Attach Hotspot TCP Traffic to Redsocks in PREROUTING
A local OUTPUT rule misses packets arriving from a phone; the redirected interface address also must reach the listener.
Given the existing REDSOCKS chain with required exclusions and TCP redirect to 12345, attach the actual hotspot ingress:
iptables -t nat -A PREROUTING -i wlan1 -s 10.0.0.0/24 -p tcp -j REDSOCKSReplace wlan1/subnet and preserve local services. This does not create the chain, redirector or SOCKS server.
PREROUTING REDIRECT selects the receiving interface's primary address. A redsocks local_ip=127.0.0.1 that worked for local OUTPUT traffic therefore may not accept it. Use the hotspot address or deliberate broader bind with input restrictions, and match local_port to the redirect.
The upstream ip/port names the SOCKS server. Keep redsocks' new egress reachable and preserve exclusions if OUTPUT interception also exists. For a permitted public-target TCP route without SOCKS credentials, a matching endpoint from the SOCKS proxy list can fill the upstream fields.
This is IPv4 TCP only. UDP DNS, QUIC and IPv6 need their own design.