[APP][ROOT][6+] Tether TPROXY v0.1 (USB, Wifi Hotspot, Ethernet)

[fddm]

Thanks for reporting back! Unfortunately you already have dun set in your primary APN, so that's not what is causing the issue here. I don't have a subscription to the VZW network and am unable to do testing for this issue. When you say that it doesn't work, is it that no traffic passes, that traffic counts towards your tethering allotment, or it's throttled down as if it were regular tethered traffic?

I take it that your app basically "proxifies/socksifies" traffic on the phone's tether interfaces to a local SOCKS5 proxy service/app on the phone.

That's right, it uses the iptables tproxy module supported on most modern Android phones to redirect tethered traffic through a local proxy. The idea is that packets are recreated on the phone with the correct TTL/HL and the origin of the traffic is obscured.

What's most interesting about this approach to me is that you could run the proxy server on the phone, tproxy server on an OpenWRT device, and connect them through an adb tunnel. This in theory would bypass entitlement, APN dun profile, and TTL/HL dpi detection - all with a phone that is in an entirely stock state.

For IPv6 "GUA" is global unicast addresses (Internet routable) and "ULA" is unique local addresses (private IP addresses). I am not sure why you would want to choose a ULA in this situation since the goal is Internet access. Are the IP addresses on that configuration screen in the screenshot above the local addresses for the SOCKS5 proxy? If so, would using a ULA address for its IPv6 address mean that the clients would also need ULA addresses to access it? If so, how would the clients get those addresses? Self-generate them or does that setting set dnsmasq to issue ULA IPv6's to the tethered clients? Since (if?) you are using a SOCKS5 proxy to send the Internet traffic I am not sure why you say above that using "ULA" for IPv6 will prefer IPv4 when the IPv4 address is also a private one. Why favor private IPv4 over private IPv6?

This setting effects the preferred protocol version for connected clients (per RFC 3484). GUA tells DNSMASQ to assign local IPs in the 2001:db8::/64 range, which is treated like a real public address, so clients will prefer sending their traffic through IPv6. ULA assigns addresses in the fd00::/64 range, so clients will send traffic through IPv4 by default.

 

[J0nhy]

Thanks for reporting back! Unfortunately you already have dun set in your primary APN, so that's not what is causing the issue here. I don't have a subscription to the VZW network and am unable to do testing for this issue. When you say that it doesn't work, is it that no traffic passes, that traffic counts towards your tethering allotment, or it's throttled down as if it were regular tethered traffic?


That's right, it uses the iptables tproxy module supported on most modern Android phones to redirect tethered traffic through a local proxy. The idea is that packets are recreated on the phone with the correct TTL/HL and the origin of the traffic is obscured.

What's most interesting about this approach to me is that you could run the proxy server on the phone, tproxy server on an OpenWRT device, and connect them through an adb tunnel. This in theory would bypass entitlement, APN dun profile, and TTL/HL dpi detection - all with a phone that is in an entirely stock state.


This setting effects the preferred protocol version for connected clients (per RFC 3484). GUA tells DNSMASQ to assign local IPs in the 2001:db8::/64 range, which is treated like a real public address, so clients will prefer sending their traffic through IPv6. ULA assigns addresses in the fd00::/64 range, so clients will send traffic through IPv4 by default.

Is not happening only with Verizon it happens with any sim on my phone either esim or psim,, thanks anyways

Here's the outcome for tmo
Row: 0 _id=799, name=T-Mobile US, numeric=310260, mcc=310, mnc=260, carrier_id=-1, apn=fast.t-mobile.com, user=, server=*, password=, proxy=, port=, mmsproxy=, mmsport=, mmsc=http://mms.msg.eng.t-mobile.com/mms/wapenc, authtype=-1, type=default,supl,mms, current=0, protocol=IPV4V6, roaming_protocol=IPV4V6, carrier_enabled=1, bearer=0, bearer_bitmask=917503, network_type_bitmask=916479, lingering_network_type_bitmask=0, mvno_type=, mvno_match_data=, sub_id=-1, profile_id=0, modem_cognitive=0, max_conns=0, wait_time=0, max_conns_time=0, mtu=1440, mtu_v4=0, mtu_v6=0, edited=0, user_visible=1, user_editable=0, owned_by=1, apn_set_id=0, skip_464xlat=-1, always_on=0

 

[JDToo]

What's most interesting about this approach to me is that you could run the proxy server on the phone, tproxy server on an OpenWRT device, and connect them through an adb tunnel. This in theory would bypass entitlement, APN dun profile, and TTL/HL dpi detection - all with a phone that is in an entirely stock state.

It's a great approach to the problem. I have been looking at doing the same thing using Redsocks and Wi-Fi hotspot running on a Linux PC to get devices like TV's that don't have SOCKS support to be able to traverse through an unrooted tethered phone running a SOCKS5 server. I previously bricked an old router with DD-RT so I have been hesitant to use one with it or OpenWRT to do this, but if you have a router that certifiably works with either replacement firmware, it would be a more convenient choice.

 

[fddm]

Since you have root, you can just install the kmod-usb-net-rndis in OpenWRT, bridge usb0 to lan, and disable DHCP. That'll let you use your phone's USB tethering as a wan to serve your network.

Spoiler: OpenWRT Setup

Add kernel RNDIS support:

opkg update
opkg install kmod-usb-net-rndis

Network -> Interfaces -> Devices Tab
-> Configure br-lan
Bridge Ports: add usb0

Network -> Interfaces -> LAN
-> DHCP Server
--> General Setup
Check "Ignore interface"

For routers, I find Linksys to be the cheapest. You'll want a Qualcomm or Mediatek CPU with a USB2+ port. There is a bug with Qualcomm USB3 where the driver can crash when plugging in a phone. This is easily fixed with a script, but it's easier to just recommend Mediatek hardware:

Table of Hardware: Full details

Table of Hardware: Full details This table shows full hardware details for all devices listed in the Table of Hardware. ---------- Using the Table of Hardware * Sort the columns by clicking the column header * Enter your filter criteria

openwrt.org

You need to pay attention to the hardware version when purchasing though, different versions of the same model often have wildly different hardware.

If you edit your APN settings for your APN protocols to "IPv4" and have "dun" in APN type, then you can add this to the router to automatically bypass tether limitations without any app:

Spoiler: Set TTL on an OpenWRT Bridge

Lets you set the outgoing TTL if your unable to set it on your phone. IPv4 only.

opkg update
opkg install iptables-mod-ipopt
opkg install iptables-mod-physdev

System -> Startup -> Local startup

sysctl -w net.bridge.bridge-nf-call-arptables=1
sysctl -w net.bridge.bridge-nf-call-iptables=1
sysctl -w net.bridge.bridge-nf-call-ip6tables=1

Network -> Firewall -> Custom Rules

iptables -t mangle -I POSTROUTING -m physdev --physdev-out usb0 -j TTL --ttl-set 65

Alternatively, I always recommend VPN Hotspot with a local VPN like Adguard for bypassing restrictions. It's relatively foolproof to set up. Just need to make sure to disable IPv6 and Tether hardware acceleration in the app.

 

[J0nhy]

Any updates for this app?