20

I'd like to be able to connect my Android phone to public Wi-Fi points (some with unencrypted connections), but:

  1. People can see what I'm doing by intercepting unencrypted radio transmissions
  2. The AP owner or other people logged into it can see what I'm doing
  3. Hackers can pretend to be the access point and carry out man-in-the-middle attacks

There are tools like Wi-Fi Ruler and WeFi to automatically connect to access points, but I don't trust random APs. I'd like all my traffic to go through an encrypted tunnel to my home router, and from there out to the Internet.

I've done such tunnels from other computers with SSH/SOCKS and PPTP before. Is there any way to do this with Android?

More specifically:

I'm willing to change the router firmware, but I was having issues with DD-WRT disconnecting, which is why I'm using Tomato. Some possible solutions:

SSH with dynamic SOCKS proxy:

  • Android supposedly supports this through ConnectBot, but I don't know how to get it to route all traffic.
  • Tomato supports this natively.

I've been using this with Tunnelier for my web browsing at work. Requires setting up each app to go through the proxy, though.

PPTP:

  • Android supports this natively.
  • Tomato does not support this, unless you get the jyavenard mod and compile it?

I previously used PPTP for web browsing at work and in China because it's native in Windows and DD-WRT. After a while I started having problems with it, then I started having problems with DD-WRT, so I switched to the SSH tunnel instead. Also it supposedly has security flaws, but I don't understand how big of a problem it is.

IPSec L2TP:

  • Android (phone) and Windows (work/China) both support this natively
  • I don't know of a router that does. I could run it on my computer using openswan, but then there are two points of failure.

OpenVPN:

I could also run a VPN server on my desktop, I guess, though that's less reliable and presumably slower than running it in the router itself. I could change the router firmware, but I'm wary of more fundamental things breaking. Tomato has been problem-free for the regular stuff.

Related: Anyone set up a SSH tunnel to their (rooted) G1 for browsing?

Improve this question
0

2 Answers 2

Reset to default
4

You can configure android to use a proxy server. But you must do it either from the adb client, or from the terminal in a rooted g1.

  1. > adb shell
  2. # sqlite3 /data/data/com.google.android.providers.settings/databases/settings.db
  3. sqlite> INSERT INTO system VALUES(99,’http_proxy', 'proxy:port');
  4. sqlite>.exit

read about @ http://discuz-android.blogspot.com/2008/01/set-proxy-for-android-web-browser.html

Improve this answer
1
  • This is just for the stock Android web browser, right? I want every communication from any app to be tunneled.
    – endolith
    Jan 16, 2012 at 19:21
2

You can use connectbot to tunnel your connection over SSH.

Improve this answer
8
  • 1
    Really? I know how to use Connectbot to log into an SSH server, but how do I configure it to tunnel everything through that connection?
    – endolith
    Oct 30, 2009 at 16:33
  • 1
    I use it sometimes with android-vnc-viewer, check FAQ question #8: code.google.com/p/android-vnc-viewer/wiki/faq "...We recommend you tunnel your VNC connection over SSH with connectbot. Set up your connectbot connection to the server hosting your VNC server, and configure a tunnel to forward port 5900. Then you can set up an android-vnc-viewer connection to 5900 on localhost..." Something similar can be done to tunnel especific data.
    – Macarse
    Oct 31, 2009 at 15:53
  • Ah, cool. That doesn't cover sending everything over the SSH tunnel, though. I asked the same question over here: forceclose.com/questions/369/… Maybe you want to add your answer?
    – endolith
    Nov 1, 2009 at 14:29
  • 1
    I just added :D
    – Macarse
    Nov 2, 2009 at 10:14
  • 1
    in ConnectBot's Hosts lists: - Long press on a user@host line. - Edit port forwards. - menu - Add port forward. - Complete the form.
    – Macarse
    Nov 2, 2009 at 20:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .