TeapodStream

Android VPN client with Xray protocol support and TUN interface.

To avoid misunderstandings, here's a brief explanation of the project's essence and plans:

Teapod Stream is a personal, non-commercial project whose main goal is simplicity. It's not a feature-packed Swiss army knife for geeks with hundreds of settings, but simply a convenient, human-friendly UI for a VPN.

The client is developed as needed: code is refined when the author encounters bugs or issues themselves.

- Priorities: The project is still in the stage of building core functionality, so minor bugs are fixed last. - Releases: Stable builds that the author has already tested on their own device. - Pre-releases: Actively developed versions (everything may change or break).

Features

- Protocols: VLESS, VMess, Trojan, Shadowsocks - Transports: TCP, WebSocket, gRPC, H2, QUIC, xHTTP, HTTPUpgrade, SplitHTTP - Encryption: TLS, Reality (including post-quantum ML-DSA-65) - Shadowsocks prefix proxy — DPI bypass for servers with the ?prefix= parameter - TUN interface — all device traffic goes through the VPN - Proxy-only mode — runs a SOCKS5 proxy without raising a TUN tunnel - Split tunneling — exclude or include specific apps - Subscriptions — automatic configuration updates via URL (including self-signed TLS) - QR scanning — quickly add configurations - Real-time traffic statistics

Architecture

TUN mode (default): [Apps] -> [TUN interface] -> [teapod-tun2socks] -> [SOCKS5 127.0.0.1:port] -> [xray-core] -> [Server]

Proxy-only mode: [App] -> [SOCKS5 127.0.0.1:port] -> [xray-core] -> [Server]

- xray-core — routing core (XTLS/Xray-core) - teapod-tun2socks — bridge between TUN interface and xray SOCKS5 proxy (AAR) - Android VpnService — manages TUN interface at the OS level

Configuration

Xray:

Parameter | Default | Description Random port | off | Random SOCKS5 port on each connection SOCKS5 port | 10808 | Fixed port (when random is off) Random credentials | on | Generate SOCKS login/password on each connection SOCKS login/password | — | Fixed credentials (can be left empty — proxy without authentication) Proxy only | off | Run only SOCKS5 proxy without VPN tunnel (no VPN permission required) UDP | on | Route UDP traffic through SOCKS DNS mode | Through VPN | DNS request routing

Subscriptions:

- Supports base64 and plain-text formats - Subscriptions with self-signed TLS certificates: the app shows a dialog with certificate information and asks to proceed - HTTP User-Agent: TeapodStream/<version> (Android; XrayNG-compatible) Xray-core/<version>

License

The project uses open-source components:

- Xray-core — MIT License - teapod-tun2socks — MIT License