Can I share my Android's VPN connection over a Hotspot?

Question

I recently purchased a Chromebook which doesn't support my companies PPTP VPN. As a workaround, would it be possible to connect to the VPN on my Android (4.4) and share that connection over a hotspot? If so, how?

Answer 1

Unfortunately the stock Android tethering application does not work with VPNs. This limitation is an oversight in the software and not a system limitation.

However there is an application called ClockworkMod Tether that will allow you to tether and use a VPN at the same time. In fact it makes use of the standard tethering application and then fixes up the routing information to make it work.

This application does not require you to root your phone but you do need to run software on the computer that you wish to connect to your phone. Also this only works for USB tethering at the moment.

There are other alternatives to ClockworkMod Tether, if you wish to try them, including PDANet.

Hope it could help

Answer 2

I found some information that consists of adding iptables rules using command-line in your rooted device.

I tested it on my Android 4.4 on Blu studio and it works fine.

Quoted text originally written by SmokeyTech1 of XDA-Developers here:

1. You need a rooted device
2. Make sure you have a VPN app, like OpenVPN or DroidVPN ( I use DroidVPN and its the best)
3. Download Terminal Emulator
4. Activate your hotspot and connect to your VPN
5. Launch Terminal emulator and on the first line type "su" (without the quotes) and press enter

6. Copy and paste this to the Terminal Emulator. Make sure to paste to a new folder using Root Browser first and copy to T.E. in the exact format as shown below:

   iptables -t filter -F FORWARD
   iptables -t nat -F POSTROUTING
   iptables -t filter -I FORWARD -j ACCEPT
   iptables -t nat -I POSTROUTING -j MASQUERADE
   ip rule add from 192.168.43.0/24 lookup 61
   ip route add default dev tun0 scope link table 61
   ip route add 192.168.43.0/24 dev wlan0 scope link table 61
   ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61

7. That's about it. Also, be sure to make a folder with Root Browser and paste the code there, as this resets after re-boot. It worked on my LG G3 on android 4.4.2

_{(Note: Quoted text has been edited to fit the site's formatting style.)}

ATTENTION: Part of the rules where it says wlan0, this is interface that corresponds to where you want send the connection. To send it to the WiFi hotspot, replace it with ap0 The tun0 is the VPN tunnel that you receive from the remote server. You can list all the interfaces typing netcfg the root terminal

As for terminal emulator, I use ConnectBot:

ConnectBot allows a terminal emulator on your device for connections ssh, telnet and localhost.

Answer 3

Yes. F-Secure Freedome (a VPN client) is running on my Note 2. I have Note 2 tethered to an Ubuntu machine and an Android tablet. My tablet and laptop post a Germany IP address, while I am on the other side of the ocean.

• Make sure that your data plan allows tethering.
• Make sure that you are on the cell network. However, USB tether to Wifi VPN on the phone works a bit better. I keep my connection dropped when going all over over the air.
• Depending on your flavor of Android your mileage may vary

Note 2 and the tablet are running 4.4 (CM 11 nightlies), Ubuntu is on 14.04.

Answer 4

1. On Android device, install:

   • Proxoid (run on port 8081).
   • Internet Sharer (HTTP: 8080, SOCKS: 1080).
   • Ping & DNS (I need IP address of mobile phone)
2. Tether Chromebook and phone by USB cable.
3. Run:
   • Mobile internet connection
   • VPN client
   • Proxoid
   • Internet Sharer
4. Set mobile to tether USB connection (check the icon of USB connection on mobile changed).
5. Find phone IP address (Ping & DNS, Network Info, IP: xxx.xxx.xxx.xxx, internet connection must be active)
6. On Chromebook, log in, check internet connection, WiFi should be automatically replaced by USB Ethernet.
7. Click the ethernet icon, Settings, proxy TAB.
8. Finally set on Chromebook (HTTP proxy host: IP in form xxx.xxx.xxx.xxx, port 8080, HTTPS proxy host IP, port 8081, SOCKS proxy IP, port 1080).
9. Try to run Chrome and browse intranet (as in mobile).

Answer 5

This is an extension to the answer provided by João José that would allow you to selectively direct certain traffic to VPN while letting other go directly.

I wouldn't have figured it out without João José's brilliant answer so if you will upvote this, please upvote his answer as well.

# Following rules will allow me to redirect traffic through my vpn
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE

ip route add 192.168.43.0/24 dev wlan0 scope link table 61
ip rule add fwmark 0x61 table 61
ip rule add iif tun0 table 61

# Configure traffic that I want to make it go through VPN
# 1. My DNS
iptables -t mangle -A PREROUTING -p tcp -d 208.67.220.220/32 -j MARK --set-xmark 0x61
iptables -t mangle -A PREROUTING -p tcp -d 208.67.222.222/32 -j MARK --set-xmark 0x61
iptables -t mangle -A PREROUTING -p udp -d 208.67.220.220/32 -j MARK --set-xmark 0x61
iptables -t mangle -A PREROUTING -p udp -d 208.67.222.222/32 -j MARK --set-xmark 0x61
# 2. Insecure websites
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-xmark 0x61