By default a phone reaches the internet directly from its region. If you have your own proxy, you can route the phone's traffic through it, so that everything the phone talks to sees the proxy's address instead.
Setting it
On the phone's screen in the app, the Egress proxy row reads Direct until you change it. Tap it and fill in:
- Type: SOCKS5 or HTTP.
- Host and port: the bare hostname or IP address, and the port. No scheme, no credentials in the host.
- Username and password, if the proxy needs them. The password is stored encrypted and is never shown back, not even to you; leave it blank when editing to keep the one already stored.
- Bypass, optionally: public IP addresses or ranges that should leave directly rather than through the proxy. Ranges must be a /16 or narrower. Hostnames are not accepted here, because the rule that enforces the bypass sees addresses, not names.
The change applies within about a second on a running phone, with no reboot. On a powered-off phone it is saved and applied when the phone next starts. If the phone could not apply it, the app says so and the setting is kept for the next attempt.
What goes through it
Every TCP connection the phone makes, from every app, whether or not the app honours Android's own proxy setting. DNS lookups go through it too, so name lookups resolve from the proxy's location as well; this is what stops the usual address-detection tricks seeing the real address.
What is refused while a proxy is set
A proxy carries TCP only. While one is set, the phone refuses other UDP traffic rather than letting it out directly: QUIC and HTTP/3, WebRTC media, and some game and VoIP traffic. Letting it out would mean the phone showing two different addresses depending on the protocol, which is exactly what setting a proxy is meant to prevent. Browsers fall back to ordinary HTTPS on their own and stay proxied; a raw-UDP app will not work while a proxy is set. Destinations on the bypass list are exempt on every protocol.
What is not accepted
Proxies at private, loopback, link-local or carrier-grade NAT addresses are refused, and so is a hostname that resolves to one. A proxy inside our own network would turn a phone into a way of reaching other customers' phones, so the check is made on the address the phone is actually about to connect to, not just on what was typed.
Removing it
Choose Direct again. If the running phone could not be told, the app says so: the proxy is gone from your account but the phone is still routing through it until it restarts. Restart it to be sure.
Owner only. Someone you have shared the phone with can use the phone but cannot see or change where its traffic leaves from, because the settings hold your paid proxy credentials. A phone transferred to another account has its proxy removed first, for the same reason.
Still stuck? Write to us and we will answer.