This guide compared to PDANet, FoxFi, NetShare, EasyTether, Wi-Fi Tether Router, TetherMe, iTether, MyWi, iPhoneModem:
-
+ Supports hotspots from Android phones & tablets, and Quectel modems.
-
There is methods for unjailbroken iOS and iPadOS, however they are frustrating to handle.
-
-
+ Jailbreaking or rooting is not required.
-
+ Fully open-source and free of charge.
-
+ Better reliablity and internet speeds.
-
+ On "unlimited" telecom plans, grants you unlimited data for hotspots.
-
Use within reason. Try not to use over two TBs (2000GB) of data in a month.
-
-
+ Moves past various types of throttling, such as limited video quality on YouTube or other streaming services.
-
If you use an OS that blocks Android snitching by default, such as GrapheneOS. Skip to "2. Moving past throttling".
-
Quectel modems: Skip to "2. Moving past throttling".
iOS and iPadOS
See here for the SSL method if you’re willing to experiment. Contributions here would be greatly appreciated, as I can’t anticipate every OS configuration and general setup, which is a requirement for these SSL and SSH methods.
Rooted/jailbroken Android
-
Install Magisk; read "Getting Started", then "Patching Images".
-
Download the Unlimited Hotspot Magisk module.
-
Open Magisk → Modules → Install from storage → Select the "unlimited-hotspot-v7.zip" that was downloaded.
-
Reboot.
|
ℹ️
|
For every macOS device you use, you’d have to install SpoofDPI on each. Same applies for Android devices via installing PowerTunnel, and so on for other OSes. |
-
FreeBSD, OpenBSD: zapret.
-
macOS and Linux: PowerTunnel, SpoofDPI, or zapret (for macOS, use zapret’s BSD instructions).
How to use PowerTunnel on macOS
-
Make sure the latest PowerTunnel.jar is downloaded.
-
Download the Adoptium installer and open it.
-
After you got done installing Adoptium "Temurin", in Finder, Left Option + Right Click PowerTunnel.jar then click "Open".
-
-
Windows: GhosTCP.
-
Android: PowerTunnel for Android; run it in VPN mode.
-
iOS/iPadOS: Cloudflare’s 1.1.1.1 app; any other VPNs work too, but be sure to use a reptuable one that utilizes WireGuard.
macOS
-
Download Unlimited Hotspot, then open
unlimited-hotspot-main.zipin Finder to extract it. -
After extracted, open the "unlimited-hotspot-main" folder, then open its "macOS" folder.
-
Open Terminal.
-
Type
sudo -i, enter your login password, then press Enter. -
Type
cpthen drag theset-ios-tcp-stack.shfile in, press Space, type in/var/rootand press Enter. -
Type
cpthen drag thefelikcat.set.ios.tcpstack.plistfile in, press Space, type in/Library/LaunchDaemonsand then press Enter. -
chmod +x /var/root/set-ios-tcp-stack.sh -
launchctl load -w /Library/LaunchDaemons/felikcat.set.ios.tcpstack.plist
-
nano /etc/pf.conf -
Add the following three lines before
nat-anchor:
-
pfctl -f /etc/pf.confthenpfctl -e
For Quectel modems, or if the hotspot device is plugged into a router, then these steps are required:
Asuswrt-Merlin
-
Advanced Settings - WAN→ disableExtend the TTL valueandSpoof LAN TTL value. -
Advanced Settings - Administration-
Enable JFFS custom scripts and configs→ "Yes" -
Enable SSH→ "LAN only"
-
-
Replace the LAN IP and login name if needed:
$ ssh 192.168.50.1 -l asus-
Use other SSH clients if preferred, such as MobaXterm or Termius.
-
-
# nano /jffs/scripts/wan-event
#!/bin/sh
# shellcheck disable=SC2068
Say() {
printf '%s%s' "$$" "$@" | logger -st "($(basename "$0"))"
}
WAN_IF=$1
WAN_STATE=$2
# Call appropriate script based on script_type
SERVICE_SCRIPT_NAME="wan${WAN_IF}-${WAN_STATE}"
SERVICE_SCRIPT_LOG="/tmp/WAN${WAN_IF}_state"
# Execute and log script state
if [ -f "/jffs/scripts/${SERVICE_SCRIPT_NAME}" ]; then
Say " Script executing.. for wan-event: $SERVICE_SCRIPT_NAME"
echo "$SERVICE_SCRIPT_NAME" >"$SERVICE_SCRIPT_LOG"
sh /jffs/scripts/"${SERVICE_SCRIPT_NAME}" "$@"
else
Say " Script not defined for wan-event: $SERVICE_SCRIPT_NAME"
fi
##@Insert### nano /jffs/scripts/wan0-connected
#!/bin/sh
# HACK: I am unsure of what to check.
## Do this too early and the TTL & HL won't be set.
sleep 5s; modprobe xt_HL; wait
# Removes these iptables entries if present.
# WARNING: Only removes these entries once, and never assumes the same entries are present twice.
iptables -t mangle -D PREROUTING -i usb+ -j TTL --ttl-inc 2
iptables -t mangle -D POSTROUTING -o usb+ -j TTL --ttl-inc 2
ip6tables -t mangle -D PREROUTING ! -p icmpv6 -i usb+ -j HL --hl-inc 2
ip6tables -t mangle -D POSTROUTING ! -p icmpv6 -o usb+ -j HL --hl-inc 2
# Move past TTL & HL hotspot detections.
## Increments the TTL & HL by 2 (1 for the router, 1 for the devices connected to the router).
iptables -t mangle -A PREROUTING -i usb+ -j TTL --ttl-inc 2
iptables -t mangle -I POSTROUTING -o usb+ -j TTL --ttl-inc 2
ip6tables -t mangle -A PREROUTING ! -p icmpv6 -i usb+ -j HL --hl-inc 2
ip6tables -t mangle -I POSTROUTING ! -p icmpv6 -o usb+ -j HL --hl-inc 2Now, set permissions correctly to avoid this error: custom_script: Found wan-event, but script is not set executable!
# chmod a+rx /jffs/scripts/*
# reboot
GoldenOrb or OpenWrt via LuCI
-
GoldenOrb specific:
Network→Firewall→Custom TTL Settings-
Ensure its option is disabled.
-
-
Network→Firewall→Custom Rules
# Removes these iptables entries if present; only removes once, so if the same entry is present twice (script assumes this never happens), it would need to be removed twice. iptables -t mangle -D PREROUTING -i usb+ -j TTL --ttl-inc 2 iptables -t mangle -D POSTROUTING -o usb+ -j TTL --ttl-inc 2 ip6tables -t mangle -D PREROUTING ! -p icmpv6 -i usb+ -j HL --hl-inc 2 ip6tables -t mangle -D POSTROUTING ! -p icmpv6 -o usb+ -j HL --hl-inc 2 # Move past TTL & HL hotspot detections. ## Increments the TTL & HL by 2 (1 for the router, 1 for the devices connected to the router). iptables -t mangle -A PREROUTING -i usb+ -j TTL --ttl-inc 2 iptables -t mangle -I POSTROUTING -o usb+ -j TTL --ttl-inc 2 ip6tables -t mangle -A PREROUTING ! -p icmpv6 -i usb+ -j HL --hl-inc 2 ip6tables -t mangle -I POSTROUTING ! -p icmpv6 -o usb+ -j HL --hl-inc 2
Details
|
🔥
|
Never spoof to an IMEI of a device you do not own, you will block the device of whoever uses it — but only if it’s on the same telecom. It is also illegal in the United States to spoof to an IMEI of a device that is not owned by you. |
-
AT+EGMR=1,7,"The IMEI here"
Installation instructions for other OSes, such as Windows, Linux, etc.
macOS
-
Go to AirVPN’s IP Leak to see your current DNS servers. Save a screenshot of this page.
-
Install Homebrew if you haven’t already.
-
brew install dnscrypt-proxy -
Be sure to read the information Brew gives you after it’s done installing dnscrypt-proxy.
-
It is recommended to install dnscrypt-proxy’s service.
-
-
Open Settings, go to Network, then click on the Network interface you are currently using; for me, that is "USB 10/100/1G/2.5G LAN".
-
Click "Details…"
-
Go to DNS, press the Plus (+) button under "DNS Servers", then type in
127.0.0.1
-
Go back to AirVPN’s IP Leak to see if the changes to your DNS servers is successful; compare it to your prior screenshot.
-
Use Netflix’s Speedtest, then compare that result to Waveform’s Bufferbloat Test.
-
This tests for throttling of streaming servers (Netflix), various forms of data fingerprinting, and hotspot detections.
-
-
This only works via USB, as it will block wireless hotspots.
-
Context: Data saver tells Android to restrict data to only the USB hotspot and which app is at the forefront.
-
-
Android & iOS: Search for "Roaming" in the Settings app, then disable it.
-
Context: Roaming to a different telecom usually has unavoidable throttling. Roaming kicks in when signal strength is either very poor or non-existent from your telecom. In T-Mobile USA’s case, they roam on AT&T with only up to 250kbps download & upload speeds on AT&T’s towers.
-
-
iOS: Context: T-Mobile owns Sprint’s towers. For me, Sprint has consistently better speeds at my home.
-
Install NetMonster for its network monitoring. Without NetMonster, you are blind to what bands are used, and their signal strength.
-
Install Network Signal Guru then use it to set the allowed LTE bands to only the "LTE 4x4 Bands" listed on cacombos.com for your device. This could stabilize your speeds, and can potentially increase speeds.
-
If the ads bother you, enable Systemless Hosts in Magisk’s settings, then install AdAway and use its Root method; do not use its VPN method.
|
💡
|
Android → Only if you have high ping or ping spiking issues: try disabling "hotspot hardware acceleration" in the Settings app. |
Learning resources
-
https://incolumitas.com/2021/03/13/tcp-ip-fingerprinting-for-vpn-and-proxy-detection/
-
https://blog.cloudflare.com/optimizing-tcp-for-high-throughput-and-low-latency/
-
Showed that moving past the hotspot clasification on non-jailbroken iOS and iPadOS devcies is possible, via ad-hoc Wi-Fi on the client, and a proxy server on the iOS/iPadOS device: https://blog.cyrusroshan.com/post/phone-data-hotspot
Third-party scripts
-
/jffs/scripts/wan-eventused for Asuswrt-Merlin is a refined version of this script.
You’ve reached the end of this guide. Star it if you liked it.
Tip me if you want more pre-paid United States telecoms tested, such as AT&T, Verizon, and third-party MVNOs using say AT&T’s network like Cricket Wireless. As of Sep 10 2023: I’ve only tested with a Magenta T-Mobile plan, with me maxing out its hotspot data out.
Scan this image, or click on it to tip me on Ko-fi:
