HTTP / HTTPS / SOCKS5 / PAC listeners in. Wi-Fi, cellular while on Wi-Fi, WireGuard, OpenVPN, Tor, and upstream proxies out — per-flow, round-robin, with a live exit-IP proof. The phone farm operator's self-hosted alternative to subscription proxies.
No ads ArxRoute makes zero outbound calls except the egress you configure. The no-telemetry pledge is verifiable in 30 seconds — aapt dump permissions + the open dependency list.
Clients point at the phone's local proxy. ArxRoute decides — per domain, per rule, or round-robin — which radio or tunnel carries each flow, and the phone's own VpnService binds cellular so the egress is the VPN owner's legitimate upstream (no EPERM, no leak).
HTTP/HTTPS (CONNECT), SOCKS5, and a PAC server. Bind loopback, a LAN IP, or all interfaces — fail-closed: a non-loopback bind without a password is refused.
Per-flow rules + a default egress set. Round-robin across Wi-Fi, cellular, an upstream proxy, or Tor. Cellular-routed flows fall back to Wi-Fi when over the data cap or on radio flap.
WireGuard (wireguard-go), OpenVPN (openvpn3), and Tor (Guardian TorService) all run inside the app's own VpnService — so egress sockets are protect()ed and cellular-bound.
The differentiator no incumbent matches: real carrier IPs without dropping the LAN. The cellular Network handle is bound per-flow via android_setsocknetwork.
Per-connection bytes, a live connections dashboard, cellular data cap with live mid-flow enforcement, and per-egress exit-IP proving.
A small authenticated LAN HTTP API + Android Intents for rotation, egress selection, stats, and pause/resume — iProxy-style automation, self-hosted. See the API →
A proxy app is a black box until you prove the exit. ArxRoute's TEST ALL EGRESSES button dials every available egress in parallel through ip.overflow.biz and lists each one's real exit IP on screen. If a flow isn't leaving by the network you expect, you see it immediately — not in production.
ArxRoute needs VpnService so it can own the tunnels and protect() egress sockets. One consent dialog, one tap.
Default bind is loopback; to serve a LAN client, set proxy auth (fail-closed) and the phone's LAN IP. HTTP on :8080, SOCKS5 on :1080 by default.
The header populates one exit IP per egress — Default (Wi-Fi), Mobile, each upstream proxy, and Tor. Each row is the true public IP as seen through that egress.
With Wi-Fi connected and Mobile enabled, the Mobile row shows your carrier's IP — distinct from the Default row — proving the per-flow cellular bind is live without dropping Wi-Fi.
aapt dump permissions app-release.apk shows 8 permissions, zero dangerous. The dependency list is open. Reproducible builds let you rebuild bit-identical and confirm nothing phones home.
Native Go core (gomobile .aar) + Kotlin/Jetpack-Compose UI + Android foreground services. arm64-v8a. Target SDK 34, min SDK 24.
| Area | Detail |
|---|---|
| Proxy listeners | HTTP/HTTPS (CONNECT), SOCKS5 (RFC 1928/1929, CONNECT only), PAC server. Independent per-listener binds; one failing listener never takes the proxy down. |
| Egress selection | Per-flow host rules (first-match) + a default egress set. Set entries: wifi, cell, proxy, tor. More than one → round-robin. Cellular slots degrade to Wi-Fi when over cap or unavailable. |
| Cellular bind | Per-flow via android_setsocknetwork; fail-closed (a bind errno aborts the dial, never silently uses the default network). IPv6-first with DNS64 on IPv6-only carriers. |
| Upstream proxies | HTTP/HTTPS-CONNECT and SOCKS5 upstreams, round-robin with failover. HTTPS upstreams TLS-wrap the proxy connection before CONNECT. |
| Tunnels | WireGuard (wireguard-go), OpenVPN (openvpn3 via SWIG), Tor (Guardian TorService, SOCKS 9050). All owned by the app VpnService; Tor auto-reconnects on network change via the control port. |
| Security | Fail-closed auth-or-loopback, 15s slowloris handshake deadline, 512-connection concurrency cap, 10-min idle splice timeout, EncryptedSharedPreferences for keys, zero analytics/crash SDKs. |
| Data cap | Cellular cap enforced live mid-flow (not just at connection close); over-cap flows fall back to Wi-Fi. |
| Resilience | MIUI/OEM freeze + idle-kill self-heal; config persists in encrypted store so a null-intent restart comes back with the same config; foreground services with specialUse type survive backgrounding. |
| Operator API | Loopback/LAN HTTP control plane (Pro) — see API spec. |
| Licensing | Core hand-rolled (permissive); openvpn3 incorporation is MPL-2.0 — source-disclosed at github.com/rorph/arxroute-vpnclient. |
A small authenticated LAN HTTP control plane for phone-farm automation — the self-hosted iProxy-alternative surface. The binary is perpetual: this API never phones home and there is no kill-switch. Token auth, constant-time compared, with admin/buyer scopes.
ArxRoute8788 by default; bindable to 127.0.0.1, one LAN interface, or 0.0.0.0. LAN exposure is plaintext — use only on a trusted network or tunnel, with a generated high-entropy token.Authorization: Bearer <token>. admin = all endpoints incl. /tokens CRUD; buyer = read (/status /stats /test) + /rotate.GET /docs; OpenAPI 3.0 at GET /openapi.json (public; operational endpoints still require auth).| Method | Path | Purpose |
|---|---|---|
| GET | /status | Live state: paused, egress set, activeConns, bytesUp/Down, cellUsed, capReached, lastError. |
| GET | /stats | Byte counters, active connections, and the live connections array. |
| GET | /test?tor=1&timeout=12000 | Run TEST ALL EGRESSES; returns each egress {label,egress,ok,exitIp,ms,err}. |
| POST | /egress?set=wifi,cell | Set the default egress target set (wifi,cell,proxy,tor; >1 = round-robin). |
| POST | /pause | Stop forwarding new connections; existing ones drain. |
| POST | /resume | Resume forwarding. |
| POST | /rotate (buyer+) | Cellular IP rotation — honesty contract {changed,before_ip,after_ip,method_used,outcome,error}, never promises success. Rooted: method_used=root. Non-root: unavailable (Shizuku/Sui WIP). Concurrent rotations → 409. |
| GET/POST/DEL | /tokens (admin) | Scoped-token CRUD: list · mint a buyer token (returned once) · delete ?token= to revoke. |
TOKEN=your-operator-token
BASE=http://PHONE_LAN_IP:8788
curl -s -H "Authorization: Bearer $TOKEN" $BASE/status
curl -s -H "Authorization: Bearer $TOKEN" "$BASE/test?tor=1" # exit IP per egress
curl -s -X POST -H "Authorization: Bearer $TOKEN" "$BASE/egress?set=cell" # force cellular
curl -s -X POST -H "Authorization: Bearer $TOKEN" $BASE/rotate # {changed,before_ip,after_ip,method_used}
Full operator guide, iProxy migration recipe, and Android Intent actions are documented in the app's OPERATOR_API.md. Free tier does not bind the API listener; the Go handler retains a 402 defense-in-depth response if started without a Pro entitlement.
One-time, own-it-forever. No subscriptions on the binary — a payment lapse never disables a running fleet. Free gates on scale, never on reachability: you can self-validate before you pay.
No ads — ever. An ad SDK inside a proxy app would break the no-telemetry pledge that's the whole point. Distribution starts via signed release; Google Play listing is planned as a defensive name-claim once the trust pack is live.