[T-Mobile Samsung Galaxy S 4] mersfire:
WiFi Tether and VPN (root needed)

I've finally managed to figure it out, thanks to the threads here on XDA.

How to enable WiFi Tethering with all traffic routed through VPN

Current setup

Galaxy Note 2 (T-Mobile), Rooted, Android 4.1.2, stock TW ROM

Applications needed

- WiFi Tether Widget "Tethering Widget" from the Play store (I'm using the one by Hi-Develop)

- RootExplorer with root access

- adbd Insecure (by Chainfire) from the Play Store or from http://xdaforums.com/showthread.php?t=1687590

- APN Backup and Restore from http://xdaforums.com/showthread.php?t=1962752

- Shell script to forward traffic from http://xdaforums.com/showthread.php?t=1766020&page=4

(I named the script ipforward.sh)

#!/system/bin/sh
iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -A FORWARD -j ACCEPT
iptables -t nat -A POSTROUTING -j MASQUERADE

Steps for PC Setup

1. Root your phone

2. Install WiFi Tether Widget

3. Install RootExplorer

4. Install adbd Insecure

5. Extract files from APN Backup and Restore thread to your PC

6. Install Android Commander on Windows PC

7. Copy the new APN .xml file to phone in folder "ApnBackupRestore"

8. Copy the shell script to any folder you want (I just put it in the Downloads folder)

9. Run adbd Insecure on phone (needed to allow Android Commander install apks)

10. Run Android Commander on Windows PC (make sure root is OK, see the above thread for details)

11. Install APN Backup and Restore as a System App

12. Close Android Commander

13. Open APN Backup and Restore on your phone

14. Dismiss the warning

15. Click on the menu and disable ICS check

16. Close APN Backup and Restore (fully close)

17. Reopen APN Backup and Restore

18. You can choose to backup the original APN now

19. Click on Delete APN

20. Click on Restore APN and choose the new t-mobile.xml from WarlockW

21. Enable tethering from tethering widget (supposed stock app will overwrite APNs, so don't use it)

22. Enable VPN

23. Open Root Explorer and go to the directory you copied ipforward.sh

24. Clock on the ipforward.sh and choose Execute

25. Output should be 0 and nulls

You now have tethering enabled and all clients tethered to your device will also be tunneled through VPN.

Now every time you want to tether, you need to:

1. Run tether widget

2. Start VPN

3. Run shell script from root explorer to forward traffic to VPN tunnel

Background

It seems like the stock T-mo tethering app would route all client traffic through the phone's default IP address and not use the VPN. This probably helps them monitor the type of traffic. TrevE mod also did not work for me after 4.1.2 update, and I'm not sure what I was doing wrong. Somehow, the hidden APN used for tethering was preventing tethered traffic to go through a VPN tunnel. I did not want to mess with the APNs, but in the end this was the only solution that worked for me. I triple checked my IP address on the phone before and after VPN and also on the clients before and after VPN. This method seems to do the trick.

Routing client traffic through VPN is useful for many reasons, so I hope this solution works for others as well. Thanks to all the authors of the threads above as they were key to making this happen. The setup is somewhat involved, but the final solution is not too cumbersome.