I want to use the internet of my school on my Android, the problem is they have a Squid proxy, and many applications on my phone don't use the proxy at all.

The obvious solution is to install a transparent proxy on my Android to force all applications to connect through it. The problem is that I need to root the phone to make it work, and I don't want to do it because it's not really my phone and rooting is a little risky-

Another solution, which is safer, is to make my computer run as a gateway, so I put my Ubuntu IP in the gateway parameter of the phone.

I'm running a small proxy on my ubuntu (cntlm), so I redirect the Android traffic to it. I did it with "iptables" as follows:

iptables -t nat -A PREROUTING -s -p tcp -j REDIRECT --to-ports 8888
iptables -t nat -A PREROUTING -s -p udp -j REDIRECT --to-ports 8888 is the IP of the phone, 8888 is the port of cntlm (proxy on my PC).

Now, on the phone: When I enter www.google.com on the navigator I get nothing (web site not found, error message of Firefox).

But, when I enter (IP of Google) I get an error message from the school proxy (so it worked in some way – my PC redirected the traffic of the phone to the Squid proxy).

The error message is :

The requested URL could not be retrieved
while trying to process the request
get / http/1.1
user-Agent ...

I think the problem is in the "GET" header,it should be GET HTTP/1.1. But I don't understand what's happening, and I'm a certified CCNA.

  • If you did this using NAT, wouldn't the MAC address of the phone be sent unmodified? I would assume the proxy authenticates with a particular device, and thus it's rejecting the packets from your phone. Dec 16, 2012 at 13:37

3 Answers 3


you can use this

on the phone configure same proxy port as you use on ubuntu and configure proxy IP as IP of ubuntu server.

do this on your ubuntu

iptables -t nat -A POSTROUTING -s  -j SNAT --to
iptables -t nat -A PREROUTING -s -d   -j DNAT --to is phone IP is ubuntu IP is proxy server IP

and enable IP forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward
  • I don't want at all to enter the proxy on the phone, because most applications do not support the proxy for ex skype: even if i enter the proxy of the school, it doesn't work, and i enter a proxy on my windows that i developed to debug application, i see that skype doesn't use the proxy at all
    – yacine
    Dec 16, 2012 at 16:53
  • OK..in that case you can use gateway as you are using now and use this.. iptables -t nat -A PREROUTING -s -d -p tcp --destination-port 80 -j DNAT --to
    – daya
    Dec 16, 2012 at 16:56
  • And for skype check if its trying to use UPnP
    – daya
    Dec 16, 2012 at 17:01
  • The squid proxy require an NTLM authentication, this is why i'm using CNTLM on my ubuntu. so how should be the iptables commande ? thanks a lot for your responses
    – yacine
    Dec 16, 2012 at 17:05
  • the GET request looks fine except. it should have the Hostnme and not the IP(it surely wont work with shared hosts.i.e. multiple sites hosted on a single IP). when you are not configuring proxy on the phone ,it will try to send a DNS request and wait for a response before it can initiate a HTTP connection.
    – daya
    Dec 16, 2012 at 17:18

You are redirecting absolutely everything. Including DNS traffic. This does not work; CNTLM doesn't proxy DNS.

Try explicitly allowing port 53 through unmolested:

iptables -t nat -I PREROUTING -s -p tcp --dport 53 -j ACCEPT iptables -t nat -I PREROUTING -s -p udp --dport 53 -j ACCEPT

  • yeah, that's right. It get nothing when I enter the web site name. I added a DNS server and the appropriate iptables commande. I get the same error
    – yacine
    Dec 19, 2012 at 15:48

The solution is the add :

1- A DNS server : and redirect the DNS traffic to it, and the rest of the udp traffic to CNTLM

This doesn't solve the problem entirely, I get the same error whether I enter the web site name or it's IP (before installing DNS server I get the error just when I enter the web site IP, so DNS resolution worked)

2- After analyzing the traffic from the phone in the cases with/without proxy, I get this :

without the proxy

get / http/1.1


user-Agent ...


with the proxy

get http/1.1


user-Agent ...

so the solution is to add the host name to get header, I will write an app that does

I'm sure it will work :D

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.