Proxa

Run WireGuard, Tailscale and ZeroTier at once — and decide per rule which one each connection takes. Everything on device.

Proxa is a rule-based proxy and network toolbox for iPhone. Decide where every connection goes with a real rule engine, route it through the servers and networks you choose, block ads and trackers, and read your live traffic — all on device.

SEVERAL NETWORKS AT ONCE • Connect WireGuard, Tailscale and ZeroTier at the same time. They are not modes you switch between: all three can be up together, each reachable by name. • Rules decide which one carries each connection. Work domains over the tailnet, a lab subnet over ZeroTier, everything else direct — at the same moment, without touching a switch. • Networks is a one-time in-app purchase. Set one up and see exactly what it would do before deciding.

ROUTE WITH RULES • Domain, suffix, keyword, IP-CIDR, GEOIP and port rules, read top to bottom into policy groups. • Send traffic through your own proxy servers or a subscription, or straight out DIRECT. • Policy groups with health checks and automatic failover.

READ YOUR TRAFFIC • A live request log: host, the rule that routed each connection and the node that carried it, with status, timing and size. • HTTPS decryption for the hosts you list, with a guided certificate setup. Off until you turn it on; only the hosts you name are decrypted. • WebSocket frames in both directions, plain http:// and ws:// included. • Filter by status, method or blocked; search by host or URL.

CHOOSE YOUR RESOLVER • Custom DNS: the system's, servers you name, DNS-over-HTTPS or DNS-over-TLS, with per-host overrides and a cache. • Fake IP answers lookups on the device, so a domain rule matches even when the connection never shows a name — QUIC included. • An unreachable resolver falls back to the system's, so a bad setting costs a moment rather than your connection.

THIRTEEN OUTBOUND PROTOCOLS • HTTP, SOCKS5, Shadowsocks, VMess, VLESS + REALITY, Trojan, WireGuard, SSH, Snell, Hysteria2, TUIC, HTTP/3 and AnyTLS.

FROM THE HOME SCREEN • A widget showing status, the node in use, traffic moved and connections allowed or refused. • Control Center switches for capture and for the traffic log — reaching for "stop recording me" should not take your network down.

ON DEVICE BY DESIGN • Everything runs on your device. Proxa has no account, no sign-in, and no servers that receive your traffic. What you capture stays in the app's private storage until you delete it. See our privacy policy.

Proxa uses a VPN configuration (Network Extension) to route this device's traffic through its on-device engine. It is not a commercial VPN service — there is no Proxa server, and traffic goes only to the proxies and networks you configure yourself.