3

I found articles how to set up a http-proxy. But can't find any info, how to set up a socks5 proxy. My goal is to route all traffic from apps, etc throught this proxy. Is this possible? How then programs like Drony work?

1

Android does have HTTP(S) proxy support built-in that can be set through Settings UI and/or command line, but it isn't global, so regarded by proxy aware apps only. However there is no built-in support for SOCKS, so you can't set SOCKS5 proxy from adb shell or terminal emulator without using a third party tool / app. See details in How to set Wi-Fi HTTPS proxy, not HTTP, via adb shell?

HOW PROXY WORKS:

See this answer for HTTP(S) proxy.

SOCKS proxy - a complete handshake protocol - creates a tunnel at lower level than application proxies (http/s) in OSI model, so UDP traffic can also be transported. However the connection isn't secure like https and the security depends on initial authentication during handshake. socks can be used by individual clients or can be set system-wide i.e. to transparently forward all traffic. A common application of latter case is encrypted SOCKS tunnels like SSH dynamic forwarding, Tor, shadowsocks, stunnel, ssf, sshuttle, obfsproxy and so on. A VPN is also an encrypted tunnel but it operates even below SOCKS, therefore able to carry all IP traffic and forward every port.

SOCKSification can be done in parts:

  1. Establish a connection between client device and proxy server.

    It's handled differently by different apps. For instance, SocksDroid uses native tool tun2socks at back end while ProxyDroid uses redsocks. Ki4a also uses tun2socks and has a builtin interface for SSH login to create a Dynamic Forwarding tunnel that acts as a local SOCKS proxy. shadowsocks is another encrypted SOCKS proxy. Other apps like Drony and Postern have their own closed source methods.

  2. Redirect traffic from whole device or specific apps through proxied connection.

    Every app doesn't have built-in support to use SOCKS proxy, only a few apps such as web browsers have. So again we need to use third party tools which use different approaches. Two most common methods on Android are iptables (which ProxyDroid uses) and Java VPN API (which SocksDroid, Postern, Drony, Orbot (Tor) and many other apps use). Ki4a and Shadowsocks have both options.

See this answer for other proxification methods.


Just as a reference, Shared library interceptor has been a popular hack (used by socksify, tsocks, torsocks, proxychains etc.). When a dynamic binary is run for some network communication, LD_PRELOAD variable is used to force load a specific dynamic library in memory before any other shared libraries. Dynamic linker searches for required symbols in this library first. This library is modified to offer the same functions as the OS socket layer, but transparently translating plain connections to proxied connections by effectively taking control of functions/syscalls related to networking (socket, connect in particular). Proxifier and ProxyCap do something similar on Windows.

Though this approach is more relevant to native libraries and not Android's Java stack (where apps run), apps can be hacked to start with specific LD_PRELOAD values. Android's linker does support LD_PRELOAD, see Termux-exec for instance. But I haven't seen a practical implementation of this approach for proxy on Android.


SETTING SOCKS PROXY FROM CLI:

While executing both above mentioned steps through command line isn't impossible, it's too complicated to be feasible for a common user. redsocks can be configured with iptables while tun2socks requires creating a tun network interface as well as configuring routing table (that's what VPN API does at back end), which is practically impossible. SSHuttle is also similar project that's based on SSH and makes use of iptables NAT, TPROXY or routing table. ss-redir (shadowsocks) also uses iptables NAT. Plus, all methods require root access.

CONCLUSION:

So to use SOCKS proxy on Android is best achieved using an app. SocksDroid is simple, free, open source and has no ads. But the selection depends on multiple factors like protocols / methods and one important being the UDP (particularly DNS) support.


SOURCE:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.