Skip to content

Per-App VPN Routing on Android

Android allows VPN applications to control which apps are routed through the VPN tunnel.

This is commonly called per-app VPN routing or split tunnelling.

When using a VPN together with Every Proxy, routing behaviour depends on:

  • Whether Every Proxy is included in the VPN’s allowed app list
  • Whether the Every Proxy Network Bridge is enabled

Understanding how these interact is important.

Default Behaviour (Without Network Bridge)

By default, Every Proxy runs as a normal Android application.

Its outbound connections follow Android’s routing rules.

If a VPN app is active:

  • If Every Proxy is included in the VPN app list → outbound proxy traffic routes through the VPN.
  • If Every Proxy is excluded → outbound proxy traffic bypasses the VPN.

In this mode, Every Proxy connects directly to destination servers using the network path assigned to it by Android.

With Every Proxy Network Bridge Enabled

The Every Proxy Network Bridge is a separate proxy server running locally on the device.

It does not use Android’s VPN service framework.

The Bridge supports both:

  • HTTP proxy traffic
  • SOCKS proxy traffic (SOCKS4 and SOCKS5)

When enabled:

  1. Client traffic connects to Every Proxy (HTTP or SOCKS).
  2. Every Proxy forwards that traffic to the Network Bridge using localhost.
  3. The Network Bridge establishes the outbound TCP connection.

This is standard proxy chaining:

Client
→ Every Proxy (HTTP or SOCKS)
→ Network Bridge (localhost)
→ Destination (or upstream network)

The chaining behaviour is protocol-independent. Both HTTP and SOCKS connections are forwarded in the same manner.

Interaction with Per-App VPN Routing

Because the Network Bridge is a separate local proxy process:

  • Each component (Every Proxy and Network Bridge) follows Android’s routing rules independently.
  • Whether traffic reaches the VPN depends on which app is included in the VPN’s allowed list.

For example:

  • If the Network Bridge is included in the VPN app list, its outbound connections will route through the VPN.
  • If it is excluded, its outbound connections will bypass the VPN.

This allows more granular control over routing behaviour.

Routing Scenarios

Scenario 1 — External VPN Only

  • VPN app active
  • Network Bridge disabled

Every Proxy connects directly to destination servers.

Routing depends on whether Every Proxy is included in the VPN app list.

Scenario 2 — VPN + Network Bridge

  • VPN app active
  • Network Bridge enabled

Every Proxy forwards traffic to the Bridge via localhost.

The Bridge establishes the outbound connection.

Routing depends on whether the Bridge app is included in the VPN app list.

Important Notes

  • The Network Bridge is not a VPN.
  • It does not create a tunnel interface.
  • Android’s single-VPN limitation does not apply to the Bridge.
  • Routing behaviour is determined by Android’s per-app VPN configuration.
  • Proxy chaining does not modify encryption; TLS remains end-to-end.

Summary

Per-app VPN routing determines which applications use the VPN tunnel.

The Every Proxy Network Bridge is a locally chained proxy server.

By combining per-app VPN routing with proxy chaining, you can control whether outbound proxy traffic uses the VPN connection or the standard Android network route.