Reverse Tether - Samsung Galaxy Player 4.0, 5.0

I currently run Paranoid Android on my SG5, which works well enough for my tastes. One thing I've wanted to play with is reverse tethering. Since I charge my player via the computer's usb connection, I figured it'd make sense to disable wifi and save a little power to speed up the slow usb charging and just use the pc's internet connection via usb. I also have a few apps like calibre and the compantion app which don't work correctly when I'm on a wifi connection that's been firewalled to prevent devices from communicating with each other. This bypasses the wifi connection and gives me a nice secure connection between devices.
I got it working ... mostly. I don't expect many people to find this useful, but I thought it might be an entertaining hack to poke at.
The following script sits on my linux netbooks' ~/bin directory as reverse-tether.sh
Code:
#!/bin/sh
# We need root on the host to mess with networking
if [[ $(whoami) != "root" ]]; then
echo "You must be root to run this script!"
exit 1
fi;
# We need root on the Player to mess with networking
echo 'Enabling adb root access...'
adb -d root
# Turn on usb networking
echo 'Enabling usb network interface on the Galaxy Player...'
adb -d shell 'sh /storage/sdcard0/reverse_tether.sh up &'
# adb disconnects, so we wait for the network on the player to settle before continuing on.
sleep 2
# Rename device interface as ArchLinux has annoying device names (becomes player)
IF=`ifconfig -a | grep "enp" | cut -d ':' -f 1`
ip link set dev $IF down
/usr/sbin/ifrename -i $IF -n player
ip link set dev player up
echo 'Setting Computer IP Address ...'
ifconfig player 192.168.200.1 netmask 255.255.255.0
ifconfig player up
echo 'Enabling NAT and IP Forwarding on Computer...'
# Start forwarding and nat (use existing default gw)
iptables -F -t nat
iptables -A POSTROUTING -t nat -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 'Starting dnsmasq on Computer...'
dnsmasq --interface=player --no-dhcp-interface=player
echo
echo 'Connection is ready! Press any key to shutdown.'
echo
read
echo 'Shutting down reverse tethering'
# SSH server is always running on player, with public rsa key imported for passwordless logins
# This hackery is required as adb seems to be disabled with rndis active.
# I use dropbear server II, but any of the ssh servers would probably work.
ssh [email protected] 'sh /storage/sdcard0/reverse_tether.sh down &'
killall dnsmasq
ifconfig player down
iptables -F -t nat
echo 0 > /proc/sys/net/ipv4/ip_forward
And the following script is simply stashed on the sdcard of the player. as /storage/sdcard0/reverse_tether.sh
Code:
#!/system/bin/sh
if [ "$1" = "up" ]; then
echo 1 > /sys/class/usb_composite/rndis/enable
ip addr add 192.168.200.2/24 dev usb0
ip link set usb0 up
ip route delete default
ip route add default via 192.168.200.1
setprop net.dns1 192.168.200.1
fi
if [ "$1" = "down" ]; then
sleep 2
ip route delete default
ip link set usb0 down
echo 0 > /sys/class/usb_composite/rndis/enable
fi
When I finish, sometimes I need to restart wifi on the player to get networking to work again.
The only real problem I've had is that some apps require or want wifi/3g active in order to fully function. For example, the play store works fine until you try and download an actual update. Google Maps works fine, although you get lots of warnings about having wifi turned off. I have no idea how to "emulate" 3g or wifi which I think would solve that problem.
This was fun getting running. Hope you enjoyed...

I know this is an old thread but I found this really really useful. Going to give it a try after work today. Great job.
Sent from my YP-G70 using xda app-developers app

Related

[howto][script] peek at DNS queries

Here's a script I use to track all DNS queries any Android app is doing.
It will show which hostnames some app is about to contact for resources, including, but not limited to adverts, updates, rogue hosts, thumbnail images, news sources etc.
Prerequisites:
- rooted device with busybox installed
- a DNS resolver with readable logs. This usually means a local "bind9" installation within the LAN.
- optional: "Script Manager" installed. Makes it easy to experiment and run on network change events.
Code:
#!/system/bin/sh
# trying to direct dns queries to
# private dns resolver in LAN
dns="net.dns"
dns_dflt="${1:-192.168.2.1}"
dns2="${2:-${dns}2}"
boss="${3:-192.168.2.55}"
dns_1=$(getprop "${dns}1")
ex=$?
dns_chg=$(getprop 'net.dnschange')
ex=$(($ex + $?))
echo "$0: id=$(id);dns_1='${dns_1}'"
ping -c1 -w3 "${boss}" &&
case "-${dns_1}" in
-${dns_dflt})
echo "$0: setprop"
setprop "${dns}1" "${boss}"
ex=$(($ex + $?))
setprop "${dns2}" "${dns_1}"
ex=$(($ex + $?))
setprop "net.dnschange" "$((${dns_chg} + 1))"
ex=$(($ex + $?))
;;
esac
getprop | grep 'dns' || :
[ $ex -ne 0 ] && echo "$? setprop '$1' '$2'"
exit $ex
run as root admin user and tick "on network". The output is a list of all current DNS related settings after the script has run.
I use it with the following arguments, which are valid for the "netgear" wlan router and my PCs IP:
192.168.2.1 net.dns2 192.168.2.55
the first is the IP of the DNS server set up in the DHCP lease sent from the router (never changes, used for plausibility test);
the second is the getprop property where the original DNS server will be stored in;
the third is the IP of my own DNS resolver whose logs I can check.
The script makes sure that the resolver is reachable (ping) and that Androids DNS settings are only mutilated when they match expected values (1st argument).

[Q] Networking question

Hi All,
I have a stupid Juniper VPN device at work which does not support 64 bit linux clients using netconnect. I have found ways around this previously, but now we are setting up 2 factor auth which throws a lot of javascript into the mix, making the scripts I used pretty much obsolete. The Junos pulse client works well for android, so I am thinking I want to use an android device as a router. Connecting to the VPN and using wifi tethering does not work, same with USB tethering does not work, and those are not exactly what I want anyway.
So basically I want to be able to connect my android device to my wifi here at home, connect to the VPN on it, run a script to do my setup on the Android device, lastly add a route on my client pc to tunnel through the android device. here is what I tried so far on the device:
Code:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -P FORWARD ACCEPT
iptables -t nat -I POSTROUTING -s 192.168.0.0/16 -d 10.0.0.0/8 -j MASQUERADE
ip rule add from all to 10.0.0.0/8 fwmark 0x3c lookup 60
and on the client PC:
Code:
route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.1.29
where 192.168.1.29 is the IP of my android device, and 10.0.0.0/8(I know its lazy) is the IP range I want to go through tun0 on the device. This is however not working.
The only thing I need to do on a standard linux box to do this would be:
Code:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -I POSTROUTING -s 192.168.0.0/16 -d 10.0.0.0/8 -j MASQUERADE
And setup the same route command on the client but point it at the linux box instead. This currently works, but when we decide to flip the switch and use the 2 factor auth only I will not be able to make it work on a standard linux box, but 2 factor does work on android via the Junos app.
I fear I am missing something simple in Android land, please help...

[Q]Android OpenVPN gateway for USB tether

Now before I get flamed for a duplicate post, I have already searched this topic. I found 2 threads here, one of which has a few different methods, and a few others elsewhere on the net. I've tried all of them, literally. Every guide I could find relating to passing USB Tethered traffic through my phone's OpenVPN connection. I figure I must be doing something wrong somewhere in my iptables.
Some info about my setup:
Phone: Samsung Galaxy S5 - Rooted via Towelroot, SuperUser updated, RootCheck confirmed rooted
Interfaces from 'netcfg': wifi = wlan0, usb tether = rndis0, Cellular data = rmnet0, OpenVPN tunnel = tun0
VPN network = 10.0.1.0/24
USB Tethered network = 192.168.42.0/24
Wifi Tethered network = 192.168.43.0/24
LAN network (on other side of VPN) = 10.0.0.0/8
Firewall/OpenVPN server = pfSense
OS of Client attempting to connect through VPN = Windows 7
I am trying to use my phone as an OpenVPN gateway because I require a connection to my home network, and I have insufficient permission to install the OpenVPN client on the machine I am trying to connect back home with. Even though I cannot install the OpenVPN client/Tun/tap network interface, it does allow my phone's rndis interface to be installed.
And this is what I have tried so far:
iptables -- flush
iptables -A POSTROUTING -o tun0 -j MASQUERADE -t nat
iptables -A FORWARD -i tun0 -o rndis0 -m state --state RELATED,ESTABLISHED -j RETURN
iptables -A FORWARD -i rndis0 -o tun0 -m state --state INVALID -j DROP
iptables -A FORWARD -i rndis0 -o tun0 -j RETURN
And This:
iptables --flush
iptables -A POSTROUTING -s 192.168.42.0/24 -j MASQUERADE -t nat
iptables -A FORWARD -j ACCEPT -i rndis0 -o tun0
iptables -A FORWARD -j ACCEPT -i tun0 -o rndis0
Neither one seems to work. I tried the former earlier and couldnt tell if it worked or just screwed everything up, as I couldnt connect to anything on my home LAN or the internet.
Any help is greatly appreciated. I don't know if I need to add a rule on the pfSense firewall to handle traffic from 192.168.42.0/24 or not, I havn't seen that mentioned anywhere.
Hey, I know this is a little old, but did you get anywhere?
I'm too trying to get traffic from the tethered device to be routed via the phone's VPN connection.
Thanks

[SOLVED] Weird NAT issues when trying to tether via VPN

Hi, I recently wrote a program in C/C++ which allows me to tunnel over ICMP (my carrier stupidly allows ICMP traffic over 3g with the right APN )
All works fine if im using it from the phone, using the NDK compiled binary.
Also works fine if im not running the tunnel from my phone and just tethering via usb/wifi/bt and running the tunnelling program on the device tethered to my s3
What I'm trying to achieve is: run the tunnelling prog on the phone, and set up some iptables rules to forward rndis0/wlan0/bt-pan to tun0 so that I can use the tunnelled connection simultaneously on the phone and on whatever other devices are tethered to the phone.
Problem is, whilst running the program on the phone, I can access all sites/ips fine, but the connection provided to the tethered devices with the iptables rules is flaky at best, and simply will not connect to some sites at all
Possibly netmask issue?
Assuming my default gateway on the phone is set to the tunnel endpoint, here are the iptables rules I am using to NAT the tetherable interfaces:
iptables -F natctrl_FORWARD
iptables -A FORWARD -o tun0 -i bt-pan -s 192.168.44.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o tun0 -i wlan0 -s 192.168.43.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o tun0 -i rndis0 -s 192.168.42.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
strangely I can ping ok, and access sites like google and facebook but most other sites will not load.
Have done tracepath so I know the packets are going through the tunnel.
Anyone able to shed any light on this?
Alternatively, could it be possible to edit the default tethering scripts on the s3 to use the tun0 device instead of rmnet0 ? Will search them and try
Going to roll my NDK executable into a shared library and make it into a paid app.
Used 10gb in 2 days on a SIM which has never and will never have credit. Also works whilst roaming!
Jamie
Issue was that the MTU of wlan0/bt-pan/rndis0 was larger than that of the tunnel, causing packets to fragment. Lowered mtu and problem solved, working beautifully now

Iptables

Hello together,
I have a question about iptables in android. I have some rootet smartphones and I like to block some ip address ranges
for wifi, mobil, and vpn. I dont like to have a app for this, because the phones are for a company and the user should not deinstall the firewall apps like afwall and so on.
So is there a way to write a bash file maybe and start it also after a reboot like in linux ?
Hope someone can help me.
thanks ...
micky1067
Custom iptables rules
This assumes that you have iptables in your kernel (netfilter). You can write a bash script and put it into init to load at startup however in android the starting of network devices zero all the rules so that would also need to be changed, in addition a program like AFWall uses iptables to run so you would need to make sure that you do not conflict with them. Any other firewall that does not use Iptables will only be on top of this. The way to do this is to make your own set of rules (chains) which are not touched by the other programs and load them in first. IPTables chains work that it prosesses them in order and if it is matched executes the rule and if not continues so as long as there is no rule to block everything the chain only adds. For example to block local addresses on wifi facebook on 4G and VPN on both do this
1. $IPTABLES -N mychain
2. $IPTABLES -A mychain -i wimax+ -d 10.0.0.0/8 -j DROP
3. $IPTABLES -A mychain -i wimax+ -m iprange --src-range 172.16.0.0-172.31.0.0 -j DROP
4. $IPTABLES -A mychain -i rmnet+ -s 185.60.216.35 -j DROP
5. $IPTABLES -A mychain -i rmnet+ -d 157.240.20.35 -j DROP
6. $IPTABLES -A mychain -m multiport 500,1194 -s -j REJECT --reject-with tcp-reset
7. $IPTABLES -A mychain -m multiport 500,1194 -d -j REJECT --reject-with tcp-reset
8. $IPTABLES -I mychain
Explanation: 1. makes a new chain or set of rules 2-3 adds rules to the chain using interface (-i) (wifi) one rule for destination (-d) another for source (-s) to drop 4-5 adds rules to the chain using interface (-i) (4g) one rule for destination (-d) and one rule for source (-s) to drop (blocks only one of facebook addresses) 6-7 adds rules for openVPN protocols (-m multiport) to reject with a reset package 8. inserts the chain to be used in IPTables first.
You can also use REJECT instead of DROP but that is outside the scope of this post when and if to use DROP /REJECT. You can also specify your internet interfaces instead of using the generic ones.
for more information see IPTables man pages and tutorial and the wiki of AFWALL

Categories

Resources