Proxa

Proxa is a rule-based proxy and network toolbox for iPhone. Decide where every connection goes with a real rule engine, route it through the servers and networks you choose, block ads and trackers, and read your live traffic — all on device.

SEVERAL NETWORKS AT ONCE
• Connect WireGuard, Tailscale and ZeroTier at the same time. They are not modes you switch between: all three can be up together, each reachable by name.
• Rules decide which one carries each connection. Work domains over the tailnet, a lab subnet over ZeroTier, everything else direct — at the same moment, without touching a switch.
• Networks is a one-time in-app purchase. Set one up and see exactly what it would do before deciding.

REACH WHAT IS ONLY REACHABLE FROM INSIDE
• A server can be reached through one of your networks, or through another server. A proxy that lives only inside your tailnet or your ZeroTier network becomes usable, without exposing it to the internet first.
• The connection to it is carried by whatever you chose. If that is off or unreachable, the server is not used — traffic is refused rather than quietly sent out directly.
• Part of the same one-time Networks purchase.

ROUTE WITH RULES
• Domain, suffix, keyword, IP-CIDR, GEOIP and port rules, read top to bottom into policy groups.
• Send traffic through your own proxy servers or a subscription, or straight out DIRECT.
• Policy groups with health checks and automatic failover.

READ YOUR TRAFFIC
• A live request log: host, path, method, status, timing and size.
• HTTPS decryption for the hosts you list, with a guided certificate setup. Off until you turn it on; only the hosts you name are decrypted.
• WebSocket frames in both directions, plain http:// and ws:// included.
• Filter by status, method or blocked; search by host or URL.

CHOOSE YOUR RESOLVER
• Custom DNS: the system's, servers you name, DNS-over-HTTPS or DNS-over-TLS, with per-host overrides and a cache.
• An unreachable resolver falls back to the system's, so a bad setting costs a moment rather than your connection.

THIRTEEN OUTBOUND PROTOCOLS
• HTTP, SOCKS5, Shadowsocks, VMess, VLESS + REALITY, Trojan, WireGuard, SSH, Snell, Hysteria2, TUIC, HTTP/3 and AnyTLS.

FROM THE HOME SCREEN
• A widget showing status, the node in use, traffic moved and connections allowed or refused.
• Control Center switches for capture and for the traffic log — reaching for "stop recording me" should not take your network down.

ON DEVICE BY DESIGN
• Everything runs on your device. Proxa has no account, no sign-in, and no servers that receive your traffic. What you capture stays in the app's private storage until you delete it. See our privacy policy.

Proxa uses a VPN configuration (Network Extension) to route this device's traffic through its on-device engine. It is not a commercial VPN service — there is no Proxa server, and traffic goes only to the proxies and networks you configure yourself.