Chute - Proxy Network Toolbox

Now with AmneziaWG, XHTTP transport, ECH, uTLS fingerprints, and post-quantum TLS. Import Clash and sing-box profiles straight from a subscription URL.

Chute turns your iPhone and iPad into a complete network workstation: a rule-based proxy client, an HTTPS debugging proxy, and a full DNS stack — all running on a network engine written from scratch for Apple platforms.

Switch it on once and the whole device is behind the proxy. Every connection your apps make can be inspected, routed, rewritten, or blocked by rules you wrote.

SYSTEM-WIDE PROXY • Chute VIF — a transparent virtual interface on a custom TCP/IP stack, no per-app setup • Local HTTP and SOCKS5 servers for the other devices on your network • Hot reload — edit rules, DNS, and scripts without dropping a single connection • On-demand activation, per-Wi-Fi behavior, and persistence across reboots

17 PROXY PROTOCOLS HTTP, HTTPS, SOCKS5, SOCKS5 over TLS, Shadowsocks (AEAD, AEGIS, and 2022), ShadowsocksR, VMess, VLESS, Trojan, TUIC v5, Hysteria2, WireGuard, AmneziaWG, AnyTLS, ShadowTLS, MASQUE, and SSH tunneling — plus a built-in Tailscale client.

Transport and TLS: XTLS Vision, REALITY, XHTTP, uTLS fingerprinting, ECH, and X25519MLKEM768 post-quantum key exchange.

30 RULE TYPES • DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD, DOMAIN-WILDCARD, DOMAIN-REGEX • IP-CIDR, IP-CIDR6, GEOIP, IP-ASN, SUBNET — match on Wi-Fi SSID, BSSID, or router • SRC-IP, SRC-PORT, DEST-PORT, IN-PORT, IN-TYPE, IN-USER, IN-NAME • PROCESS-NAME, PROCESS-PATH, PROCESS-NAME-REGEX, USER-AGENT, URL-REGEX • PROTOCOL, HOSTNAME-TYPE, and AND / OR / NOT for composite conditions • RULE-SET and DOMAIN-SET with remote subscriptions and auto-update • SCRIPT for the cases a rule alone cannot express

POLICY GROUPS • URL-Test — always ride the lowest-latency node • Fallback — automatic failover the moment a node degrades • Load Balance — round-robin, consistent hash, or sticky sessions • SSID — switch policy automatically by Wi-Fi network • Select — take the wheel manually whenever you want it

MODERN DNS • DoH, DoH3, DoQ, DoT, and plain DNS — a different resolver per domain if you want • FakeDNS for fast, leak-free routing decisions • EDNS Client Subnet, negative caching, custom hosts, and full query logs

TRAFFIC INSPECTION • Capture HTTP, HTTPS, and DNS live, with full headers and bodies • HTTPS decryption scoped to exactly the hosts and paths you choose • URL rewrite, header rewrite, and JSONPath body rewrite • Local mock responses for offline work and edge-case testing • Real-time throughput charts, per-connection detail, and traffic accounting

SCRIPTING AND MODULES • A JavaScript engine for requests, responses, DNS resolution, and scheduled tasks • A persistent store, an HTTP client, and notification APIs available to your scripts • Modules package rules, rewrites, and scripts into one installable file

BRING YOUR EXISTING SETUP • Import Clash and sing-box profiles from a subscription URL, a file, or over Wi-Fi • Remote subscriptions with automatic update • Pair with Chute Dashboard, a free Mac app, to inspect iPhone traffic over Wi-Fi or USB

BUILT FOR DAILY USE • Home Screen widget, Control Center control, and a Notification Center toggle • Face ID / Touch ID lock • Picture in Picture traffic monitor

FREE AND PAID The proxy engine, the rule engine, the DNS stack, and the live dashboard are free to use with one configuration. A single one-time purchase — no subscription — adds multiple switchable configurations, iCloud sync, HTTPS decryption, traffic recording for Chute Dashboard, local server control, the Picture in Picture monitor, and Always On. One purchase covers up to 3 iPhone or iPad devices and 3 Apple TV devices.

Chute does not operate proxy servers and does not provide network access on its own — you bring your own server or a service you already use. Traffic and logs stay on your device. Chute collects no browsing data and sells nothing to anyone.