Database Info

Net tips

These are very general, as long as android implements prop system at its core and is build on top of linux...
Prerequisites:
rooted device
#setprop net.hostname whateveryouwant
sets the host name reported on the network, instead of the default Android-number. This becomes useful if you're used to call (browse) the computers on your network by name...
if your kernel supports iptables you can use this command to force every dns request to a specific dns ip (instead of that one provided from dhcp):
#iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination IP
this works for all connections (interfaces), and is useful to override 3G and wifi ISP DNS to get more fast connections (as long as isp dns may become slow) and other advantages...
interfaces can be limited with -i interface option of iptables to set type of connection (3G, wifi, etc) uses the dns (if an interface is not listed than, will use its default, dhcp, dns).
Hope to be useful, despite it's not a guide.

Solution to Tethering + OpenVPN issues on KitKat/4.4

I was previously using a stock rooted Nexus 4 (with 4.3) with "OpenVPN Connect" (net.openvpn.openvpn) and android built-in wifi tethering to tunnel tethered clients through the OpenVPN connection. This required some iptables modifications but worked fine.
With a stock rooted Nexus 5 (with 4.4.0) and OpenVPN Connect 1.1.12, this stopped working and that was really annoying.
Part of the issue was the one described here
But it was more complicated. It seems that there are routing table issues that I had to research a bunch.
Here are the iptables commands that I already had to run even on the Nexus 4 (with 4.3), which I got from here
Code:
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
These (above) are somewhat liberal firewall rules that you may what to refine for more security.
But below are additional routing entries that I needed to add specifically for the Nexus 5 (with 4.4.0). They force tethered clients to route through the VPN, unless their traffic is a broadcast or designated for the wifi LAN. Those exceptions are required for DHCP to work on the tethered client. They assume the tethered LAN is 192.168.43.XYZ and the OpenVPN interface is tun0.
Code:
ip rule add from 192.168.43.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
This seems to all work best if I start OpenVPN after activating tethering, not before.
I'm not entirely clear whether this is a result of some change/bug in KitKat, or an incompatibility in "OpenVPN Connect", or both. I wonder if it would work ok with other OpenVPN clients like "OpenVPN for Android" (de.blinkt.openvpn)
Other Notes:
* Server is OpenVPN 2.3.2
* Server has this line set in its config:
Code:
push "redirect-gateway autolocal def1"

Running android 4.4.2 google stock image with SuperSU on LG Nexus 4. These routing commands worked great and allowed me to tunnel all WiFi tethered traffic through my VPN. Thanks for figuring this out it was bugging me!

Im stock 4.4.2 no root or anything just pure stock i download install openvpn from google play and imported my config files click connect then open PDAnet connect and the Ip is changed.

OK, so I'm having a bit of trouble understanding and implementing the fix for my nexus 5. I've already got WiFi tethering working through the sqlite db fix but now I can't get my connection to work when my VPN (PIA official app) is broadcasting. These commands you're sending, are they done on the phone terminal or computer and is that EXACTLY how theyre being entered. For rules in red where would I find the IP I would use. Thanks guys Id really appreciate any help given.

Worked!
scootley said:
This seems to all work best if I start OpenVPN after activating tethering, not before.
Click to expand...
Click to collapse
Thanks scootley! These worked me on 4.3. I activated my hotspot before OpenVPN, but I used
Code:
iptables --flush
first before entering your commands. Seems to help. My OpenVPN server config also has the following in addition to push redirect:
Code:
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway autolocal def1"
Jrock2t5 said:
OK, so I'm having a bit of trouble understanding and implementing the fix for my nexus 5. I've already got WiFi tethering working through the sqlite db fix but now I can't get my connection to work when my VPN (PIA official app) is broadcasting. These commands you're sending, are they done on the phone terminal or computer and is that EXACTLY how theyre being entered. For rules in red where would I find the IP I would use. Thanks guys Id really appreciate any help given.
Click to expand...
Click to collapse
These commands are entered on the phone. You can download Terminal Emulator or something similar through the app store.
First make sure you're connect to your hotspot from your computer. Next, let's find your local IP address. Here are the instructions for Windows:
Click on the Start menu and type cmd. When you see the cmd applications in Start menu panel, click it or just press enter.
A command line window will open. Type ipconfig and press enter.
You'll see a bunch of information, but the line you want to look for is "IPv4 Address." The number across from that text is your local IP address.
Here's how to do the same thing on a Mac:
Open System Preferences (via the Apple menu at the top lefthand corner of your screen).
When System Preferences opens, click on the icon labeled Network.
You should see a few options on the left with labels like Wi-Fi, Ethernet, Bluetooth, etc. The ones with green dots have IP addresses assigned to them. Click the one on top (if it isn't already selected) and look to the right. There should be a sentence that reads something like "Wi-Fi is connected to Chocolate and has the IP address 192.168.1.102." The number at the end of that sentence is your local IP address.

Thanks for this thread, I've nearly got tethering working through Private Internet Access/Open VPN.
When running the commands
Code:
ip rule add from 192.168.43.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
i get an error "RTNETLINK answers: File exists"
I tethered up while connected to the VPN and could ping out to external IP addresses but no DNS resolution. So in my windows settings I manually specified DNS settings and can now browse the web through the VPN on my Galaxy s4!
But how do I fix the DNS issue? I want the clients that connect to pick up the DNS settings that actually work, without having to manually specify.
Thanks for any help

Vpn problem
Hi I havent tried the above options..yet
I have a sgs3 sgh-t999 . a comercial vpn account with the xxx.ovpn cert files.
after getting the details entered into open vpn and importing the cert file all is good untill I go to connect [see attachment]
phone is v4.3, baseband mjc, kernel v 3.0.31, rom S3rx v3.0 1-27-14
any suggestions on how to proceed?

RXP said:
Thanks for this thread, I've nearly got tethering working through Private Internet Access/Open VPN.
When running the commands
Code:
ip rule add from 192.168.43.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
i get an error "RTNETLINK answers: File exists"
I tethered up while connected to the VPN and could ping out to external IP addresses but no DNS resolution. So in my windows settings I manually specified DNS settings and can now browse the web through the VPN on my Galaxy s4!
But how do I fix the DNS issue? I want the clients that connect to pick up the DNS settings that actually work, without having to manually specify.
Thanks for any help
Click to expand...
Click to collapse
1) RTNETLINK answers: File exists
This just means you already ran the command before during this reboot session and it's saved into the route table. If you restart your phone, and run the commands again, it will go through first time, but repeated commands will yield same error. Should be normal. Table clears on reboot.
2) Please see the thread at http://forum.xda-developers.com/galaxy-s2/help/solved-wifi-hotspot-issue-samsung-t1689242
It seems like in order for OpenVPN DNS push to work, you have to change your APN settings on your phone to have it automatically register and push out to your other devices. I had the same problem and came across this during a search.

Massive thanks to the OP for posting this here and to everyone helping out in this thread.
The above rules route wifi tethered traffic via the vpn but I was wondering if there are similar rules to route usb tether too?
Cheers

It seems to work once, but when Data connection is lost or openvpn reconnects, wifi tathering stops working, need to do everything again (switch all off, connect to 3G, vpn, create wifi hotspot and apply fix script). And somehow DNS doesn't work. Tryed on Galaxy S5, LG L70, both on 4.4.2
But in general, this workaround is working, just needs a little bit of tweaking

This is fantastic.
For those of you using VPN on your phone as well, does it seem to stay connected? My VPN (OpenVPN) was flawless on 4.3 ... I mean smooth as ice with no disconnects.
When I upgraded to Kitkat, I wanted to immediately hide in a hole from embarrassment. Only after trying to connect and stay connected did I start to read around to check what the heck was going on. Biggest mistake ever. But then again, who would have thought right? I mean come on...who would have thought it would make using VPN a nightmare after an update that's suppose to be improved? Whatever...
Anyhow, lesson learned. Now I'm waiting desperately for someone to figure out how to downgrade from 4.4 back to 4.3 and/or to find a patch/fix for this issue so we don't have to run a script on every boot or reset.
At the end of the day, at least there is a solution thanks to folks like you. Kudos to the OP and everyone else who has contributed to the work around...for the time being lets hope...
:good:

For anyone interested, I played with the commands to have it work over a USB tether instead of Wifi. Why? Because my battery life stinks and this way my phone is charging also. What the heck. works great.
The only change was in the two spots where it has "wlan0" change them to "usb0". Another change was that the subnet of the USB connection is 192.168.42.0/24 (versus 192.168.43.0/24 on wifi). I get it working in this order:
1) reboot phone (to make sure to other lingering route tables are wiped out
2) turn off wifi
3) establish VPN connection
4) start USB tethering (and have your phone usb connected to your computer
5) After eveything is hooked up, open a terminal window, make sure you have superuser access (su) and execute the commands below. I just have them saved in a text file on my phone's sd card, copy them and just paste them all at once into the terminal window. Haven't figured out how to get this to run automatically using init.d (yet - assuming you can because upon phone reboot, I have to assuming that it will spit out errors because the tun0 and usb0 devices will not exist!)
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
ip rule add from 192.168.42.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.42.0/24 dev usb0 scope link table 61
ip route add broadcast 255.255.255.255 dev usb0 scope link table 61

Vpn api delete route joy downgraded
@grogargh
Have you tried Tasker, run shell
To run after booting [or from widget or otherwise]
http://forum.xda-developers.com/showthread.php?t=1110775

routing difference between linux and Android (Lollipop)

I'm trying to set up a lollipop-TV-box with wlan and lan adapter as a router the way I did it with a Linux-box, but it doesn't work
I tried it the Linux-way on a linux-Machine with a shell-script. The wlan-net is 192.168.0.x the lan is 192.168.1.x. The wlan-ip in the Android/Linux router is 192.168.0.13 the lan in the same device is 192.168.1.2, the connected lan-client-ip is 192.168.2.4
the routing is Internet-(Wifi)-Gateway 192.168.0.1->Android/Linux-Box 192.168.0.13/192.168.1.2->192.168.2.4 and vice-versa
on lan-client:
ip route:
default via 192.168.1.2 dev eth0 proto static metric 1024
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.4
on Android/Linux-Router
192.168.0.0/24 dev wlan0 proto kernel scope link src 192.168.0.13 metric 600
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.2 metric 100
I also enabled forwarding and set the forward-tables with iptables
With the Linux-Box as a router everything works like a charm, with Android not, when I ping the lan-ip of the client from the Android box (ping 192.168.1.4) the reply is network unreachable from the external internet-server
PING 192.168.1.4 (192.168.1.4) 56(84) bytes of data.
From 84.116.198.82: icmp_seq=7 Destination Net Unreachable
From 84.116.198.82: icmp_seq=8 Destination Net Unreachable
From 84.116.198.82: icmp_seq=17 Destination Net Unreachable
I have to specify the interface with ping -I eth0 192.168.1.4, then it works, although this should already be specified by the local routes, like if the local request is routed over the public gateway. Looks like in Android the local routing is overriden by a hidden route to the default gateway.
So, what is the difference?

How to access wifi hotspot on phone with active VPN connectio?

I have to access the Internet through my phone data connection, from both Windows 10 laptop and Android 6.0.1 tablet. Both devices can connect fine to the wifi hotspot and they can use the Internet. However, if I connect the VPN client (Private Internet Access), neither the Windows 10 laptop, nor the Android tablet can connect anymore. If they were already connected before activating VPN, Internet access stops on both devices. The OnePlus One phone is rooted.
I googled for a solution and I found something with using iptables. The following commands should be pasted in a terminal window under root:
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
ip rule add from 192.168.43.0/24 lookup 61
ip route add default dev tun0 scope link table 61
ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61
After these commands, the Windows 10 laptop can access the Internet, even if the VPN connection is active. However, the traffic from the laptop doesn't go through the VPN connection on the phone. If I check the IP address at whatismyip.com from the laptop, I get the T-Mobile ip address. If I do the same thing from the phone, I get the PIA server ip address.
Unfortunately, this solution does not work for the Android tablet. If already connected to the wifi hotspot, before activating VPN on the phone, Internet access stops. If I try to connect the tablet after activating VPN, it gets stuck in "obtaining IP address".
It seems that somehow, the Windows DHCP client knows how to access the DHCP server running on the phone (at 192.168.143.1). However, the request from the Android tablet is probably sent to the Internet, and does not reach the DHCP server (or the DNS server.) I suspect the local network (192.168.143.0/24) should be somehow excluded in iptables, but I don't know how to do that. Also, I'm not sure if I exclude it, the connection from Windows laptop will be affected.
So my main question is:
Is there a solution to access the wifi hotspot on the phone while VPN is active, from BOTH Windows and Android devices?
My second question is:
Is there a solution to direct the network traffic coming from the devices connected to the wifi hotspot, THROUGH the VPN connection running on the phone?
XDA:DevDB Information
Tethering with active VPN connection, Kernel for the OnePlus One
Contributors
alanPr
Kernel Special Features:
Version Information
Status: Testing
Created 2018-07-09
Last Updated 2018-07-09

[GUIDE] Tethering through VPN over USB-OTG-ACA Ethernet /w IPv6 Support

This is a guide for tethering over USB Ethernet adapter. The purpose of this is to reliably USB tether to any router, without the need for a USB port or stable USB/RNDIS support(Broadcom MIPS is particularly bad). USB-OTG-ACA means the phone is powered externally while also operating in host mode. I used a cheap micro-USB Y-cable for this that lets me plug in a power source, USB Ethernet adapter, and phone together. IPv6 is supported via masquerading, so you share public IPs with your phone(thus hiding devices behind it). In this example I tether to a VPN tun0 interface, but you can tether to and from any interface you want.
This guide is targeted to more advanced users, but I included a E5 Play kernel and the files required at the bottom of this post for those who wouldn't be able to try this otherwise.
The first step is to enable the kernel IPv6 NAT table, with iptables and masquerading support. To do this I used LSM Kernel. My device is the E5 Play, steps for other devices are a little different.
https://forum.xda-developers.com/moto-e5/development/kernel-lowspecmoto-kernel-v0-1a-t3882378
These need to be set in james_defconfig. You can also enable any necessary kernel modules for your Ethernet adapter here.
Code:
CONFIG_NF_NAT_IPV6=y
CONFIG_IP6_NF_TARGET_MASQUERADE=y
CONFIG_IP6_NF_NAT=y
I had to disable the WireGuard install script and use jury_rig.sh instead, as well as fix a minor typo in the build script(misspelled and erroneous compile command) and one of the source files (extra const declaration).
The next step is to disable the IPv4 DHCP client for the Ethernet adapter's interface eth0. After a little reverse engineering, I found this state was controlled by /data/misc/ethernet/ipconfig.txt, and there is already a tool I can use to generate configurations.
https://github.com/jhswartz/ipconfigstore
I just feed it an empty static assignment and DHCP is then disabled.
Code:
ipAssignment: STATIC
id: 0
Next was to cross-compile radvd to support RA for IPv6. Modern versions of OpenWRT support spoofing so you don't need this, but everything else requires you run a RA server from the gateway device. I needed to use android-ifaddrs to get around an unsupported feature in the NDK. The version I built expects the config to exist at /sdcard/radvd.conf.
Now comes the scripting to make everything work. I made an application for this, but you can also accomplish this with something like Tasker or even run it manually.
At boot:
*Launch radvd as a root daemon
*Start your VPN
*Delete the file /sdcard/tether.state
*Execute tether.sh as root
On Intent.ACTION_POWER_CONNECTED:
*Execute tether.sh as root
tether.state keeps the script from applying NAT rules more than once, so the connection is just restored when the script is re-ran.
Code:
#!/system/bin/sh
echo 'Waiting for tether interfaces'
for waitTime in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
do
if [ -d '/sys/class/net/eth0' ] && [ -d '/sys/class/net/tun0' ] ; then break ; fi
echo "$waitTime"
sleep 1
done
sleep 2
if [ -d '/sys/class/net/eth0' ] && [ -d '/sys/class/net/tun0' ]
then
echo 'Preparing tether interface'
ip link set dev eth0 down
ip link set dev eth0 mtu 1280
sysctl -w net.ipv6.conf.eth0.mtu=1280
sysctl -w net.ipv6.conf.eth0.autoconf=0
sysctl -w net.ipv6.conf.eth0.accept_ra=0
ip addr flush dev eth0
echo 'Setting IP addresses'
ip -6 addr add fd00::1/64 dev eth0 scope global
ndc interface setcfg eth0 192.168.42.129 24 up
echo 'Waiting for interface to come up'
for waitTime in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
do
if [ "$(cat /sys/class/net/eth0/operstate)" = 'up' ] ; then break ; fi
echo "$waitTime"
sleep 1
done
sleep 3
ip -6 route add fd00::/64 dev eth0 src fd00::1
echo 'Enabling IP forwarding'
ndc ipfwd enable tethering
echo 'Adding marked routes'
ndc network interface add 99 eth0
ndc network route add 99 eth0 192.168.42.0/24
ndc network route add 99 eth0 fd00::/64
ndc network route add 99 eth0 fe80::/64
if [ ! -f '/sdcard/tether.state' ]
then
echo 'Setting up NAT'
touch /sdcard/tether.state
ndc nat enable eth0 tun0 99
ndc ipfwd add eth0 tun0
ip6tables -t nat -N natctrl_nat_POSTROUTING
ip6tables -t nat -A POSTROUTING -j natctrl_nat_POSTROUTING
ip6tables -t nat -A natctrl_nat_POSTROUTING -o tun0 -j MASQUERADE
ip6tables -t filter -A natctrl_FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -g natctrl_tether_counters
ip6tables -t filter -A natctrl_FORWARD -i eth0 -o tun0 -m state --state INVALID -j DROP
ip6tables -t filter -A natctrl_FORWARD -i eth0 -o tun0 -g natctrl_tether_counters
ip6tables -t filter -A natctrl_FORWARD -j DROP
fi
else
echo 'Skipping operation, USB not connected'
fi
eth0 is the Ethernet adapter and tun0 is the VPN interface. I also use a very similar script to do the same thing with RNDIS, you can setup all kinds of interesting tethering setups with these commands. If you want to run DHCP on the phone for use with a switch or cross-over cable or whatever, this command should work as root:
Code:
dnsmasq --keep-in-foreground --no-resolv --no-poll --dhcp-authoritative --dhcp-range=192.168.42.10,192.168.42.99,1h --dhcp-option=6,8.8.8.8,8.8.4.4 --dhcp-option-force=43,ANDROID_METERED --dhcp-leasefile=/sdcard/dnsmasq.leases --pid-file=/sdcard/dnsmasq.pid --listen-mark 0xf0063
Since this is a powered tethering setup, you probably want to use something to control charging:
https://play.google.com/store/apps/details?id=com.slash.batterychargelimit&hl=en&gl=US
On the router, set it's IP to 192.168.42.1, gateway to 192.168.42.129, DNS servers, and DHCP range to 192.168.42.10-192.168.42.99. Disable IPv6 support if it has it. Don't plug anything into the WAN (yellow) port, the phone connects to LAN.
Moto E5 Play kernel with IPv6 NAT support
https://drive.google.com/file/d/15IDtuuOn60bgw5FHVnoacexe2fjzuHcg/view?usp=sharing
ipconfig.txt, radvd, radvd.conf, tether.sh
https://drive.google.com/file/d/18YL4rYyF9tFu34WI_wzBLNtiUDp9U7_a/view?usp=sharing
I wrote an app to manage this, but it still needs a bit of work to handle custom configurations.

fddm said:
This is a guide for tethering over USB Ethernet adapter. The purpose of this is to reliably USB tether to any router, without the need for a USB port or stable USB/RNDIS support(Broadcom MIPS is particularly bad). USB-OTG-ACA means the phone is powered externally while also operating in host mode. I used a cheap micro-USB Y-cable for this that lets me plug in a power source, USB Ethernet adapter, and phone together. IPv6 is supported via masquerading, so you share public IPs with your phone(thus hiding devices behind it). In this example I tether to a VPN tun0 interface, but you can tether to and from any interface you want.
This guide is targeted to more advanced users, but I included a E5 Play kernel and the files required at the bottom of this post for those who wouldn't be able to try this otherwise.
The first step is to enable the kernel IPv6 NAT table, with iptables and masquerading support. To do this I used LSM Kernel. My device is the E5 Play, steps for other devices are a little different.
https://forum.xda-developers.com/moto-e5/development/kernel-lowspecmoto-kernel-v0-1a-t3882378
These need to be set in james_defconfig. You can also enable any necessary kernel modules for your Ethernet adapter here.
Code:
CONFIG_NF_NAT_IPV6=y
CONFIG_IP6_NF_TARGET_MASQUERADE=y
CONFIG_IP6_NF_NAT=y
I had to disable the WireGuard install script and use jury_rig.sh instead, as well as fix a minor typo in the build script(misspelled and erroneous compile command) and one of the source files (extra const declaration).
The next step is to disable the IPv4 DHCP client for the Ethernet adapter's interface eth0. After a little reverse engineering, I found this state was controlled by /data/misc/ethernet/ipconfig.txt, and there is already a tool I can use to generate configurations.
https://github.com/jhswartz/ipconfigstore
I just feed it an empty static assignment and DHCP is then disabled.
Code:
ipAssignment: STATIC
id: 0
Next was to cross-compile radvd to support RA for IPv6. Modern versions of OpenWRT support spoofing so you don't need this, but everything else requires you run a RA server from the gateway device. I needed to use android-ifaddrs to get around an unsupported feature in the NDK. The version I built expects the config to exist at /sdcard/radvd.conf.
Now comes the scripting to make everything work. I made an application for this, but you can also accomplish this with something like Tasker or even run it manually.
At boot:
*Launch radvd as a root daemon
*Start your VPN
*Delete the file /sdcard/tether.state
*Execute tether.sh as root
On Intent.ACTION_POWER_CONNECTED:
*Execute tether.sh as root
tether.state keeps the script from applying NAT rules more than once, so the connection is just restored when the script is re-ran.
Code:
#!/system/bin/sh
echo 'Waiting for tether interfaces'
for waitTime in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
do
if [ -d '/sys/class/net/eth0' ] && [ -d '/sys/class/net/tun0' ] ; then break ; fi
echo "$waitTime"
sleep 1
done
sleep 2
if [ -d '/sys/class/net/eth0' ] && [ -d '/sys/class/net/tun0' ]
then
echo 'Preparing tether interface'
ip link set dev eth0 down
ip link set dev eth0 mtu 1280
sysctl -w net.ipv6.conf.eth0.mtu=1280
sysctl -w net.ipv6.conf.eth0.autoconf=0
sysctl -w net.ipv6.conf.eth0.accept_ra=0
ip addr flush dev eth0
echo 'Setting IP addresses'
ip -6 addr add fd00::1/64 dev eth0 scope global
ndc interface setcfg eth0 192.168.42.129 24 up
echo 'Waiting for interface to come up'
for waitTime in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
do
if [ "$(cat /sys/class/net/eth0/operstate)" = 'up' ] ; then break ; fi
echo "$waitTime"
sleep 1
done
sleep 3
ip -6 route add fd00::/64 dev eth0 src fd00::1
echo 'Enabling IP forwarding'
ndc ipfwd enable tethering
echo 'Adding marked routes'
ndc network interface add 99 eth0
ndc network route add 99 eth0 192.168.42.0/24
ndc network route add 99 eth0 fd00::/64
ndc network route add 99 eth0 fe80::/64
if [ ! -f '/sdcard/tether.state' ]
then
echo 'Setting up NAT'
touch /sdcard/tether.state
ndc nat enable eth0 tun0 99
ndc ipfwd add eth0 tun0
ip6tables -t nat -N natctrl_nat_POSTROUTING
ip6tables -t nat -A POSTROUTING -j natctrl_nat_POSTROUTING
ip6tables -t nat -A natctrl_nat_POSTROUTING -o tun0 -j MASQUERADE
ip6tables -t filter -A natctrl_FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -g natctrl_tether_counters
ip6tables -t filter -A natctrl_FORWARD -i eth0 -o tun0 -m state --state INVALID -j DROP
ip6tables -t filter -A natctrl_FORWARD -i eth0 -o tun0 -g natctrl_tether_counters
ip6tables -t filter -A natctrl_FORWARD -j DROP
fi
else
echo 'Skipping operation, USB not connected'
fi
eth0 is the Ethernet adapter and tun0 is the VPN interface. I also use a very similar script to do the same thing with RNDIS, you can setup all kinds of interesting tethering setups with these commands. If you want to run DHCP on the phone for use with a switch or cross-over cable or whatever, this command should work as root:
Code:
dnsmasq --keep-in-foreground --no-resolv --no-poll --dhcp-authoritative --dhcp-range=192.168.42.10,192.168.42.99,1h --dhcp-option=6,8.8.8.8,8.8.4.4 --dhcp-option-force=43,ANDROID_METERED --dhcp-leasefile=/sdcard/dnsmasq.leases --pid-file=/sdcard/dnsmasq.pid --listen-mark 0xf0063
Since this is a powered tethering setup, you probably want to use something to control charging:
https://play.google.com/store/apps/details?id=com.slash.batterychargelimit&hl=en&gl=US
On the router, set it's IP to 192.168.42.1, gateway to 192.168.42.129, DNS servers, and DHCP range to 192.168.42.10-192.168.42.99. Disable IPv6 support if it has it. Don't plug anything into the WAN (yellow) port, the phone connects to LAN.
Moto E5 Play kernel with IPv6 NAT support
https://drive.google.com/file/d/15IDtuuOn60bgw5FHVnoacexe2fjzuHcg/view?usp=sharing
ipconfig.txt, radvd, radvd.conf, tether.sh
https://drive.google.com/file/d/18YL4rYyF9tFu34WI_wzBLNtiUDp9U7_a/view?usp=sharing
I wrote an app to manage this, but it still needs a bit of work to handle custom configurations.
Click to expand...
Click to collapse
For those who don't have a kernel with the network modules you've mentioned, but want to get ipv6 working (thinking of Tmobile) and have access to openwrt router, would adding the mentioned ip6tables command work?
In my router, I added something like this,
ip6tables -t mangle -I POSTROUTING -o usb0 -j HL --hl-set 65
but ipv6 connection didn't work. If I remove that line from the router firewall, then ipv6 connection works but it counts as tethered.

aznxwill said:
For those who don't have a kernel with the network modules you've mentioned, but want to get ipv6 working (thinking of Tmobile) and have access to openwrt router, would adding the mentioned ip6tables command work?
In my router, I added something like this,
ip6tables -t mangle -I POSTROUTING -o usb0 -j HL --hl-set 65
but ipv6 connection didn't work. If I remove that line from the router firewall, then ipv6 connection works but it counts as tethered.
Click to expand...
Click to collapse
One option is to use your phone's native tether and set up IPv6 nat on your router. This will make your iptables rule work and only requires provisioning and dun bypasses on the phone. The downside is your tethered traffic will go through a separate IPv6 address from your phone, so it's more risky.
The other option is to proxy, but getting UDP support is a real hurdle. Ideas are porting Shadowsocks or one of those Socks5 proxies written in Go. Adding UDP support to microsocks is also possible, but way more work. You'd use the Shadowsocks client or transocks-wong on the router to serve clients with no knowledge of the proxy.
Edit: also, what phone/rom/router are you working with?

fddm said:
One option is to use your phone's native tether and set up IPv6 nat on your router. This will make your iptables rule work and only requires provisioning and dun bypasses on the phone. The downside is your tethered traffic will go through a separate IPv6 address from your phone, so it's more risky.
The other option is to proxy, but getting UDP support is a real hurdle. Ideas are porting Shadowsocks or one of those Socks5 proxies written in Go. Adding UDP support to microsocks is also possible, but way more work. You'd use the Shadowsocks client or transocks-wong on the router to serve clients with no knowledge of the proxy.
Edit: also, what phone/rom/router are you working with?
Click to expand...
Click to collapse
I'm working with OnePlus 8 (phone) + GL.iNET MT-1300 (router) on TMO network.
I am able to get USB tethering to work with the router for IPv4. My setup is as follows:
Phone (USB) <---> MT-1300 (router) <---> clients (PC/phones/TVs)
For IPv4, I added the following line to router firewall:
iptables -t mangle -I POSTROUTING -o usb0 -j TTL --ttl-set 65
Click to expand...
Click to collapse
Currently trying to figure out IPv6...

This is the guide to enable nat6 on openwrt:
NAT66 and IPv6 masquerading
NAT66 and IPv6 masquerading This article relies on the following: * Accessing web interface / command-line interface * Managing configs / packages / services / logs Introduction * This how-to describes the method for setting up NAT66 aka NAT6 with IPv6 masquerading on your OpenWrt...
openwrt.org
Make sure usb0 is bridged to wan, not lan. Then your iptables rule will work.