maskproxy

WebRTC and UDP through the phone

Run the tunnel on the client device that uses the browser. The profile routes TCP, UDP and DNS through SOCKS5 to the proxy phone, using its selected cellular or Wi-Fi exit network. The proxy phone needs no root for UDP.

Running on Windows

  1. Select SOCKS5 or HTTP + SOCKS5 for the proxy and enable UDP. Connect the phone with app 0.12 or later, then download the UDP / WebRTC tunnel profile.
  2. Download sing-box 1.14.1 from the official source for your client device. Place the profile next to sing-box.exe.
  3. Check the profile in PowerShell from the same folder:
.\sing-box.exe check -c .\maskproxy-tunnel.json

Then open PowerShell as Administrator and run:

.\sing-box.exe run -c .\maskproxy-tunnel.json

Windows must approve the tunnel adapter and its permissions. Press Ctrl+C to stop. The tunnel affects the entire client device; do not run it on the production proxy phone itself. On Android, use a compatible sing-box client and approve the VPN on the client device.

Verification

  1. Check that the phone is connected and the correct exit network is available. Cellular only blocks Wi-Fi fallback when mobile data is lost.
  2. Check your public IP, then collect ICE candidates on a trusted WebRTC test page. Inspect the srflx candidate discovered by STUN: it should come from the phone's exit network. Carriers may assign different NAT addresses for different destinations.
  3. Test a real call or data channel. STUN success proves UDP request and response transport, but does not prove a complete WebRTC session; some networks require TURN.

Addresses of type host or mDNS are local device candidates, not the internet exit IP. The tunnel does not spoof device identity or browser settings and does not guarantee proxy undetectability.

DNS & connection limits

The tunnel sends DNS queries to 198.18.0.53:53 as an internal address. The proxy phone forwards them to its selected network DNS or configured custom DNS. If the relay is a hostname, only that hostname is resolved locally to establish the tunnel. Browser encrypted DNS also travels through the tunnel, but uses the browser's chosen provider.

The server must expose the proxy TCP port and UDP session range (20000–29999 by default). Behind NAT, configure the public UDP address and forward the same range. This profile does not encrypt SOCKS5 between client and server; use a trusted path or encrypted channel for public deployment. The profile contains the proxy password: keep it private. Download a new profile after changing the server, port or password.

Linux

Select Linux next to the tunnel download, then check the profile with sing-box check -c maskproxy-tunnel.json and run it with sudo sing-box run -c maskproxy-tunnel.json. Requires TUN and nftables. The Linux profile also captures UDP sockets bound to a network interface. The platform selection applies to the client device; the proxy phone itself does not need root.