Bluetooth PAN network tethering

Software PureOS
1

As far back as the Maemo-Linux Nokia N900 we have had a FOSS option to install and configure bluetooth tethering using the Personal Area Network profile. Using bt vs wifi is a major A/hr savings when on battery, it is quite secure, and easy to use once configured.

This is the PAN setup guide for Maemo Linux from around 2011(have to get past the old HTTPS certs) pre-systemd arm debian fork

https://bugs.maemo.org/Bluetooth_PAN

This is mostly a setup of iptables and some bluetooth or bluez config. When I had a pinephone I got as far as getting the PAN bluetooth link and networking working but for some reason never solved why I couldn’t get the link between the BT PAN and the cellular modem’s internet connection unless I SSH’ed into the phone with the -D and connected to that socks5 proxy as a crude hack.

2

MTU, perhaps?

3

Ideally I would have made a working dhcp and network tunnel, but when I wiped and started again I must have missed a step in my notes. I never got it that close to working again using bluez(I could have been hacking at the configs themselves?) despite trying over the space of five years occasionally. It needs to be said that I don’t mentally visualize things like iptables very well and I am stuck cutting and pasting the work of others and praying too often.

4

OK I think I have it working; lets test this and add it to PureOS… Mobian too!

sudo modprobe bnep

echo “bnep” | sudo tee /etc/modules-load.d/bnep.conf

sudo hciconfig hci0 up

bluetoothctl

(in the [bluetooth] dialog type)

power on

(then end [bluetooth] session type)

exit

Lets make a personal area network

sudo sdptool add NAP

sudo nmcli connection add type bluetooth con-name "PAN-Share" ifname bnep0

bluetooth.type nap ipv4.method shared

sudo nmcli connection up "PAN-Share"

Now to keep it all after reboot

sudo apt install iptables-persistent

sudo netfilter-persistent save

crossposted to BT PAN - we need iptables and BT hackers

5

Is there an easy way to add an on/off button in the notification area or BT settings?

reality is the pairing process is enough GUI ad then when needed the client computer can connect to PAN as needed and the host phone can disconnect a problematic paired client completely.

6

I have had opportunity to use this with my ubuntu-mate (no snap) laptop several times with no issue, just pair and start ‘pureos network’ in the network app in mate, my mobile provider is crap so not surprised at the sow speeds especially during power outages.
I also have a pinetab2 with danctnix which seems to have network connection problems though a working bluetooth driver was only made available in that OS a few months ago.

7

I forgot to post that you need to sudo apt install bluez-tools

8

Great, I borked my system over in the multimedia fix thread, fixed that hosing my in-call audio.
Wiped and reinstalled PureOS, now either I missed a step or something as get this error now

modprobe: ERROR: could not insert 'bridge': Exec format error

Sadly this is a very important tool for me as the Librem5 has a short enough battery life as it is without also using wifi to bridge my cellular data to my computer or tablet, I just uses it last week during a power outage.
I dont know why bridge mode worked before…
(some notes)
The NetworkServer1 D-Bus API was removed from BlueZ 5, which is why it fails. Modern systems use bt-network command instead. cant get bridge nat or nap to work as I fumble with workarounds…idk… frustrating as I followed the above and it worked on the previous install, digging through openwrt docs I feel like one step before was finding arcane packages which hid the BT tools I needed and I didn’t doc them here…
Has anyone else tried and succeeded getting a working Bluetooth PAN access point using my instructions or others?

10

modprobe: ERROR: could not insert ‘bridge’: Exec format error

Something’s messed up with your kernel. It works on stock linux-image-6.12.0-1-librem5 6.12.94pureos1~cri1 in crimson.

11

I tried this on a fresh OS install. I have everything saved, for several hours I dug troubleshooting everything scouring openwrt to get it fixed. I probably borked something by trying everything…
@dos Since this is and has long been my own project(since we got this from TMO for the N900) thanks for not just the look but taking the time to go so far as to test.

12

Perhaps the kernel version in the fresh install is older than the kernel version that dos mentioned? It could be worth checking at least, see what uname -a says. (Not sure how it is right now, but at some point a while back when I reflashed I needed to also do “apt update && apt upgrade” afterwards to get the latest versions of everything.)

13

I will check && compare once I am home but fresh USB install Reflashing the Librem 5 – Purism with immediate apt upgrade should give me the freshest crimson AFAIK.
(edit)
Linux pureos 6.12.0-1-librem5 #2 SMP PREEMPT 6.12.94pureos1~cri1 2026-07-01 04:02:34 UTC aarch64 GNU/Linux

14

So I apparently did something wrong and was thus getting this response to the commands I though was the complete install & setup above.

purism@pureos:~$ sudo sdptool add NAP

sudo nmcli connection add type bluetooth con-name "PAN-Share" ifname bnep0 

bluetooth.type nap ipv4.method shared

sudo nmcli connection up "PAN-Share" 
Error: Failed to add 'PAN-Share' connection: bluetooth.type: property is missing
-bash: bluetooth.type: command not found
Error: unknown connection 'PAN-Share'.

whe I entered this sudo nmcli connection add type bluetooth con-name "PAN-Share" ifname bnep0 this after conditions is apparently what was missing bluetooth.type nap ipv4.method shared likely what I missed since this DID work on the previous install, not sure how I missed that when I made the above, I was nearly considering another wipe and reinstall as PAN is mission critical for me due to frequent power blackouts or running from solar power.
I ended up getting PAN Bluetooth access point working use this format:

sudo apt install bluez-tools

sudo modprobe bnep
echo "bnep" | sudo tee /etc/modules-load.d/bnep.conf
sudo hciconfig hci0 up
sudo systemctl enable --now bluetooth

sudo nmcli connection add type bluetooth con-name "PAN-Share" ifname btnap0 bluetooth.type nap ipv4.method shared
sudo nmcli connection up "PAN-Share"

sudo apt install iptables-persistent
sudo netfilter-persistent save

My only question is if bluez-tools was the only thing I installed when I first tried this so feedback please.

15

Last week I rented a car and used the Bluetooth to listen to music from my Librem both local files via Amberal and streaming using (flatpak)Shortwave. I never figured out handsfree for calls(I just kiled BT via the notification area button) but music was fine except that the radio connectivity of the BT connection was sketchy, I blame the BT of the radio in the car.
Later I accidentally clicked the Advanced Network Configuration - Network Connections app on the Librem5 that I made the BT PAN connection above.
As long as it was open I decided to look at the Pan-Share since it is now listed as an option in the GUI. It showed that the car I had rented had used my PAN connection to access the internet BIG PRIVACY VIOLATION! In the GUI there is an option to call it a metered connection, I assume this will let me click a yes-no permission option window before granting access. More important is the option in the GUI to always connect via VPN which I have configured.
Together the GUI (metered)permission popup on the Pureos phone gives me control over what a not-100%-owned-by-me device like a rented car can do (and I dont want some rented car using my internet when I just want it to play my music), forcing it through a VPN lets me setup a custom network interface on my VPS which hosts my openVPN server or perhaps even set it up to route it to TOR.
(Edit)
ok so I don’t seem to get a popup for permission to use internet over the PAN connection when I connect my laptop, I just get internet access form the phone(I am using it to post this) I had just use tab to move to the hidden OK button. I used compositor to get access to the whole GUI including being able to see cancel and save; save is not an option(greyed out). That is why this didn’t work.
I dont want to break anything, like I always seem to do, so since I have a working PAN for now I will leave this and wait to see if any of you have a good idea of rental-car-proofing the Bluetooth PAN. I think making some sort of public profile for devices like a rented car or really any borrowed or really any unverified non-simple bluetooth device(I recall reading about some sketchy headphones which only work via an app which access the internet and phone home when possible) which might want to abuse that bluetooth and internet access.

This also makes me think about whether I want to share phonebook access so that I can dial contacts form the radio head unit or if a permission for that is also warranted. below are the services my BT connection advertises(notice network access point which this thread adds):

IrMC Sync
OBEX Object Push
OBEX File Transfer
Headset
Audio Source
Audio Sink
Remote Control Target
Remote Control
Network Access Point
Handsfree Audio Gateway
Phonebook Access (PBAP) - PSE
Message Access Server
Message Notification Server
PnP Information
Generic Access
Generic Attribute
Device Information
Proprietary

16

I looked into how Android handles this, there is a global PAN toggle in BT settings. IMO this is stupid, on a privacy device like ours it should be a per-device opt-in permission. In the Gnome BT settings a tick box should be added to white list BT devices which need PAN internet access, adding an automatic VPN or socks tunnel might be nice too once the advanced network app gave me that idea.

think something like this

Car stereo
Media audio
Hands-free calls
Internet access over Bluetooth PAN
Phonebook access
Message access

Trusted laptop
Media audio
Hands-free calls
Internet access over Bluetooth PAN

The important implementation detail is that this should be enforced at the Bluetooth-profile or NetworkManager level. A device that is not allowlisted should not receive a bnep network interface or should have its forwarding blocked before any traffic can pass.

The VPN option should be separate from the permission decision:

Permission: may this device use PAN at all?
Routing: if permitted, should its traffic use the normal connection, a VPN, or a dedicated interface?

A VPN would conceal the traffic from the mobile carrier and local network, but it would not prevent the car from making connections or consuming data. A per-device VPN policy could also be difficult if all PAN clients are initially merged into the same forwarding path; the system would need separate routing based on the Bluetooth device or PAN interface.

For a first implementation, prioritize:

PAN disabled for all devices by default.
A per-device Allow internet access over PAN checkbox.
Automatic creation of a NetworkManager connection only for allowlisted devices.
A firewall rule blocking forwarding from non-allowlisted bnep interfaces.
Optional “route this device through VPN” as a later feature.

That would preserve the convenient Bluetooth experience while ensuring that pairing a rental car, headphones, speaker, or borrowed device does not silently turn the phone into its internet gateway.

does this sound sane? I wonder if a bunch of bnep interfaces is smart or creating problems.