# adb shell with root privileges to configure the android routing tables
# In this case wlan1 is the hotspot interface and tun0 the vpn interface

# use the vpn routing table for hotspot traffic
ip rule add from all iif wlan1 lookup tun0 pref 17999

# allow traffic between VPN and hotspot
iptables -I tetherctrl_FORWARD -i tun0 -o wlan1 -j RETURN
iptables -I tetherctrl_FORWARD -i wlan1 -o tun0 -j RETURN

# masquerade traffic through the VPN
iptables -t nat -A tetherctrl_nat_POSTROUTING -o tun0 -j MASQUERADE