How to set up a socks5 with Android cli?

Question

I found articles how to set up a http-proxy. But can't find any info, how to set up a socks5 proxy. My goal is to route all traffic from apps, etc throught this proxy. Is this possible? How then programs like Drony work?

Answer 1

Android does have HTTP(S) proxy support built-in that can be set through Settings UI and/or command line, but it isn't global, so regarded by proxy-aware apps only. However there is no built-in support for SOCKS. So if an app - unlike web browsers - cannot be configured to use SOCKS proxy, there is no way to set SOCKS5 proxy from adb shell or terminal emulator without using a third party tool / app. See details in How to set Wi-Fi HTTPS proxy, not HTTP, via adb shell?

HOW PROXY WORKS?

See this answer for HTTP(S) proxy.

SOCKS proxy - a complete handshake protocol - creates a tunnel at lower level than application proxies (http/s) in OSI model, so UDP traffic can also be transported. However the connection isn't secure like https and the security depends on initial authentication during handshake. socks can be used by individual clients or can be set system-wide i.e. to transparently forward all traffic. A common application of latter case is encrypted SOCKS tunnels like SSH dynamic forwarding, Tor, shadowsocks, stunnel, ssf, sshuttle, obfsproxy and so on. A VPN is also an encrypted tunnel but it operates even below SOCKS, therefore able to carry all IP traffic and forward every port.

HOW TO SOCKSIFY:

Apps force all traffic towards a SOCKS proxy in two parts:

1. Establish a connection between client device and proxy server

   Proxy can be a standalone server or secure tunnel. In latter case the proxy is running usually on the client device itself or on local network. E.g. Ki4a has a builtin interface for SSH login to create a Dynamic Forwarding tunnel that acts as a local SOCKS proxy. Shadowsocks and Orbot (Tor) are two more examples of encrypted tunnels. Both listen on SOCKS5 as well as transparent proxy ports. Drony and Postern can also create shadowsocks tunnels. And the list goes on.

2. Redirect traffic from whole device or specific apps towards proxy

   Every app doesn't have built-in support to use SOCKS proxy, only a few apps such as web browsers have. So we need third party apps / native tools which use different approaches.

   Two common methods are redsocks + iptables and tun2socks + VPN/routing. ProxyDroid uses first approach. In latter case root is not required because apps (like SocksDroid, Orbot, Shadowsocks and many other firewalls / sniffers) use Android's Java VPN API. Drony and Postern use Java based similar methods. Ki4a provides both options.

See this answer for other proxification methods.

---

Just as a reference, Shared library interceptor is a popular hack in Linux world (used by socksify, tsocks, torsocks, proxychains etc.). When a dynamic binary is run for some network communication, LD_PRELOAD variable is used to force load a specific dynamic library in memory before any other shared libraries. Dynamic linker searches for required symbols in this library first. This library is modified to offer the same functions as the OS socket layer, but transparently translating plain connections to proxied connections by effectively taking control of functions/syscalls related to networking (socket, connect in particular). Proxifier and ProxyCap do something similar on Windows.

Though this approach is more relevant to native libraries and not Android's Java stack (where apps run), apps can be hacked to start with specific LD_PRELOAD values. Android's linker does support LD_PRELOAD, see Termux-exec for instance. But I haven't seen a practical example of this approach for proxy on Android.

---

SETTING SOCKS PROXY WITH CLI:

While executing both above mentioned steps through command line isn't impossible, it's too complicated to be feasible for a common user. redsocks can be configured with iptables while tun2socks requires creating a tun network interface as well as configuring RPDB / routing table (that's what VPN API does at back end). SSHuttle is also similar project that's based on SSH and makes use of iptables NAT, TPROXY or routing. ss-redir (shadowsocks) also uses iptables NAT/TPROXY. Plus, all methods require root access.

For a redsocks+iptables working example, see How to send all internet traffic to a SOCKS5 proxy server in local network?

CONCLUSION:

So to use SOCKS proxy on Android is best achieved using an app. SocksDroid is simple, free, open source and has no ads. Or you can use an app specific to a protocol e.g. Tor or Shadowsocks (I have no affiliation with any apps mentioned in this answer). But the selection depends on multiple factors like protocols / methods and one important being the UDP (particularly DNS) support.

---

SOURCE:

• Comparison of proxifiers