Operating modes

AndroidWrt has one proxy engine and two ways of getting traffic into it.

Nodes, subscriptions, routing rules, SmartDNS, the panel and the configuration are the same in both modes. Only the layer that decides how traffic reaches Xray differs; in the code it is a pluggable interception backend.

Root transparent gateway

With root, rebornd steers traffic in the kernel, before any app sees it:

• Connections from hotspot clients are caught in PREROUTING and handed to Xray through TPROXY, TCP and UDP.
• Xray routes them by rule. By default, Chinese sites (geosite:cn, geoip:cn) go direct and everything else through the proxy node; the rules are yours to change.
• Client DNS can be redirected to SmartDNS, which sends overseas queries through the proxy so that they cannot be poisoned on the way.
• Replies to connections opened from outside, such as port forwards, never enter the proxy.

When the transparent proxy is switched on, rebornd starts SmartDNS and Xray, checks that both survive startup, and only then installs the rules. If any step fails, everything falls back to off: the rules never point at a proxy that is not running.

Rootless VPN

Without root, the planned mode uses Android's VpnService with tun2socks, through a companion app. Until that app exists, the panel shows the transparent proxy switch greyed out, with the reason, rather than hiding it.

Choosing the mode

The intercept setting in etc/config.json picks the backend: