Description suggestions
I suggest adding a feature to synchronize the Android "Per-App Proxy" (Bypass Apps) list remotely.
Node administrators should be able to provide a list of Android package names (e.g., ["ru.sberbankmobile", "ru.gosuslugi.info"]) through subscription metadata, a custom remote JSON config, or a specific field in the subscription link. When a user updates their subscription in NekoBox, the app would parse this array and automatically merge it with the local VpnService bypass list.
Note: I am ready to implement this feature myself and submit a Pull Request. Before I start writing the code, I would like to know if you are open to accepting this feature, and if so, what your architectural preferences are for passing this data (e.g., modifying the subscription parser vs. a separate config URL).
Necessity of recommendations
Currently, node admins rely on core-level routing rules (like geosite:ru, geoip:ru -> direct) to keep regional services working. However, this is no longer sufficient.
Modern anti-fraud SDKs (especially in banking and government apps) easily detect VPN usage by making simultaneous network requests to local domains (which go direct) and foreign tracking/analytics domains (which go through the proxy). The app detects the IP mismatch (Local ISP IP vs. Proxy Datacenter IP) and permanently blocks access or restricts functionality.
Because of this vector analysis, core-level routing fails to hide the proxy. The only 100% effective workaround is to completely isolate the app from the tun0 interface at the OS level using Android's VpnService bypass.
Unfortunately, non-technical users (relatives, standard users) are completely incapable of manually finding and checking the correct system packages in the "Per-App Proxy" settings. Allowing node administrators to manage and deploy this bypass list centrally via subscriptions is critical for usability and will resolve a massive pain point for those maintaining servers for non-tech-savvy users.
Description suggestions
I suggest adding a feature to synchronize the Android "Per-App Proxy" (Bypass Apps) list remotely.
Node administrators should be able to provide a list of Android package names (e.g.,
["ru.sberbankmobile", "ru.gosuslugi.info"]) through subscription metadata, a custom remote JSON config, or a specific field in the subscription link. When a user updates their subscription in NekoBox, the app would parse this array and automatically merge it with the localVpnServicebypass list.Note: I am ready to implement this feature myself and submit a Pull Request. Before I start writing the code, I would like to know if you are open to accepting this feature, and if so, what your architectural preferences are for passing this data (e.g., modifying the subscription parser vs. a separate config URL).
Necessity of recommendations
Currently, node admins rely on core-level routing rules (like
geosite:ru,geoip:ru->direct) to keep regional services working. However, this is no longer sufficient.Modern anti-fraud SDKs (especially in banking and government apps) easily detect VPN usage by making simultaneous network requests to local domains (which go
direct) and foreign tracking/analytics domains (which go through the proxy). The app detects the IP mismatch (Local ISP IP vs. Proxy Datacenter IP) and permanently blocks access or restricts functionality.Because of this vector analysis, core-level routing fails to hide the proxy. The only 100% effective workaround is to completely isolate the app from the
tun0interface at the OS level using Android'sVpnServicebypass.Unfortunately, non-technical users (relatives, standard users) are completely incapable of manually finding and checking the correct system packages in the "Per-App Proxy" settings. Allowing node administrators to manage and deploy this bypass list centrally via subscriptions is critical for usability and will resolve a massive pain point for those maintaining servers for non-tech-savvy users.