MagicNet Root Module: Sing-Box TUN Proxy (No VPN Slot)

MagicNet is a root-managed network workbench for Android devices that utilizes a sing-box TUN interface to route, proxy, and hijack traffic. It operates independently of the system VpnService, ensuring the default VPN slot remains available for other applications.

I tested MagicNet to bypass typical proxy application limits, and having the system VPN slot free is a massive advantage when running other privacy tools simultaneously. The atomic configuration updates saved me from broken network states during URL imports, while the dynamic app routing accurately separated my browser traffic from background services.

Features

• Native imports handle Clash YAML, base64, and common share links directly without requiring external conversion tools.
• Dynamic per-app routing automatically adjusts proxies, direct connections, or TUN bypasses using Android multi-user UIDs.
• Wi-Fi policies trigger whitelist or blacklist mode automatically depending on the specific SSID or BSSID you connect to.
• Hotspot forwarding captures tethered traffic into the TUN interface while temporarily disabling hardware offloads during proxy usage.
• Atomic updates guarantee that any failed URL configuration rolls back completely, preventing corrupted system states.
• Built-in diagnostics bundle desensitized logs, health checks, and transparent status metrics into a single command for fast troubleshooting.

Support & Requirements

• Supported OS: Rooted Android environments
• Root Manager: Magisk, KernelSU, or APatch
• Dependencies: None (uses built-in sing-box core)

How to Install

1. Download the latest MagicNet .zip package directly from the GitHub Releases page.
2. Open your preferred root manager (Magisk, KernelSU, or APatch), flash the module from your local storage, and reboot the device.
3. Access the module WebUI to import your subscription URL, and ensure "Private DNS" is disabled in your Android system settings.

MagicNet actively intercepts physical DNS/DoT queries (ports 53/853) to prevent local network leaks. It completely ignores external VPN overlays, meaning it will not conflict if you run a separate VPN app. Additionally, userspace Tailscale endpoints are natively supported within the configuration without spawning a secondary Android TUN.