Jump to content

USB Internet

From postmarketOS Wiki

A phone running postmarketOS can connect to the Internet through a USB cable plugged onto another Internet-connected device. For this to work you set your host machine as gateway for your phone and let your host machine do network address translation (NAT) for the phone or a guest machine.

On your phone or guest machine

Note Note: 1.1.1.1 and 1.0.0.1 are the DNS servers, feel free to change it if you wish.
Note Note: It works in both sides: to share Internet from your phone to PC (aka USB tethering), just swap host and phone below and use 172.16.42.1.

OpenRC

These instructions assume the relevant interface is named usb0. On some devices (those running [android-based] downstream kernels?), it may be rndis0. Check first with e.g., ifconfig, and use the interface that has the line inet addr:172.16.42.1.

# ip route add default via 172.16.42.2 dev usb0
# echo nameserver 1.1.1.1 > /etc/resolv.conf

If neither of those work or run correctly, try route add default gw 172.16.42.2

To make the configuration persistent after reboot do:

# echo 'ip route add default via 172.16.42.2 dev usb0' > /etc/local.d/usb_internet.start
# chmod +x /etc/local.d/usb_internet.start
# rc-update add local

Disable it if you plug the USB cable out and want to use WiFi, because it can interfere with routing (packets would try to use the USB networking, even though it's disconnected)

systemd with usb-moded (GNOME Mobile, Phosh or Plasma Mobile)

Only available on edge. Make sure the package postmarketos-usb-moded-systemd is installed.

# nmcli conn modify 'USB Developer Mode' ipv4.gateway 172.16.42.2
# nmcli conn modify 'USB Developer Mode' ipv4.ignore-auto-dns yes
# nmcli conn modify 'USB Developer Mode' ipv4.dns "1.1.1.1 1.0.0.1"
# systemctl restart NetworkManager

For persistence when disconnecting and reconnecting the USB cable, these settings can be added to the systemd startup script /usr/bin/usb-moded-developer-mode.

On the host machine

Note This section assumes the host machine is running Linux; for Windows, see Windows FAQ#Configuring USB Internet with a Windows host.

First, enable IP forwarding:

# sysctl net.ipv4.ip_forward=1

Then follow the instructions according to the distribution or firewall you use.

iptables (Ubuntu/Arch/Alpine)

# iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# iptables -A FORWARD -s 172.16.42.0/24 -j ACCEPT
# iptables -A POSTROUTING -t nat -j MASQUERADE -s 172.16.42.0/24
# iptables-save #Save changes

This will enable IPv4 forwarding on your host machine which basically lets it function as a router. The postrouting command will make the kernel on the host translate the packets between the phone network and your normal network on the host machine.

firewalld (RHEL/CentOS/Fedora/Rocky/SLE/openSUSE)

You can use a firewalld policy to forward the connection[1]. After the network interfaces have been added to the zones [2]

# firewall-cmd --get-active-zone

# firewall-cmd --zone=external --add-interface=wlp1s0 --permanent
# firewall-cmd --zone=internal --add-interface=enp193s0f3u1 --permanent

# firewall-cmd --permanent --new-policy fwdIntToExt
# firewall-cmd --permanent --policy fwdIntToExt --add-ingress-zone internal
# firewall-cmd --permanent --policy fwdIntToExt --add-egress-zone external
# firewall-cmd --permanent --policy fwdIntToExt --set-target ACCEPT
# firewall-cmd --permanent --policy fwdIntToExt --add-masquerade
# firewall-cmd --reload

# firewall-cmd --get-active-zone 
# firewall-cmd --zone=external --list-all
# firewall-cmd --zone=internal --list-all
# firewall-cmd --info-policy fwdIntToExt

nftables (postmarketOS)

# nft add table inet nat
# nft 'add chain inet nat postrouting { type nat hook postrouting priority 100 ; }'
# nft add rule inet nat postrouting iifname "usb*" masquerade

postmarketOS has chain forward configured for USB interfaces by default.[3] If using other distributions or the following lines are missing, add them manually.

# nft add rule inet filter forward ct state { established, related } accept
# nft add rule inet filter forward iifname "usb*" accept

You can now verify the Internet connection on your phone by pinging something. If this does not work it means you need to compile the kernel with CONFIG_USB_ETH setting enabled in menuconfig.

ufw

In the file /etc/default/ufw, change DEFAULT_FORWARD_POLICY to ACCEPT.

DEFAULT_FORWARD_POLICY="ACCEPT"

In the file /etc/ufw/sysctl.conf, uncomment net/ipv4/ip_forward=1.

net/ipv4/ip_forward=1
#net/ipv6/conf/default/forwarding=1
#net/ipv6/conf/all/forwarding=1

Add the following rule to /etc/ufw/before.rules BEFORE the *filter table rules.

# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]

# Forward traffic for 172.16.42.0/24
-A POSTROUTING -j MASQUERADE -s 172.16.42.0/24

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT

Restart ufw to make changes take effect.

# ufw disable && ufw enable

See also

Notes