IPv6 tethering

Finally stumbled on how this can be done, I feel really dumb for not landing on this sooner. Turns out we can use TPROXY mangle rules to capture and redirect outbound IPv6 traffic to a local transparent proxy. transocks-wong and microsocks (for example) would be enough for TCP support, but I’m unsure about UDP atm.

The kernel module to achieve this is very widely supported on Android: CONFIG_NETFILTER_XT_TARGET_TPROXY

Think I answered poorly. AFAICT public ipv6 addresses for tethered clients are configured via slaac server on the provider side, not anything on the client side. Guess this would be testable by blocking icmp6 between rndis0 and the ipv6 mobile interface and reconnecting.

I had some recent success getting tethering with ipv6 working. I grabbed Lineage sources for my phone and rebuilt my kernel with CONFIG_NF_NAT_IPV6 and CONFIG_IP6_NF_TARGET_MASQUERADE enabled. Also cross-compiled radvd for ipv6 provisioning. radvd.conf defines interface rndis0, prefix fd00::/64, and ipv6 dns servers.

#!/system/bin/sh

#netID = 99 0x63
setprop sys.usb.config 'rndis,adb'
ndc interface setcfg rndis0 192.168.42.129 24 up
ip -6 addr add fd00::1/64 dev rndis0 scope global
ip -6 route add fd00::/64 dev rndis0 proto kernel src fd00::1
ndc ipfwd enable tethering
ndc network interface add 99 rndis0
ndc network route add 99 rndis0 192.168.42.0/24
ndc network route add 99 rndis0 fd00::/64
ndc network route add 99 rndis0 fe80::/64
ndc nat enable rndis0 tun0 99
ndc ipfwd add rndis0 tun0

ip6tables -t nat -N tetherctrl_nat_POSTROUTING
ip6tables -t nat -A POSTROUTING -j tetherctrl_nat_POSTROUTING
ip6tables -t nat -A tetherctrl_nat_POSTROUTING -o tun0 -j MASQUERADE
ip6tables -t filter -D tetherctrl_FORWARD -g tetherctrl_counters
ip6tables -t filter -A tetherctrl_FORWARD -i tun0 -o rndis0 -m state --state RELATED,ESTABLISHED -g tetherctrl_counters	
ip6tables -t filter -A tetherctrl_FORWARD -i rndis0 -o tun0 -m state --state INVALID -j DROP	
ip6tables -t filter -A tetherctrl_FORWARD -i rndis0 -o tun0 -g tetherctrl_counters	
ip6tables -t filter -A tetherctrl_FORWARD -j DROP

# These commands as written are blocking
dnsmasq --keep-in-foreground --no-resolv --no-poll --dhcp-authoritative --dhcp-range=192.168.42.10,192.168.42.99,1h --dhcp-option=6,8.8.8.8,8.8.4.4 --dhcp-leasefile=/sdcard/dnsmasq.leases --dhcp-option-force=43,ANDROID_METERED --pid-file=/sdcard/dnsmasq.pid --listen-mark 0xf0063

radvd -n

Here I set the ipv6 address and route, mark traffic for the global ipv6 subnet, and add the missing ip6tables rules to match. Found I needed to call dnsmasq directly as ndc tether seemed to interfere.