I have a kindle paperwhite which doesn't support adding Proxy servers in WiFi connections. I have created a hotspot connection via WiFi on my ubuntu thorugh which I connect my phones. I only have Ethernet connection for Internet. I have to configure the proxy server under networking tab in Settings in Ubuntu. For some reason when I connect to the hotspot SSID from my ohones I still need to add the proxy server in my phone. Can I share/ route internet access via WiFi so that the mobile devices like my kindle can access internet without a need of handling proxy servers, only my PC needs to.

1 Answer 1


When you set up a hot spot, you computer functions as a NAT router—all it is doing is rewriting packets to appear as if they come from your computer, and then rewriting and forwarding on the responses. This usually only extends as far tracking connections—except optionally for a few things (like FTP) it doesn't do anything to the data inside the packet, just the headers. That's why if your PC needs a proxy, so do the devices behind it.

However, what you want to do is possible—it's just not going to be easy. You need to set up a transparent proxy (running on your machine), then configure that proxy to forward to the actual proxy. Traditionally on Linux this has been done with Squid (and Google for squid transparent proxy will find some guides) and iptables TPROXY.

There is a big problem though: transparent proxying of HTTPS is not easy. Squid can do it, but it needs to be able to generate valid certificates for arbitrary sites. That means generating your own CA, and installing it on the clients. I doubt that's easy on a Kindle. And of course most, if not all, of the Amazon services the Kindle wants to access are HTTPS.

The next problem you'll face with doing that is HTTP private key pinning (HPKP). I'm not sure if the Kindle Paperwhite does that—but if it does, you won't be able to fake certificates for the Amazon services.

In theory I think it should be possible to use iptables TRPOXY to intercept HTTPS and send it through an upstream proxy without faking certificates, as long as that proxy allows CONNECT. Because CONNECT just builds a tunnel for you. But I could not find any existing software to do that.

Have you considered building a tunnel to a network that doesn't require a proxy? That'd be much easier! (Presuming you have the network owner's permission, of course).

In short: what you want to do should be possible, but it doesn't look easy. I hope I've provided some pointers in case you feel like putting the time in to make it work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .