PrivStack Panel

Transparent proxy for rooted Android — invisible to VPN detection.

No VPN. No TUN. No icon. No TRANSPORT_VPN. Banking apps see nothing.

How It Works

App traffic → iptables TPROXY → sing-box → proxy server

- Uses kernel-level tproxy + iptables instead of Android VPN - No VpnService, no TUN interface, no status bar icon - Whitelist mode: only selected apps go through proxy, everything else is direct - Full IPv4 + IPv6 support with mirrored rules - Tested against RKNHardering → NOT_DETECTED

Components

- Magisk Module Shell scripts plus a Go daemon. Manages sing-box, iptables rules, DNS, and health monitoring.

- Android APK Kotlin plus Jetpack Compose controller. Has zero network permissions and talks to the daemon through su.

Quick Start

1. Download APK: - privstack-vX.X.X-module.zip — Magisk module - privstack-vX.X.X-panel.apk — Controller app

2. Flash module via Magisk Manager / KSU Manager / APatch

3. Reboot

4. Install and open the APK

5. Add a server: paste a vless://, trojan://, ss://, hysteria2://, or tuic:// link

6. Go to Apps tab → select which apps to proxy

7. Tap Connect

Supported Protocols

- VLESS + Reality Primary, recommended.

- VLESS + TLS Supported.

- Trojan Supported.

- VMess Supported.

- Shadowsocks 2022 Supported.

- SOCKS4 / SOCKS5 upstream Supported.

- Hysteria2 Supported through sing-box.

- TUIC v5 Supported through sing-box.

- AmneziaWG Planned through wireproxy-awg.

Import Formats

- vless://, vmess://, trojan://, ss://, socks://, socks5://, hysteria2://, hy2://, tuic:// URIs - Amnezia vpn:// format - Subscription URLs (base64-encoded URI lists) - QR codes - Clash YAML (planned) - v2rayNG JSON backup (planned)

Detection Resistance

Tested against all 6 modules of RKNHardering:

- TRANSPORT_VPN flag Not set, because no VpnService is used.

- TUN interface (tun0) Not created.

- VPN status bar icon Not shown.

- NOT_VPN capability Present.

- Package scan (23 VPN apps) Not found, because the APK has no VPN indicators.

- SOCKS5 / HTTP proxy scan Not detected, because TPROXY is not the same as SOCKS5.

- Xray gRPC API scan Blocked by root-only iptables rules.

- /proc/net/tcp scan Invisible on Android 10+ due to SELinux restrictions.

VerdictEngine result NOT_DETECTED

APK Features

- Dashboard: connection state, traffic graph, egress IP, latency - Nodes: server list with groups, latency test, import (paste/QR/subscription) - Apps: whitelist picker with templates (Browsers, Social, Streaming) - Audit: 14 security checks + Work Profile placement advisor - Material 3 with Dynamic Color (Android 12+) - Russian + English

License

MIT