How to share VPN connection with devices on hotspot? I use a VPN on my Galaxy S8+ and I am looking for a way to be able to share my ExpressVPN connection via hotspot to be able to connect devices such as Xbox One and a Smart TV. Currently cannot use a PC and my router is trash so my phone is the last resort. What can I do? What are some workarounds?
Android doesn't redirect hotspot traffic through VPN network as far as I have tested on Pie ROM (almost stock; custom ROMs might have different implementations or some specific settings). The reason is VPNService API works in Java framework of Android to redirect traffic to VPN's tun interface based on UIDs (and/or SOcket MARKs) of apps. While tethering works in native code; dnsmasq is the DNS server (up to Pie) while the rest of traffic is handled by kernel directly. Also using same internet connection or VPN for multiple devices may break terms of contract with service providers. So it's left disabled by default.

A workaround is to modify routing table but it requires root and is a bit complex on Android. This works for me:

~# ip rule add iif wlan0 lookup table 5000
~# ip route add default dev tun0 table 5000
~# ip rule add to 192.168.43.0/24 lookup table 5001
~# ip route add default dev wlan0 table 5001



First command adds a rule to RPDB to send traffic coming on hotspot (WiFi) interface to table 5000.
Second command adds a route to routing table 5000 to send all traffic on tun0 interface i.e. the one used by VPN app.
Third and fourth rules do inverse i.e. send traffic coming from VPN to tethered devices.


Firewall works above routing policy. Forwarding rules and source NAT should already be set with hotspot but just to make sure:

~# echo -n 1 &gt;/proc/sys/net/ipv4/ip_forward
~# iptables -I FORWARD -o wlan0 -i tun0 -j ACCEPT
~# iptables -I FORWARD -i wlan0 -o tun0 -j ACCEPT
~# iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE



First three commands instruct kernel/firewall to forward traffic in both directions in between VPN and hotspot interfaces.
Fourth command sets SNAT i.e. keeps track of hotspot traffic leaving VPN interface and coming back.


Make sure interfaces names and IP address are correct as on your device.

Also there is VPN Hotspot but I haven't tried. For non-root devices there exist some Wi-Fi Direct (ad-hoc) based solutions like PdaNet which require setup on both sides.

RELATED: How to use Private DNS on Android Pie for tethering?