Manual mode request

[jerry-wolf]

What did you do?

• Use shadowsocks as Orbot's local proxy.
• Switch proxy through SwitchyOmega in Firefox.

What did you expect to see?

Shadowsocks-android has an option so I can enter them to Orbot/SwitchyOmega's proxy input box.

What did you see instead?

• Only VPN and NAT mode supported. If shadowsocks used VPN service, Orbot opens another VPN service, shadowsocks's VPN service will close. If target device isn't rooted, can't use NAT mode.
• Shadowsocks will route all bandwidth, so can't control proxy through other software.

Additional

No more “Root” features in Orbot… use Orfox & VPN instead!

[madeye]

No plan for this.

Shadowsocks-android works as a transparent proxy, which won't provide local SOCKS5 proxy.

[madeye]

For your use case,

1. Deploy Tor on your server.
2. Use custom rules in shadowsocks-android.

[Mygod]

@madeye Should we follow Orbot's approach and offload NAT/transproxying onto AFWall+?

[Mygod]

Basically what I'm thinking of is the current NAT service codebase minus the iptables (root code execution) part, kind of equivalent to NAT mode with every app bypassed and no su invocations.

Pros:

• Get all the features from AFWall+ for free, such as finer control over network access rules;
• More modular design;
• Enables possibilities of different proxy methods, including this issue;
• Finally getting rid of NAT mode;
• Avoid possible privilege escalation, for example here:
  

  shadowsocks-android/mobile/src/main/scala/com/github/shadowsocks/ShadowsocksNatService.scala

  Line 155 in b8d7ade

  init_sb.append(cmd_bypass.replace("-p tcp -d 0.0.0.0", "-d " + profile.host))

  
  This could potentially be more dangerous if [SIP008] Online config shadowsocks-org#89 is implemented. But if we offload the root code to AFWall+, we don't need to worry about this any more. (they should worry)

Cons:

• Harder to use;
• I guess we also need to write a shell script for AFWall+ to use and write an FAQ entry about it.

I think this is a pretty good replacement for the long deprecated NAT mode. What do you think? @madeye

[madeye]

@Mygod Yes, i think It's doable if apps like AfWall can handle NAT for us.

Let's replace NAT mode in the next release. say 4.3.0.