ViRouteFS

Visual Route & Flow Scanner — Android app featuring a unified system VPN, transparent routing rules, and local network diagnostics.

ViRouteFS contains no ads, analytics, telemetry, trackers, or automatic log reporting. Source code is licensed under GPL-3.0-or-later.

1. About the Project & How It Works

ViRouteFS utilizes an Android VpnService with IPv4/IPv6 TUN and a local router built on a pinned build of sing-box.

Network monitoring can start without an active VPN profile. By default, all traffic routes through System (your standard mobile network or Wi-Fi). Custom user rules direct only selected apps, domains, IP addresses, or CIDR ranges to specific VPN/proxy profiles, Block, or "TCP/TLS Compatibility" mode.

Key runtime integrations include: - System: Default Android network inside the unified router. - Block: Global emergency network shutdown. - "TCP/TLS Compatibility": Dedicated local route for bypass. - Native protocols and clients: OpenVPN, OpenConnect (Cisco AnyConnect, GlobalProtect, Fortinet, F5, Pulse, Juniper), VLESS (TLS, REALITY, XHTTP via local Xray-core), SOCKS5, VMess, Trojan, Shadowsocks, Hysteria v1/v2, Snell, TUIC, AnyTLS, HTTP/HTTPS proxy, SSH, WireGuard, and Tailscale/Headscale-compatible endpoints.

If a routing rule points to a disabled, incomplete, or unavailable profile, its traffic is automatically routed to Block. There is no silent fallback to System or another VPN.

2. Key Features

- Unified Import Center: Accepts VLESS links (including v2rayNG XHTTP exports), VMess, Trojan, Shadowsocks, Hysteria2, TUIC, SOCKS5, HTTP(S), sing-box JSON configs, OpenVPN files, and standard WireGuard .conf files. Supports paste, file selection, camera QR code scanning, and the Android share menu. - Secure Subscriptions: Manual HTTPS subscription fetching supporting URI lists, Base64 wrappers, sing-box JSON, and Clash YAML. New profiles are imported disabled by default; missing target servers remain turned off rather than deleted. - Backup & Encryption: Creates cleaned diagnostic JSON files (secrets removed) or fully encrypted .vrfs backup files (AES-256-GCM encrypted via PBKDF2-HMAC-SHA256). Sensitive data (passwords, UUIDs, keys) is stored locally using Android Keystore encryption. - Multi-Profile Routing: Groups can be set up for manual selection, lowest latency, failover, or round-robin for new connections. - Android Quick Settings: Easy management directly from the notification shade.

3. Flow Scanner & Diagnostics

The Flow Scanner displays real-time connection events directly from the local engine: - Shows app/process name, destination address, domain, protocol, selected route, active rule, transferred data volume, and status. - Compares actual outbound connections against calculated routing rules to highlight mismatches. - Allows filtering by address, domain, package, route, TCP/UDP/ICMP, IPv4/IPv6, and status. - Allows manual export of visible filtered metadata to CSV via the standard Android system UI. - Packet content is never recorded, and HTTPS traffic is not decrypted.

4. Advanced Routing & DNS Controls

Routing Rules: - Filter traffic by Android package name (requires Android 10+), exact domain, suffix, keyword, regex, specific IPv4 address, or IPv4/IPv6 CIDR networks. - Precise rules can be restricted by protocol (TCP/UDP) and specific port ranges (e.g., 443, 8000-8100). - Rules apply strictly in visible priority order.

DNS Management: - Assign custom DNS policies per rule or per VPN profile. - Supports Standard UDP/TCP, DNS over TLS (DoT), DNS over QUIC (DoQ), and DNS over HTTPS/HTTP3 (DoH). - Options to route DNS requests through selected VPN/proxy profiles, configure multi-server priority, set fallbacks with timeouts, and apply local hosts overrides.

5. TCP/TLS Compatibility Route

A dedicated local route designed for networks where intermediate middleboxes interfere with standard TCP/TLS traffic. - Powered locally by a pinned build of ByeDPI (MIT license). - Runs locally without encrypting all device traffic or hiding your IP address. - Operates on a fail-closed basis: if the process stops, traffic assigned to this route is blocked rather than leaked.

6. Privacy & Security

- 100% open-source with zero ads, analytics SDKs, or third-party trackers. - No background scanning or automatic log/PCAP exports. - Camera permissions are strictly used for live QR scanning; image frames are processed in-memory and never saved or transmitted. - Configurations, credentials, and encrypted backups remain strictly local (Android cloud backups are explicitly disabled).

License

GNU General Public License v3.0