Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to use the internet of my school on my Android, the problem is they have a Squid proxy, and many applications on my phone don't use the proxy at all.

The obvious solution is to install a transparent proxy on my Android to force all applications to connect through it. The problem is that I need to root the phone to make it work, and I don't want to do it because it's not really my phone and rooting is a little risky-

Another solution, which is safer, is to make my computer run as a gateway, so I put my Ubuntu IP in the gateway parameter of the phone.

I'm running a small proxy on my ubuntu (cntlm), so I redirect the Android traffic to it. I did it with "iptables" as follows:

iptables -t nat -A PREROUTING -s 10.0.1.118 -p tcp -j REDIRECT --to-ports 8888
iptables -t nat -A PREROUTING -s 10.0.1.118 -p udp -j REDIRECT --to-ports 8888

10.0.1.118 is the IP of the phone, 8888 is the port of cntlm (proxy on my PC).

Now, on the phone: When I enter www.google.com on the navigator I get nothing (web site not found, error message of Firefox).

But, when I enter http://74.125.143.101 (IP of Google) I get an error message from the school proxy (so it worked in some way – my PC redirected the traffic of the phone to the Squid proxy).

The error message is :

The requested URL could not be retrieved
while trying to process the request
get / http/1.1
host 74.125.143.101
user-Agent ...
...

I think the problem is in the "GET" header,it should be GET 74.125.143.101 HTTP/1.1. But I don't understand what's happening, and I'm a certified CCNA.

share|improve this question
    
If you did this using NAT, wouldn't the MAC address of the phone be sent unmodified? I would assume the proxy authenticates with a particular device, and thus it's rejecting the packets from your phone. –  Breakthrough Dec 16 '12 at 13:37

3 Answers 3

you can use this

on the phone configure same proxy port as you use on ubuntu and configure proxy IP as IP of ubuntu server.

do this on your ubuntu

iptables -t nat -A POSTROUTING -s 1.1.1.1  -j SNAT --to 1.2.3.4
iptables -t nat -A PREROUTING -s 1.1.1.1 -d  1.2.3.4   -j DNAT --to 5.6.7.8

1.1.1.1 is phone IP

1.2.3.4 is ubuntu IP

5.6.7.8 is proxy server IP

and enable IP forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward
share|improve this answer
    
I don't want at all to enter the proxy on the phone, because most applications do not support the proxy for ex skype: even if i enter the proxy of the school, it doesn't work, and i enter a proxy on my windows that i developed to debug application, i see that skype doesn't use the proxy at all –  yacine Dec 16 '12 at 16:53
    
OK..in that case you can use gateway as you are using now and use this.. iptables -t nat -A PREROUTING -s 1.1.1.1 -d 1.2.3.4 -p tcp --destination-port 80 -j DNAT --to 5.6.7.8 –  daya Dec 16 '12 at 16:56
    
And for skype check if its trying to use UPnP –  daya Dec 16 '12 at 17:01
    
The squid proxy require an NTLM authentication, this is why i'm using CNTLM on my ubuntu. so how should be the iptables commande ? thanks a lot for your responses –  yacine Dec 16 '12 at 17:05
    
the GET request looks fine except. it should have the Hostnme and not the IP(it surely wont work with shared hosts.i.e. multiple sites hosted on a single IP). when you are not configuring proxy on the phone ,it will try to send a DNS request and wait for a response before it can initiate a HTTP connection. –  daya Dec 16 '12 at 17:18

You are redirecting absolutely everything. Including DNS traffic. This does not work; CNTLM doesn't proxy DNS.

Try explicitly allowing port 53 through unmolested:

iptables -t nat -I PREROUTING -s 10.0.1.118 -p tcp --dport 53 -j ACCEPT iptables -t nat -I PREROUTING -s 10.0.1.118 -p udp --dport 53 -j ACCEPT

share|improve this answer
    
yeah, that's right. It get nothing when I enter the web site name. I added a DNS server and the appropriate iptables commande. I get the same error –  yacine Dec 19 '12 at 15:48

The solution is the add :

1- A DNS server : and redirect the DNS traffic to it, and the rest of the udp traffic to CNTLM

This doesn't solve the problem entirely, I get the same error whether I enter the web site name or it's IP (before installing DNS server I get the error just when I enter the web site IP, so DNS resolution worked)

2- After analyzing the traffic from the phone in the cases with/without proxy, I get this :

without the proxy

get / http/1.1

host 74.125.143.101

user-Agent ...

..

with the proxy

get 74.125.143.101/ http/1.1

host 74.125.143.101

user-Agent ...

so the solution is to add the host name to get header, I will write an app that does

I'm sure it will work :D

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.