How to share VPN connection with devices on hotspot?

Question

I use a VPN on my Galaxy S8+ and I am looking for a way to be able to share my ExpressVPN connection via hotspot to be able to connect devices such as Xbox One and a Smart TV. Currently cannot use a PC and my router is trash so my phone is the last resort. What can I do? What are some workarounds?

Answer 1

Android doesn't redirect hotspot traffic through VPN network as far as I have tested on Pie ROM (almost stock; custom ROMs might have different implementations or some specific settings). The reason is VPNService API works in Java framework of Android to redirect traffic to VPN's tun interface based on UIDs (and/or SOcket MARKs) of apps. While tethering works in native code; dnsmasq is the DNS server (up to Pie) while the rest of traffic is handled by kernel directly. Also using same internet connection or VPN for multiple devices may break terms of contract with service providers. So it's left disabled by default.

A workaround is to modify routing table but it requires root and is a bit complex on Android. This works for me:

~# ip rule add iif wlan0 lookup table 5000
~# ip route add default dev tun0 table 5000
~# ip rule add to 192.168.43.0/24 lookup table 5001
~# ip route add default dev wlan0 table 5001

• First command adds a rule to RPDB to send traffic coming on hotspot (WiFi) interface to table 5000.
• Second command adds a route to routing table 5000 to send all traffic on tun0 interface i.e. the one used by VPN app.
• Third and fourth rules do inverse i.e. send traffic coming from VPN to tethered devices.

Firewall works above routing policy. Forwarding rules and source NAT should already be set with hotspot but just to make sure:

~# echo -n 1 >/proc/sys/net/ipv4/ip_forward
~# iptables -I FORWARD -o wlan0 -i tun0 -j ACCEPT
~# iptables -I FORWARD -i wlan0 -o tun0 -j ACCEPT
~# iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE

• First three commands instruct kernel/firewall to forward traffic in both directions in between VPN and hotspot interfaces.
• Fourth command sets SNAT i.e. keeps track of hotspot traffic leaving VPN interface and coming back.

Make sure interfaces names and IP address are correct as on your device.

Also there is VPN Hotspot but I haven't tried. For non-root devices there exist some Wi-Fi Direct (ad-hoc) based solutions like PdaNet which require setup on both sides.

RELATED: How to use Private DNS on Android Pie for tethering?

Answer 2

Another option would be to use a raspberry Pi as the router with one of its USB ports connected to your phone with the VPN-based internet connection. To provide the internet to other devices, the ethernet port of the Raspberry Pi can connect to a router/switch/bridge and/or also the Pi's own wifi could be used to broadcast it for wireless devices. Or a wireless access point could be added to the router attached to the Pi.

Here is an answer for using a Raspberry Pi tethered to a phone to enable its mobile network to be provided as an internet connection other devices:

Answer to: 4G LTE Device [USB Tethering]--> Raspberry Pi [Ethernet]--> Router, is this possible?

What this answer assumes is that your phone will support USB tethering and the VPN at the same time and that the VPN-based internet connection can be routed over that USB tethered connection to the USB host to which your phone is attatched.

If that is possible, then I can't foresee any other blockers, assuming that the steps described in that answer are correct (I haven't yet tried them).

If successful then that means you would not need to do any particular adjustments to your phone - possible examples of reduced hassle could be: less involved, less risk to 'bricking' the phone, less risk to banking apps stopping working due to rooting, also can use another phone without having to redo the steps on that.

Update

(Following a comment from @Irfan Latif here, I added a response comment, and updated my answer with it, here):

However, if VPN is not supported at the same time as USB tethering on your phone, then the next option you could try is to run the VPN on the Pi itself Other VPN providers, such as speedify.com also support the Raspberry Pi - and Speedify in particular can bond different network connections together should, say, the original poster want to use multiple phones etc as internet connection sources. I don't work for ExpressVPN nor Speedify nor have a financial interest or affiliation with them.

It's worth also noting that if you try this, then the settings in that linked answer above might need adjusting because they might have been written for a scenario that doesn't use a VPN. I say might - because they might still work - I don't know - I just want to bring your attention to it to minimise any frustration :) . With that in mind, the approach could be to get the steps working on your setup with the Raspberry Pi, without the VPN running. Then install ExpressVPN on the Raspberry Pi and see if it still works. By having tried without VPN first, you'll know that the Raspberry Pi can work as a router, so you have that and use that as the basis to get it working with the VPN. Maybe the VPN provider can support you, or at least they might be interested as there maybe others who want to do what you're aiming to achieve, so it saves them time supporting everyone on this as well giving them the edge on support and appealing to those who appreciate the adaptability - all good for their offering in the market.

Answer 3

In my case I have a Samsung tab which got bricked and lost its mobile network functionality. Now I wanted to tether the vpn connection to the phone that that wifi hotspoted to me. Turns out android specialises tethered packets(I mean connections from tethered clients cant be connection tracked by the system itself or blocked by normal android firewall apps but iptables can block it) so I used this to my advantage.

Turns out the solution is simple. Works on customizable vpns over tcp( for udp maybe u need to run a socks proxy server havent tried that).

1. Download any proxy server apps on playstore.
2. In my case I was using openvpn so you need a customisable openvpn client and go to the exclude routes options and enter the ip address of the phone that needs to connect to my proxy server.
3. Simply start the vpn connection and change wifi settings and add the ip an port of the proxy server and your are good to go or simply run a vpn over tcp using that proxy server on the phone you want to tether.

Note: In step 2 excluding routes is for my case or simply when you want to tether to the access point but if you are the one tethering there is no need to change routes. Also In my case I was able to run a vpn on my access point with it not cutting off my connection on the client phone like a vpn over a vpn.