Phoenix vpn

Phoenix VPN is a high-performance hybrid DNS-based and direct-protocol tunneling solution. Originally developed for Linux environments to facilitate robust bypassing of internet filtering, this project adapts the core technology specifically for Android devices. This mobile implementation integrates five powerful Go-based technologies to provide a full-device VPN experience, even in highly restrictive network environments.

- vaydns: The "DNS Tunnel" backbone. Serving as the foundational technology for extreme censorship evasion, it encapsulates data into DNS queries (DoH, DoT, TCP, or UDP) to seamlessly bypass strict firewalls and deep packet inspection (DPI) when standard internet access is entirely blocked.

- Xray-core: The "Native Direct" engine. Integrated for bleeding-edge protocol support, Xray handles high-speed direct connections natively. By pulling raw IP traffic directly from the Android TUN interface, it powers next-generation connections like REALITY-TCP (with xtls-rprx-vision flow control) and XHTTP with zero fragmentation and maximum throughput.

- sing-box: The "Universal Protocol" engine. Acting as a highly versatile secondary core, sing-box provides unmatched routing logic and supports advanced censorship-resistant protocols such as Hysteria2, Reality-tcp, VLESS-WS, and VLESS-HTTPUpgrade.

- Tun2Socks: The "Network Bridge" layer. Because vaydns and sing-box excel at complex proxy logic rather than raw device routing, Tun2Socks acts as a high-performance bridge. It captures all full-device IP traffic from the Android TUN interface and transparently feeds it into those engines.

- f35: The "E2E Scanner" layer. A highly concurrent network probing tool embedded directly in the client. It is used to rapidly measure latency, TLS handshake validity, and the true reliability of global DNS resolvers and direct edge nodes across restricted networks.

Transparency & Purpose

Phoenix VPN is a transparent, source-available project dedicated to promoting digital freedom and providing secure internet access for users in countries facing heavy internet censorship. The primary objective of this software is to facilitate open communication and information access through DNS tunneling technology. This project is strictly educational and humanitarian in nature; it does not target, exploit, or attack any systems, networks, or infrastructure. The source code is made available for public audit to ensure transparency and trust within the community of users who rely on these tools for safe and unrestricted connectivity.

Key Features

- Dedicated Proxy Mode: Features a built-in local SOCKS5 proxy, allowing users to tunnel specific applications (like Telegram) without routing their entire device through the Android VpnService. Includes accurate, application-isolated traffic monitoring.

- REALITY-TCP (with Vision): Integrated native Xray support for the REALITY protocol over TCP, utilizing flagship xtls-rprx-vision flow control. This perfectly masks your traffic as standard TLS handshakes, rendering it virtually indistinguishable to Deep Packet Inspection (DPI) firewalls.

- XHTTP Multiplexing: Unlocked bleeding-edge XHTTP protocol support through the native Xray pipeline. By multiplexing streams, it eliminates head-of-line blocking on high-latency routes, unleashing massive throughput on the most restricted networks.

- Hysteria2 (QUIC/HTTP3): Introduced full support for Hysteria2. Powered by custom UDP/QUIC transport layers with "Salamander" obfuscation and precise bandwidth flow controls, it effortlessly punches through aggressively throttled networks for brute-force speed.

- VLESS over WebSockets (WS): Added seamless support for VLESS-WS, allowing traffic to be routed and hidden behind massive, trusted Edge networks and CDNs (like Cloudflare) to keep connections alive even when direct server IPs are heavily blacklisted.

- VLESS HTTPUpgrade Transport: Implemented the heavily optimized HTTPUpgrade transport for VLESS. This provides a revolutionary, low-latency alternative to standard WebSockets for CDN routing, explicitly pinning ALPN to HTTP/1.1 to bypass unnecessary handshake delays at the edge.

- Standardized DNST URL Support: Now fully compliant with the DNST URL Scheme, enabling seamless configuration sharing across compatible applications.

- Multi-Domain Server Core: The vaydns-server can now natively listen and route traffic for multiple domains simultaneously on a single instance (Port 53), allowing for seamless domain migrations without dropping existing users.

- TCP Protocol Support: Introduced full end-to-end support for plain TCP tunneling and resolving, expanding your options for bypassing restrictive DPI firewalls.

- Concurrent Multi-Resolver Engine: The app now intelligently utilizes up to 3 selected resolvers concurrently, improving connection reliability and speed.

- Light E2E Scanner: Added a highly optimized "fast-fail" handshake scanner. This bypasses heavy payload checks to rapidly verify raw connectivity, delivering instant Alive/Dead results.

- Quick DNS Scanner: Built-in DNS scanner to scan thousands of IP addresses and identify local DNS resolvers as a pre-selection for IPs to scan with the E2E scanner.

- Cloudflare Scanner: Integrated a native Application-Layer (Layer 7) IP Scanner to automatically discover and map "clean" Cloudflare front-end IPs. This ensures VLESS-WS connections remain completely stable, even when server IPs are blocked by aggressive DPI.

- Global DNS Scanner: Integrated a native Application-Layer (Layer 7) DoH Scanner to automatically discover and route through "clean" raw IP DNS resolvers. This completely strips the domain name from the TLS SNI, ensuring the initial connection bootstrap remains completely invisible to Deep Packet Inspection (DPI) and national firewalls.

- Multi-Worker Ping: Implemented parallel worker processing for ping tests. This significantly increases scanning speed when testing multiple resolvers across various configurations.

- CI/CD Ready: Automated build pipeline via GitHub Actions that injects server configurations through encrypted secrets.

- Multi-Architecture Support: Native binaries optimized for both arm64-v8a and armeabi-v7a devices.

- Encrypted Configuration: Supports pre-configured 'Default Servers' integrated via a compiled Go native layer. This architecture secures private infrastructure details by ensuring they are not stored in plain-text configuration files.

- Remote Update Configs: Users can seamlessly update default configurations over-the-air whenever new servers or optimizations become available, ensuring the app stays ahead of network restrictions.

- Remote Update Resolvers: Users can seamlessly update default resolvers over-the-air whenever new updates become available, ensuring the app stays ahead of network restrictions.

License

Copyright © 2026 The Phoenix VPN (formerly VayDNS VPN) Project

The Phoenix Source-Available License