jus got Revolution 611 flashed on my DHD.
vodafone australia since about may2011 unblocked inbound connections.
i often have a sshd running, so would like to hav that blocked from the internet.
wheres the best place to stick this command
/system/bin/iptables -A INPUT -i rmnet+ -p tcp --dport 22 -j DROP
so it executed at boot time ??
edit: all good worked it out. put an extra file in /system/etc/init.d folder with command inside it.
Related
hi i am using the u2nl and autostart together to get everything, including internet and apps working on my evo, but i am not getting 3G speeds for some reason, even though the status bar says 3G
this is what my u2nl code looks like, i think it might be the ip addresses used in there maybe they are not the server closest to me, can someone help me optiize my speed, and also post your sample autostart.sh code?
here's mine:
Code:
#!/system/bin/sh
export PATH="$PATH:/system/bin"
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F
iptables -t nat -F
iptables -X
iptables -t nat -A OUTPUT -o rmnet0 -p 6 ! -d 10.133.26.12 -j REDIRECT --to-port 1025
u2nl 10.133.26.12 8080 127.0.0.1 1025 >/dev/null 2>&1 &
sh -c "sleep 5;kill `ps|grep nk.bla.android.autostart|grep -v grep|awk '{print $2}'`" &
exit 0
i would like to know where those IP's come from, and if i can change them to improve performance. all help is appreciated, thanks
By the way i livein Houston.
Hi,
this is my first post. Thanks for the many helpful posts in this forum. Now I am having a problem where did not find a solution via forum search.
I have here an Android mobile (G1, okay rather old, but it should also be a generic question so post this here) that should use internet connection established by laptop via adb.
I am using Ubuntu 10.04 on the laptop and CM6.1 with +14M hack on the phone.
I use the following script, which works well for all command that are started from the shell,
but all Android apps like GMail, K9, Google Music, Browser etc. tell me that there is not a valid internet connection. The browser oddly complains about this, too, but is able to load the page after confirming the error message.
Code:
#!/bin/sh
PORT=12000
REMOTEIP=10.61.61.2
LOCALIP=10.61.61.1
DNS_DEF=8.8.8.8
killall -HUP pppd 2> /dev/null
adb shell "killall -HUP pppd 2> /dev/null"
adb shell "killall nc 2> /dev/null"
#pf start
while iptables -D FORWARD -j android_ppp_tether 2> /dev/null; do :; done
while iptables -D INPUT -j android_ppp_tether 2> /dev/null; do :; done
while iptables -t nat -D POSTROUTING -s $REMOTEIP -j MASQUERADE 2> /dev/null; do :; done
[ "$1" = stop ] && exit 1
iptables -F android_ppp_tether 2> /dev/null; iptables -N android_ppp_tether 2> /dev/null
iptables -I FORWARD -j android_ppp_tether
#iptables -I INPUT -j android_ppp_tether
iptables -A android_ppp_tether -s $REMOTEIP -j ACCEPT
iptables -t nat -A POSTROUTING -s $REMOTEIP -j MASQUERADE
killall pppd 2> /dev/null
adb shell "killall pppd 2> /dev/null"
adb shell "killall nc 2> /dev/null"
echo 1 > /proc/sys/net/ipv4/ip_forward
adb forward tcp:$PORT tcp:$PORT
adb shell "pppd noauth defaultroute pty 'nc -l -p $PORT' ipparam vpn" &
sleep 5
pppd noauth nodeflate pty "nc localhost $PORT" $LOCALIP:$REMOTEIP
while ! ifconfig | grep $LOCALIP; do sleep 1; done
dns="$(awk '/nameserver/ {print $2; exit}' /etc/resolv.conf)"
[ -z "$dns" ] && dns=$DNS_DEF
adb shell "setprop net.dns1 $dns"
As you can see, the phone gets the defaultroute by using the defaultroute option at the pppd commandline at the phone's side.
The DNS server is pushed via setprop net.dns1 $dns.
Is there a command or a message to issue via adb forcing the phone "to be online"?
:wq
Have not tried this yet, but, is this "reverse tethering"??
The Laptop / PC has a net connection, and functions as a router for the phone?
Why do you need adb for this?
Basically the concepts seem to be to get the phone connect to the PC (tethering - can be wired or wi-fi or bluetooth). You set up the pc to talk to the phone (set up network configuration in the PC). Set up iptables and bridge in the PC to route traffic from / to the phone directly to the phone.
And finally, set up the phone's <whatever> to use the tether to beg with the PC to give it (the phone) net access.
Not that I have been able to get it working though.
The otherway around - simple tethering - getting the PC / laptop to use the phone's GPRS / 3G connection is pretty easy.
Hello everybody. Today I come to you with an AOSP fix for tethering over LTE brought to us from Wozman at the XDA forums.
Basically some of us using AOSP were only able to tether using 3G and +HSPA and it would never work using just LTE. The issue was the phone was not bridging the interfaces properly.
Always remember to perform a nandroid backup before attempting anything you're unfamiliar with.
This has been successfully tested on:
Samsung Galaxy S3
Samsung Galaxy S4
Enter the following in Android Terminal Emulator ( http://play.google.com/store/apps/details?id=jackpal.androidterm ) to fix Tethering over LTE:
iptables -A bw_FORWARD -i !lo+
iptables -A natctrl_FORWARD -j RETURN -i rmnet+ -o wlan0 -m state --state RELATED,ESTABLISHED
iptables -A natctrl_FORWARD -j DROP -i wlan0 -o rmnet+ -m state --state INVALID
iptables -A natctrl_FORWARD -j RETURN -i wlan0 -o rmnet+
iptables -A natctrl_FORWARD -j DROP
iptables -A natctrl_nat_POSTROUTING -t nat -o rmnet+ -j MASQUERADE
The only downside to this process is it must be performed every time you reboot. A simple way around this issue is to save the code into a script (or shortcut) and run it every time you reboot.
To do this, download Gscript Lite from the Play Store
http://play.google.com/store/apps/details?id=nl.rogro.GScriptLite
Copy and paste the lines of code as text to a *.sh* file in a folder on your internal SDcard named "gscript"
Or
Download the file from here:
http://www.sendspace.com/file/nh37av
And place it in:
/Sdcard0/gscript/
Open Gscript Lite, hit your menu button and then 'add script' at the bottom left
Now hit *load file* and pick *tether.sh* from the list (you might have to do this quickly as the app might FC, no worries, if it does just start over)
or
You can paste the lines of code into the large white box. Name it in the top box, be sure to check the *needs su?* box and then hit save.
You should now see a fourth blank option now at the main menu under *CPU Information*. Hit that blank option and it'll run the script.
Now you should be able to tether using LTE
To make this process even easier, you can create a shortcut and place it on your home screen instead of having to enter the app every time
(You might have Gscript Lite FC on you after running the script from the app or shortcut itself, its nothing to worry about)
Happy tethering!
Echo.....
Sent from my SGH-I337M
Here's the fix for 4.3
#!/system/bin/sh
iptables -F
iptables -A bw_FORWARD -i !lo+
iptables -A natctrl_FORWARD -j RETURN -i rmnet+ -o wlan0 -m state --state RELATED,ESTABLISHED
iptables -A natctrl_FORWARD -j DROP -i wlan0 -o rmnet+ -m state --state INVALID
iptables -A natctrl_FORWARD -j RETURN -i wlan0 -o rmnet+
iptables -A natctrl_FORWARD -j DROP
iptables -A natctrl_nat_POSTROUTING -t nat -o rmnet+ -j MASQUERADE
may eyselfy
djbrotherson said:
Hello everybody. Today I come to you with an AOSP fix for tethering over LTE brought to us from Wozman at the XDA forums.
Basically some of us using AOSP were only able to tether using 3G and +HSPA and it would never work using just LTE. The issue was the phone was not bridging the interfaces properly.
Always remember to perform a nandroid backup before attempting anything you're unfamiliar with.
This has been successfully tested on:
Samsung Galaxy S3
Samsung Galaxy S4
Enter the following in Android Terminal Emulator ( http://play.google.com/store/apps/details?id=jackpal.androidterm ) to fix Tethering over LTE:
iptables -A bw_FORWARD -i !lo+
iptables -A natctrl_FORWARD -j RETURN -i rmnet+ -o wlan0 -m state --state RELATED,ESTABLISHED
iptables -A natctrl_FORWARD -j DROP -i wlan0 -o rmnet+ -m state --state INVALID
iptables -A natctrl_FORWARD -j RETURN -i wlan0 -o rmnet+
iptables -A natctrl_FORWARD -j DROP
iptables -A natctrl_nat_POSTROUTING -t nat -o rmnet+ -j MASQUERADE
The only downside to this process is it must be performed every time you reboot. A simple way around this issue is to save the code into a script (or shortcut) and run it every time you reboot.
To do this, download Gscript Lite from the Play Store
http://play.google.com/store/apps/details?id=nl.rogro.GScriptLite
Copy and paste the lines of code as text to a *.sh* file in a folder on your internal SDcard named "gscript"
Or
Download the file from here:
http://www.sendspace.com/file/nh37av
And place it in:
/Sdcard0/gscript/
Open Gscript Lite, hit your menu button and then 'add script' at the bottom left
Now hit *load file* and pick *tether.sh* from the list (you might have to do this quickly as the app might FC, no worries, if it does just start over)
or
You can paste the lines of code into the large white box. Name it in the top box, be sure to check the *needs su?* box and then hit save.
You should now see a fourth blank option now at the main menu under *CPU Information*. Hit that blank option and it'll run the script.
Now you should be able to tether using LTE
To make this process even easier, you can create a shortcut and place it on your home screen instead of having to enter the app every time
(You might have Gscript Lite FC on you after running the script from the app or shortcut itself, its nothing to worry about)
Happy tethering!
Click to expand...
Click to collapse
Work on MF3? been looking for a way to tether my LTE. I have Unlimited.
DrXTC said:
Work on MF3? been looking for a way to tether my LTE. I have Unlimited.
Click to expand...
Click to collapse
Not sure off the top of my head what device the MF3 is but I know this works for the HTC One as well. You could give it a shot, it reverts back after a reboot
Sent from my SGH-I337M using XDA Premium 4 mobile app
djbrotherson said:
Not sure off the top of my head what device the MF3 is but I know this works for the HTC One as well. You could give it a shot, it reverts back after a reboot
Sent from my SGH-I337M using XDA Premium 4 mobile app
Click to expand...
Click to collapse
Ok thanks it's the latest Update on Jflteatt before 4.3 update. Ill try at my risk thanks.
Hi,
My Galaxy S4 i9505 is on Android 4.3 stock rooted.
I would like to know if iptables is working before updating to android 4.4.2 stock.
Can someone do this test on his Galaxy on 4.4.2 stock rooted ?
Install Android Terminal Emulator and enable access point in network settings
In terminal :
HTML:
su
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.43.1:8980
This is risk-free, reboot your phone and iptables rules are deleted :cyclops:
And tell me if there is an error message like "getprotobyname is not implemented on Android" (if nothing is displayed it's ok)
Thanks !
Goal: Only allow outgoing cellular data to specific DNS servers and a specific webserver using cellular mode on rooted android device.
Android phone #1: VkWorld F1 (Chipset. MT6580) running Android 5.1
Android phone #2: HUAWEI Y560-L01 running Android 5.1
Active interfaces on Android #1 when cellular mode is on.
Code:
lo UP 127.0.0.1/8
ccmni0 UP x.x.x.x/x
Active interfaces on Android #2 when cellular mode is on.
Code:
lo UP 127.0.0.1/8
rmnet_data0 UP x.x.x.x/x
This is my current simple iptables for testing on Android #1 and #2
Code:
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -d 8.8.8.8 -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT //DNS
-A OUTPUT -d x.x.x.x -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT //webserver
-A OUTPUT -j DROP
These iptables rules works on Android device #2 or any Android phone that has 'rmnet' interface (from my own testing).
These iptables rules DO NOT work on Android device #1 or any Android phone that has 'ccmni' interface (from my own testing)
And if I add or change in my android #1 to
Code:
-A OUTPUT -o ccmni0 -d x.x.x.x -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
it can NOT still contact the destination ip.
However if I add this line before the last -j DROP rule it works
Code:
iptables -A OUTPUT -o ccmni0 -j ACCEPT
but this allows ccmni interface to talk freely to any website and makes my dns and webserver rule pointless.
Once again:
Devices rmnet interfaces = rules works.
Devices with ccmni interfaces = rules do not work.
[EDIT/SOLVED]
I used tcpdump and wireshark to see what might have gone wrong traffic, apparently my traffic had to go through a proxy from my provider that I blocked off in iptables. Why it still works fine with rmnet interfaces I have no clue.
volleb said:
I used tcpdump and wireshark to see what might have gone wrong traffic, apparently my traffic had to go through a proxy from my provider that I blocked off in iptables. Why it still works fine with rmnet interfaces I have no clue.
Click to expand...
Click to collapse
This is because in short it uses a different way to connect and this is only on MSM chipsets see this link while rmnet is and standard android fare