~# iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE ~# iptables -I FORWARD -i wlan0 -o tun0 -j ACCEPT ~# iptables -I FORWARD -o wlan0 -i tun0 -j ACCEPT Forwarding rules and source NAT should already be set with hotspot but just to make sure: ~# echo -n 1 >/proc/sys/net/ipv4/ip_forward send traffic coming from VPN to tethered devices.įirewall works above routing policy. Third and fourth rules do inverse i.e.Second command adds a route to routing table 5000 to send all traffic on tun0 interface i.e.First command adds a rule to RPDB to send traffic coming on hotspot (WiFi) interface to table 5000.

~# ip route add default dev wlan0 table 5001 ~# ip route add default dev tun0 table 5000 This works for me: ~# ip rule add iif wlan0 lookup table 5000 So it's left disabled by default.Ī workaround is to modify routing table but it requires root and is a bit complex on Android. Also using same internet connection or VPN for multiple devices may break terms of contract with service providers. While tethering works in native code dnsmasq is the DNS server (up to Pie) while the rest of traffic is handled by kernel directly.

The reason is VPNService API works in Java framework of Android to redirect traffic to VPN's tun interface based on UIDs (and/or SOcket MARKs) of apps. Android doesn't redirect hotspot traffic through VPN network as far as I have tested on Pie ROM (almost stock custom ROMs might have different implementations or some specific settings).

Vpn tethering android