1

I want to use the internet of my school on my Android, the problem is they have a Squid proxy, and many applications on my phone don't use the proxy at all.

The obvious solution is to install a transparent proxy on my Android to force all applications to connect through it. The problem is that I need to root the phone to make it work, and I don't want to do it because it's not really my phone and rooting is a little risky-

Another solution, which is safer, is to make my computer run as a gateway, so I put my Ubuntu IP in the gateway parameter of the phone.

I'm running a small proxy on my ubuntu (cntlm), so I redirect the Android traffic to it. I did it with "iptables" as follows:

iptables -t nat -A PREROUTING -s 10.0.1.118 -p tcp -j REDIRECT --to-ports 8888
iptables -t nat -A PREROUTING -s 10.0.1.118 -p udp -j REDIRECT --to-ports 8888

10.0.1.118 is the IP of the phone, 8888 is the port of cntlm (proxy on my PC).

Now, on the phone: When I enter www.google.com on the navigator I get nothing (web site not found, error message of Firefox).

But, when I enter http://74.125.143.101 (IP of Google) I get an error message from the school proxy (so it worked in some way – my PC redirected the traffic of the phone to the Squid proxy).

The error message is :

The requested URL could not be retrieved
while trying to process the request
get / http/1.1
host 74.125.143.101
user-Agent ...
...

I think the problem is in the "GET" header,it should be GET 74.125.143.101 HTTP/1.1. But I don't understand what's happening, and I'm a certified CCNA.

Improve this question
1
  • If you did this using NAT, wouldn't the MAC address of the phone be sent unmodified? I would assume the proxy authenticates with a particular device, and thus it's rejecting the packets from your phone.
    – Breakthrough
    Dec 16, 2012 at 13:37

3 Answers 3

Reset to default
0

you can use this

on the phone configure same proxy port as you use on ubuntu and configure proxy IP as IP of ubuntu server.

do this on your ubuntu

iptables -t nat -A POSTROUTING -s 1.1.1.1  -j SNAT --to 1.2.3.4
iptables -t nat -A PREROUTING -s 1.1.1.1 -d  1.2.3.4   -j DNAT --to 5.6.7.8

1.1.1.1 is phone IP

1.2.3.4 is ubuntu IP

5.6.7.8 is proxy server IP

and enable IP forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward
Improve this answer
10
  • I don't want at all to enter the proxy on the phone, because most applications do not support the proxy for ex skype: even if i enter the proxy of the school, it doesn't work, and i enter a proxy on my windows that i developed to debug application, i see that skype doesn't use the proxy at all
    – yacine
    Dec 16, 2012 at 16:53
  • OK..in that case you can use gateway as you are using now and use this.. iptables -t nat -A PREROUTING -s 1.1.1.1 -d 1.2.3.4 -p tcp --destination-port 80 -j DNAT --to 5.6.7.8
    – daya
    Dec 16, 2012 at 16:56
  • And for skype check if its trying to use UPnP
    – daya
    Dec 16, 2012 at 17:01
  • The squid proxy require an NTLM authentication, this is why i'm using CNTLM on my ubuntu. so how should be the iptables commande ? thanks a lot for your responses
    – yacine
    Dec 16, 2012 at 17:05
  • the GET request looks fine except. it should have the Hostnme and not the IP(it surely wont work with shared hosts.i.e. multiple sites hosted on a single IP). when you are not configuring proxy on the phone ,it will try to send a DNS request and wait for a response before it can initiate a HTTP connection.
    – daya
    Dec 16, 2012 at 17:18
0

You are redirecting absolutely everything. Including DNS traffic. This does not work; CNTLM doesn't proxy DNS.

Try explicitly allowing port 53 through unmolested:

iptables -t nat -I PREROUTING -s 10.0.1.118 -p tcp --dport 53 -j ACCEPT iptables -t nat -I PREROUTING -s 10.0.1.118 -p udp --dport 53 -j ACCEPT

Improve this answer
1
  • yeah, that's right. It get nothing when I enter the web site name. I added a DNS server and the appropriate iptables commande. I get the same error
    – yacine
    Dec 19, 2012 at 15:48
0

The solution is the add :

1- A DNS server : and redirect the DNS traffic to it, and the rest of the udp traffic to CNTLM

This doesn't solve the problem entirely, I get the same error whether I enter the web site name or it's IP (before installing DNS server I get the error just when I enter the web site IP, so DNS resolution worked)

2- After analyzing the traffic from the phone in the cases with/without proxy, I get this :

without the proxy

get / http/1.1

host 74.125.143.101

user-Agent ...

..

with the proxy

get 74.125.143.101/ http/1.1

host 74.125.143.101

user-Agent ...

so the solution is to add the host name to get header, I will write an app that does

I'm sure it will work :D

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .