Can't properly use USB Tethering from Android other than interface bridge

[clockware]

Can't properly use USB Tethering from Android other than interface bridge.

Goal first: to be able to attach my Android phone to USB any time, providing internet to DHCP Clients on LAN1 - LAN4 ports.
Hardware: Asus RT-N66U (Broadcom BCM5300)
Software: OpenWrt 18.06.2 r7676-cddd7b4c77 / LuCI openwrt-18.06 branch (git-19.020.41695-6f6641d)

History:
So I read a lot of articles on how to make USB tethering work. "usb0" interface created successfully.

Attempt1:
usb0: DHCP Client
wan: shutdown (so it wouldn't mess with me)
lan: Static address, DHCP Server, etc, etc.

Result: DHCP server on lan works correctly, as expected, though I don't have any internet access.
Additionally: If it was WAN, there would be no problem.

Attempt2:
usb0 + lan => bridge
Result: It worked. Windows successfully obtained DHCP from Android and I got a ping to 8.8.8.8.
Additionally: That observation proves that USB <-> Ethernet part works correctly and that makes Attempt1 OpenWRT problem.

In order to make it work in Attempt1 configuration, I tried to understand if OpenWRT usb0 ever obtains any address from Android. Judging by ifconfig usb0 output it doesn't.

In case someone can extract some info from that:

usb0 Link encap:Ethernet HWaddr 42:84:DC:86:07:01
inet6 addr: fe80::4084:dcff:fe86:701/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:11 errors:0 dropped:0 overruns:0 frame:0
TX packets:679 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:944 (944.0 B) TX bytes:258566 (252.5 KiB)

And that's where I'm stuck. OpenWRT doesn't seem to do the DHCP job and provide internet. Any ideas?

[mk24]

The most straightforward way to set up the routed configuration is to remove any Ethernet port from the pre-defined wan network and replace it with usb0 instead. In the default configuration, wan is already a DHCP client and has firewall rules in place to NAT / route from LAN.

If you build from scratch a new network to be the WAN, you will need to make firewall zones and rules for that network.

[clockware]

But isn't it enough that I just put it into "wan" zone? I did that too.

[clockware]

Also, your assumption/suggestion doesn't explain/count why usb0 doesn't have any IPv4 assigned (Android is set up to use IPv4 only, which Windows perfectly uses).
Point is internet is inaccessible from ssh too. You can't ping anything through usb0 if it's set as DHCP client and no bridge.

[mk24]

Something other than the firewall is wrong if it doesn't even pull a DHCP address from the phone.

Note that there are kernel device interface names (produced automatically by the device drivers) and OpenWrt UCI interface names defined in config files. This is a little confusing but basically you need to always have an OpenWrt interface which attaches to the kernel device which is doing the actual I/O. These two things can, but to reduce confusion really shouldn't, have the same name.

[clockware]

I think I'm fine there.

Also for clarity some logs of the USB connection and enabling tethering (and successfully obtaining usb0 interface):
[ 6699.646971] usb 1-1.1: new high-speed USB device number 10 using ehci-platform
[ 6704.217449] usb 1-1.1: USB disconnect, device number 10
[ 6704.516995] usb 1-1.1: new high-speed USB device number 11 using ehci-platform
[ 6704.713606] rndis_host 1-1.1:1.0 usb0: register 'rndis_host' at usb-ehci-platform.0-1.1, RNDIS device, f6:33:b3:dd:aa:de

[vgaetera]

For me USB tethering doesn't work properly when Android is connected to OpenVPN.

---

That's the issue:

Android doesn't allow tethered connections to route through the VPN. This is an Android rule that applies to all VPN apps running on non-rooted devices. This is done for security, out of concern that if a malicious individual was able to get access to your tether, they could piggy back onto the VPN connection.

A better, more secure solution is to run a VPN client on the tethered machine.

Solution for rooted devices:

0. launch terminal and become root
   yourprompt> su
   yourprompt#

1. allow FORWARDING of vpn data (this will allow ALL forwarding)
   yourprompt# iptables -A FORWARD -j ACCEPT

2. change NAT to MASQUERADE from ALL interfaces
   yourprompt# iptables -t nat -A POSTROUTING -j ACCEPT

3. route traffic in specific tethering routing table
   3a) see table for tethering (in my setup is table '60')
   yourprompt# ip rule show
   3b) add your private address (myne is 172.16.0.0/16) to the tethering table
   yourprompt# ip route add 172.16.0.0/16 dev tun0 table 60

[clockware]

That was it. So apparently there is some kind of difference between Windows and OpenWRT approach on obtaining address. When VPN is enabled on Android, it doesn't work on OpenWRT, but works on Windows. If VPN is off, then works on both.

[lleachii]

Hold up...

Are you saying that:

• You enabled a VPN app on an Android device?
• Then attempted to use that Android as a hotspot/tether?

That won't work (it may on a rooted phone, though).

[clockware]

• You enabled a VPN app on an Android device?
• Then attempted to use that Android as a hotspot/tether?

Yes, I had VPN enabled. But the fact that Windows manages to work with it is confusing, isn't it?

That won't work (it may on a rooted phone, though).

So when you say that, I'd correct it that it doesn't work on OpenWRT specifically. My phone is not rooted.

[lleachii]

But the fact that Windows manages to work with it is confusing, isn't it?

No, not really.

So when you say that, I'd correct it that it doesn't work on OpenWRT specifically. My phone is not rooted.

No, you'd be correct if you said what I did - that it doesn't work with ANDROID. This issue has nothing to do with OpenWrt.

• You simply cannot try to hack an Interface on Android - that's why I said you might be able to do so if the phone were rooted
• I've never been able to use a hotspot or tether on an Android - while it was connected to a VPN - this includes
  • Anchor Free
  • OpenVPN
  • Wireguard
  • Cyberghost

[lleachii]

(it may on a rooted phone, though)

Or, if you were accessing the ADB instead.

https://en.wikipedia.org/wiki/Android_software_development#ADB

[clockware]

No, you'd be correct if you said what I did - that it doesn't work with ANDROID. This issue has nothing to do with OpenWrt.

• You simply cannot try to hack an Interface on Android - that's why I said you might be able to do so if the phone were rooted
• I've never been able to use a hotspot or tether on an Android - while it was connected to a VPN - this includes
  • Anchor Free
  • OpenVPN
  • Wireguard
  • Cyberghost

Well I don't doubt any experience. Just saying when you see one system working and other doesn't, you suspect something wrong with the other. In this case evidence made OpenWRT look like the "other system" that doesn't work.
I'm using ShadowSocks btw.