2

I'm running marshmallow (6.0.1) rooted. I run the following commands

iptables -F

iptables -t filter -F FORWARD

iptables -t nat -F POSTROUTING

iptables -t filter -I FORWARD -j ACCEPT

iptables -t nat -I POSTROUTING -j MASQUERADE

ip rule add from 192.168.43.0/24 lookup 61

ip route add default dev tun0 scope link table 61

ip route add 192.168.43.0/24 dev wlan0 scope link table 61

ip route add broadcast 255.255.255.255 dev wlan0 scope link table 61

So I can tether the vpn connection. My problem is once tethered no new client can connect it stays at obtaining iptables address. How can I fix this?

1
  • Did you mean "stuck at obtaining IP address ? Commented Oct 21, 2017 at 12:18

1 Answer 1

0

Normally in plain hotspot mode (without VPN setup), clients will get an IP address from the phone's DHCP server.

However, when the OpenVPN client is running, by default it is redirecting all traffic to the OpenVPN server, meaning any client traffic is also being redirected. Hence, the clients aren't talking to the phone's DHCP server any more - they are talking to the OpenVPN server, and if that doesn't provide an IP address via DCHP then the clients connection attempts will "hang".

There are possible workaround to keep tethering functionality on other connecting clients:

  1. Using postrouting and forwarding rules

You can just add just post-routing and forwarding rules i.e

iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -A FORWARD -j ACCEPT
iptables -t nat -A POSTROUTING -j MASQUERADE

(this is the solution I'm using currently),


  1. Setup IP addresses manually

    • You may need to assign other clients IP manually (static IP address) to bypass DCHP server.

  1. Exclude hotspot subnet from tunnel
  • The fix is to identify the subnet used by the hotspot service and manually add it to Excluded Networks for the connection. i.e 192.168.43.0/24.

  • Now when the tunnel is initiated the hotspot subnet is always excluded from routing through the tunnel regardless of startup sequence and tethering always works.

or simply excluding 192.168.43.0/24 (and including 0.0.0.0/0) rules from iptables.

Acknowledgements

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .