XKeen
- title
- XKeen
- type
- toolbox
- summary
- Transparent Xray/mihomo proxy for Keenetic routers, proxying the whole LAN without per-device apps
- tags
- networking, proxy, vpn, router, keenetic
- language
- Shell
- license
- Unknown
- created
- 2026-04-10
- updated
- 2026-04-10
XKeen is a transparent proxy for Keenetic routers that routes your entire home network through Xray or mihomo without touching individual devices. It runs on Entware (the OpenWrt package manager for stock Keenetic firmware), intercepts traffic at the iptables level via TProxy or redirect mode, and applies GeoIP/GeoSite rules to decide what goes through the proxy and what goes direct.
The setup: a Keenetic router with a USB drive formatted EXT4 with a swap partition, Entware installed, SSH access. You run a shell installer, pick your proxy core (Xray or Mihomo), point it at your upstream proxy server (a 3x-ui instance, a manual Xray deployment, whatever serves VLESS/VMess/Trojan), and configure which traffic to route. Every device on the LAN — phones, laptops, smart TVs, guests — gets proxied transparently. No per-device VPN apps, no Happ or mihomo client installs, no subscription URLs to manage per device.
Traffic filtering uses Re:filter GeoIP/GeoSite databases, which are the same Russian-specific block/route lists that russia-v2ray-rules-dat packages for V2Ray and mihomo. The router updates these databases on a cron schedule so the routing rules stay current as the block lists change. You can also add custom IP and domain lists for fine-grained control.
Operating modes:
- TProxy — the cleanest option, intercepts at the network layer without rewriting packets. Works with both TCP and UDP.
- Redirect — classic iptables REDIRECT, TCP only but simpler to debug.
- Mixed — TProxy for UDP, redirect for TCP.
- SOCKS5 — for cases where TProxy isn't available on the kernel.
DNS is handled on the router too — DNS-over-TLS and DNS-over-HTTPS prevent DNS leaks and DNS-based blocking. IPv6 is supported.
The project is a community-maintained fork of the original XKeen by JamesZero. Current version is 1.1.3.9 (February 2026). The v1.1.x line removed the previous 15-port limitation on proxy/exclusion rules, improved auto-startup reliability, and added a self-hosted proxy option for offline deployment without pulling scripts from GitHub.
Supported hardware covers most of the Keenetic lineup: Ultra, Giga, Extra, Viva, Hero 4G, Hopper, Peak, and various Zyxel-era models. Architectures include mipsel, mips, and aarch64 depending on the model.
The main alternative to XKeen for Keenetic routers is flashing OpenWrt entirely and running a full proxy stack, but that loses Keenetic's stock firmware features (mesh networking, parental controls, ISP-specific optimizations). XKeen's value is that it adds transparent proxying without replacing the firmware.
Repo: https://github.com/Corvus-Malus/XKeen — ~1,000 stars, 86 forks, 148 commits. Community fork, actively maintained.