Mobile internet tethering - how to disguise as Android?

uxer

Wanna connect an OpenBSD machine to mobile internet via Android smartphone USB tethering.

doas dhclient urndis0

With my previous mobile provider it worked fine, now I have had to move and switch provider. With this one, when I tether, I can successfully ping from BSD but no http/ftp stuff opens, e.g.:

> curl -L unitedbsd.com
curl: (56) Recv failure: Connection reset by peer

And sometimes soon after I try it an SMS comes "buy internet sharing".

On the internet, they say that providers distinguish OSes by TTL (= time to live) so you need to set TTL to the same value as Android's which is 64, but on OpenBSD it is already 64:

> sysctl net.inet.ip.ttl
net.inet.ip.ttl=64

They on the internet also say you might need to connect via VPN in order to hide your non-Android traffic (e.g. when Windows fetches its updates they see it can't be Android and block you). But VPN also doesn't connect - I tried with freeopenvpn.org service:

doas openvpn --config /path/to/USA_freeopenvpn_tcp.ovpn

doas openvpn --config /path/to/USA_freeopenvpn_udp.ovpn

It does work for me when on Wi-Fi, but neither works vie tethering:

Enter Auth Username:freeopenvpn
Enter Auth Password:
2023-03-19 15:55:06 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2023-03-19 15:55:06 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2023-03-19 15:55:06 TCP/UDP: Preserving recently used remote address: [AF_INET]85.239.52.173:12352
2023-03-19 15:55:06 UDP link local: (not bound)
2023-03-19 15:55:06 UDP link remote: [AF_INET]85.239.52.173:12352
2023-03-19 15:55:11 Server poll timeout, restarting
2023-03-19 15:55:11 SIGUSR1[soft,server_poll] received, process restarting
2023-03-19 15:55:11 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2023-03-19 15:55:11 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2023-03-19 15:55:11 TCP/UDP: Preserving recently used remote address: [AF_INET]85.239.52.173:12352
2023-03-19 15:55:11 UDP link local: (not bound)
2023-03-19 15:55:11 UDP link remote: [AF_INET]85.239.52.173:12352
2023-03-19 15:55:16 Server poll timeout, restarting
2023-03-19 15:55:16 SIGUSR1[soft,server_poll] received, process restarting
2023-03-19 15:55:16 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2023-03-19 15:55:16 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2023-03-19 15:55:17 TCP/UDP: Preserving recently used remote address: [AF_INET]85.239.52.173:12352
2023-03-19 15:55:17 UDP link local: (not bound)
2023-03-19 15:55:17 UDP link remote: [AF_INET]85.239.52.173:12352
2023-03-19 15:55:22 Server poll timeout, restarting
2023-03-19 15:55:22 SIGUSR1[soft,server_poll] received, process restarting

and so on - loop of process restarting

rvp

uxer With this one, when I tether, I can successfully ping from BSD but no http/ftp stuff opens

Does it work if you fake an Android User-Agent (curl -A 'Mozilla/5.0 (Android 4.4.4; Tablet; rv:68.0) Gecko/68.0 Firefox/68.0' ...) or force use of SSL (https://) ?

EDIT: According to this paper, it is not just the TTL; other fields are also used for OS-detection (with tethering-detection being an extension of OS-detection). Both rely on inspecting the TCP/IP headers sent directly by the machines behind the phone. So, make the phone itself send the IP packets instead: Run an HTTP(S) or SOCKS5 proxy (like TOR) on the phone and point all the clients inside the network to that.

uxer

CiotBSD One idea: change the nameserver on resolv.conf

It reads as if it is easy but man resolvd:

resolvd also notices if the /etc/resolv.conf file is edited, and will rewrite the file, re-blending the various pieces of information. It will also create /etc/resolv.conf if it does not exist or if it is empty.

Is it safe to temporary stop resolvd in order to try another nameserver or what is the correct way to alter resolv.conf?

rvp Does it work if you fake an Android User-Agent (curl -A 'Mozilla/5.0 (Android 4.4.4; Tablet; rv:68.0) Gecko/68.0 Firefox/68.0' ...) or force use of SSL (https://) ?

Both no

curl -A 'Mozilla/5.0 (Android 4.4.4; Tablet; rv:68.0) Gecko/68.0 Firefox/68.0' -L unitedbsd.com
curl: (56) Recv failure: Connection reset by peer

curl -L https://unitedbsd.com
curl: (28) Failed to connect to unitedbsd.com port 443 after 152378 ms: Couldn't connect to server

But https:// fails even on regular Wi-Fi

rvp make the phone itself send the IP packets instead: Run an HTTP(S) or SOCKS5 proxy (like TOR) on the phone and point all the clients inside the network to that

This probably would be the best way. But... Is there any known ready and tried and working route? I have already wasted hours researching the topic and I am still nowhere.
With http://pdanet.co/ and https://tetrd.app/ you need an app on the Android and an accompanying app on a connected device. Of course they don't provide an OpenBSD version!
Also such apps tend to be freemium, i.e. try for free then pay for normal use.

Have tried http proxy via Servers Ultimate from Google Play (which is a trial version) on Android and on BSD just set proxy address in browser.
Nope - Servers Ultimate's log is riddled with: Outbound exception caught: Connection refused

CiotBSD

One idea: change the nameserver on resolv.conf! (on your openbsd)
Try with one about Quad9 servers, like 9.9.9.9 (and if you've correct connexion, use others publics "privacy" nameservers).

uxer

rvp Orbot

CiotBSD https://orbot.app/en/

Orbot reliably crashes on my phone. And when it doesn't crash - it doesn't connect. Bridges don't help. Only once it did show me that it had established a connexion, but websites wouldn't open.
Tried also older Orbot version - same.
(Other apps from Play market and F-Droid do work)

Gotta get my hands on another phone…

CiotBSD unwind.conf

On my waitlist…

CiotBSD
Really like the idea of suffixes as in connexion instead of connection. Gonna use it widely

rvp

uxer This probably would be the best way. But... Is there any known ready and tried and working route?

Try Orbot. Not sure if it allows (or, indeed, can be configured to) allow hosts other than localhost to connect to it.

CiotBSD

another idea:
try to config unwind.conf to forwarder and whynot using DOT preference.
See: https://man.openbsd.org/unwind.conf.5
Next start unwind service 😉
and after attempt your connexion.

CiotBSD

rvp Try Orbot.

Better: https://orbot.app/en/
and use F-Droid and Guardian Project Repository to obtain orbot

rvp

uxer Only once it did show me that it had established a connexion, but websites wouldn't open.

Try installing a standard HTTP(S) proxy app (and make HTTPS connections to prevent packet snooping). TOR exits are known and easily blocked.