, lesson learned. Now I'm waiting desperately for someone to figure out how to downgrade from 4.4 back to 4.3 and/or to find a patch/fix for this issue so we don't have to run a script on every boot or reset.
At the end of the day, at least there is a solution thanks to folks like you. Kudos to the OP and everyone else who has contributed to the work around...for the time being lets hope...
:good:

For anyone interested, I played with the commands to have it work over a USB tether instead of Wifi. Why? Because my battery life stinks and this way my phone is charging also. What the heck. works great.
The only change was in the two spots where it has "wlan0" change them to "usb0". Another change was that the subnet of the USB connection is 192.168.42.0/24 (versus 192.168.43.0/24 on wifi). I get it working in this order:
1) reboot phone (to make sure to other lingering route tables are wiped out
2) turn off wifi
3) establish VPN connection
4) start USB tethering (and have your phone usb connected to your computer
5) After eveything is hooked up, open a terminal window, make sure you have superuser access (su) and execute the commands below. I just have them saved in a text file on my phone's sd card, copy them and just paste them all at once into the terminal window. Haven't figured out how to get this to run automatically using init.d (yet - assuming you can because upon phone reboot, I have to assuming that it will spit out errors because the tun0 and usb0 devices will not exist!)
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
ip rule add from 192.168.42.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.42.0/24 dev usb0 scope link table 61
ip route add broadcast 255.255.255.255 dev usb0 scope link table 61

Vpn api delete route joy downgraded
@grogargh
Have you tried Tasker, run shell
To run after booting [or from widget or otherwise]
http://forum.xda-developers.com/showthread.php?t=1110775

USB-tether (cell phone to router).Trying to Port-Forward 554 from phone to router

I have a static ip cell phone, LTE service with public address: 25.25.25.25
USB-Tethered to an asus router
Router has WAN address of: 192.168.42.134,
Gateway and DNS is:192.168.43.129,
I Port-Forward 80,8080,554,etc... to Desktop Computer
Desktop Computer has HTTP Server and Darwin Streaming Server
Listening on 80,8080,554
Lan address is:192.168.1.2
I got the http server working by using an app on the cellphone called PortForarder https://play.google.com/store/apps/details?id=at.bherbst.net&hl=en
I forwarded port 8080 for incoming and 80 for target
...in settings I entered rmnet0 (25.25.25.25)for Public Interface (other choices were Lo(127.0.0.1),rndis0(192.168.42.129)
...for Target I entered router (192.168.42.134)
From the Outside (on a different internet connection)I'm able to access my html server with this http://25.25.25.25:8080
My Problem:
The app (portforwarder) is for non rooted phones, it will not let you forward ports lower than 1024,hence I cannot access my smtp stream on port 544
I'm trying to figure if the app uses iptables or routes traffic thru adb for forwarding
there are other portforwading apps for rooted phones that do use iptables (can allow to portforward lower than 1024) but I cannot get them to work with usb-tethering, it just may be I'm not understanding the correct iptable to write.
Can someone help me write an ip table that port forwards 544 from public interface(cell phone) to target host (router)
ca

Homefix said:
I have a static ip cell phone, LTE service with public address: 25.25.25.25
USB-Tethered to an asus router
Router has WAN address of: 192.168.42.134,
Gateway and DNS is:192.168.43.129,
I Port-Forward 80,8080,554,etc... to Desktop Computer
Desktop Computer has HTTP Server and Darwin Streaming Server
Listening on 80,8080,554
Lan address is:192.168.1.2
I got the http server working by using an app on the cellphone called PortForarder https://play.google.com/store/apps/details?id=at.bherbst.net&hl=en
I forwarded port 8080 for incoming and 80 for target
...in settings I entered rmnet0 (25.25.25.25)for Public Interface (other choices were Lo(127.0.0.1),rndis0(192.168.42.129)
...for Target I entered router (192.168.42.134)
From the Outside (on a different internet connection)I'm able to access my html server with this http://25.25.25.25:8080
My Problem:
The app (portforwarder) is for non rooted phones, it will not let you forward ports lower than 1024,hence I cannot access my smtp stream on port 544
I'm trying to figure if the app uses iptables or routes traffic thru adb for forwarding
there are other portforwading apps for rooted phones that do use iptables (can allow to portforward lower than 1024) but I cannot get them to work with usb-tethering, it just may be I'm not understanding the correct iptable to write.
Can someone help me write an ip table that port forwards 544 from public interface(cell phone) to target host (router)
ca
Click to expand...
Click to collapse
Not sure you can, and if you can, not sure it's allowed.
Sent from my SM-S903VL using Tapatalk

USB-tether (cell phone to router).Trying to Port-Forward 554 from phone to router

I have a static ip cell phone, LTE service with public address: 25.25.25.25
USB-Tethered to an asus router
Router has WAN address of: 192.168.42.134,
Gateway and DNS is:192.168.43.129,
I Port-Forward 80,8080,554,etc... to Desktop Computer
Desktop Computer has HTTP Server and Darwin Streaming Server
Listening on 80,8080,554
Lan address is:192.168.1.2
I got the http server working by using an app on the cellphone called PortForarder https://play.google.com/store/apps/details?id=at.bherbst.net&hl=en
I forwarded port 8080 for incoming and 80 for target
...in settings I entered rmnet0 (25.25.25.25)for Public Interface (other choices were Lo(127.0.0.1),rndis0(192.168.42.129)
...for Target I entered router (192.168.42.134)
From the Outside (on a different internet connection)I'm able to access my html server with this http://25.25.25.25:8080
My Problem:
The app (portforwarder) is for non rooted phones, it will not let you forward ports lower than 1024,hence I cannot access my smtp stream on port 544
I'm trying to figure if the app uses iptables or routes traffic thru adb for forwarding
there are other portforwading apps for rooted phones that do use iptables (can allow to portforward lower than 1024) but I cannot get them to work with usb-tethering, it just may be I'm not understanding the correct iptable to write.
Can someone help me write an ip table that port forwards 544 from public interface(cell phone) to target host (router)
ca

How to access wifi hotspot on phone with active VPN connectio?

I have to access the Internet through my phone data connection, from both Windows 10 laptop and Android 6.0.1 tablet. Both devices can connect fine to the wifi hotspot and they can use the Internet. However, if I connect the VPN client (Private Internet Access), neither the Windows 10 laptop, nor the Android tablet can connect anymore. If they were already connected before activating VPN, Internet access stops on both devices. The OnePlus One phone is rooted.
I googled for a solution and I found something with using iptables. The following commands should be pasted in a terminal window under root:
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
ip rule add from 192.168.43.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
After these commands, the Windows 10 laptop can access the Internet, even if the VPN connection is active. However, the traffic from the laptop doesn't go through the VPN connection on the phone. If I check the IP address at whatismyip.com from the laptop, I get the T-Mobile ip address. If I do the same thing from the phone, I get the PIA server ip address.
Unfortunately, this solution does not work for the Android tablet. If already connected to the wifi hotspot, before activating VPN on the phone, Internet access stops. If I try to connect the tablet after activating VPN, it gets stuck in "obtaining IP address".
It seems that somehow, the Windows DHCP client knows how to access the DHCP server running on the phone (at 192.168.143.1). However, the request from the Android tablet is probably sent to the Internet, and does not reach the DHCP server (or the DNS server.) I suspect the local network (192.168.143.0/24) should be somehow excluded in iptables, but I don't know how to do that. Also, I'm not sure if I exclude it, the connection from Windows laptop will be affected.
So my main question is:
Is there a solution to access the wifi hotspot on the phone while VPN is active, from BOTH Windows and Android devices?
My second question is:
Is there a solution to direct the network traffic coming from the devices connected to the wifi hotspot, THROUGH the VPN connection running on the phone?
XDA:DevDB Information
Tethering with active VPN connection, Kernel for the OnePlus One
Contributors
alanPr
Kernel Special Features:
Version Information
Status: Testing
Created 2018-07-09
Last Updated 2018-07-09