box_for_magisk

Overview

Maintained by taamarin, Box for Magisk is an all-in-one transparent proxy infrastructure for rooted Android devices.

Unlike typical client applications that route traffic through Android’s VpnService interface, Box for Magisk utilizes native Linux networking tools (iptables, nftables, ip route, and cgroups) to route network traffic directly into high-performance proxy cores: Sing-box, Xray, V2Ray, or Mihomo (Clash.Meta). This delivers zero-latency proxying, bypasses VPN detection, and leaves your device’s single VPN slot completely free for work or local adblockers.

Technical Architecture & How It Works

Kernel TPROXY & Cgroup Redirection

1. Traffic Interception: During boot or when started via service.sh, Box for Magisk configures iptables/nftables PREROUTING and OUTPUT chains.
2. UID-Based Rules: It inspects Android app UIDs. You can configure:
   • Global mode: All apps routed through proxy.
   • Whitelist mode: Only specified apps (e.g. browsers, social media, messaging).
   • Blacklist mode: Bypass proxy for local banking or gaming apps to minimize latency.
3. Loopback Avoidance: Using Linux cgroup marks, packets originating from the proxy core itself are marked and exempted from redirection, preventing infinite routing loops.
4. DNS Leak Prevention: Intercepts port 53 (UDP/TCP) DNS traffic, routing queries through fake-ip or encrypted DNS (DoH/DoT) resolvers configured inside the proxy core.

Installation & Setup

1. Open your root manager (Magisk, KernelSU, or APatch).
2. Download and flash the latest box4magisk-vX.zip.
3. Reboot your device.
4. Add your configuration:
   • For Sing-box: /data/adb/box/sing-box/config.json
   • For Clash: /data/adb/box/clash/config.yaml
5. Edit /data/adb/box/scripts/box.config to choose your active core:

   bin_name="sing-box" # or "clash" or "xray"
   network_mode="tproxy" # or "redirect"
   proxy_mode="whitelist" # or "blacklist" or "global"

Control Commands (CLI)

Manage the service from Termux or any root terminal:

# Start proxy service
su -c "/data/adb/box/scripts/box.service start"

# Stop proxy service
su -c "/data/adb/box/scripts/box.service stop"

# Restart proxy service
su -c "/data/adb/box/scripts/box.service restart"

# View real-time connection log
su -c "tail -f /data/adb/box/run/box.log"