# XKeen

XKeen is a transparent proxy for Keenetic routers that routes your entire home network through Xray or [[mihomo]] without touching individual devices. It runs on Entware (the OpenWrt package manager for stock Keenetic firmware), intercepts traffic at the iptables level via TProxy or redirect mode, and applies GeoIP/GeoSite rules to decide what goes through the proxy and what goes direct.

The setup: a Keenetic router with a USB drive formatted EXT4 with a swap partition, Entware installed, SSH access. You run a shell installer, pick your proxy core (Xray or Mihomo), point it at your upstream proxy server (a [[3x-ui]] instance, a manual [[xray-tutorial|Xray deployment]], whatever serves VLESS/VMess/Trojan), and configure which traffic to route. Every device on the LAN — phones, laptops, smart TVs, guests — gets proxied transparently. No per-device VPN apps, no [[happ-proxy|Happ]] or [[mihomo]] client installs, no [[vless-subscription-format|subscription URLs]] to manage per device.

Traffic filtering uses Re:filter GeoIP/GeoSite databases, which are the same Russian-specific block/route lists that [[russia-v2ray-rules-dat]] packages for V2Ray and mihomo. The router updates these databases on a cron schedule so the routing rules stay current as the block lists change. You can also add custom IP and domain lists for fine-grained control.

Operating modes:

- **TProxy** — the cleanest option, intercepts at the network layer without rewriting packets. Works with both TCP and UDP.
- **Redirect** — classic iptables REDIRECT, TCP only but simpler to debug.
- **Mixed** — TProxy for UDP, redirect for TCP.
- **SOCKS5** — for cases where TProxy isn't available on the kernel.

DNS is handled on the router too — DNS-over-TLS and DNS-over-HTTPS prevent DNS leaks and DNS-based blocking. IPv6 is supported.

The project is a community-maintained fork of the original XKeen by JamesZero. Current version is 1.1.3.9 (February 2026). The v1.1.x line removed the previous 15-port limitation on proxy/exclusion rules, improved auto-startup reliability, and added a self-hosted proxy option for offline deployment without pulling scripts from GitHub.

Supported hardware covers most of the Keenetic lineup: Ultra, Giga, Extra, Viva, Hero 4G, Hopper, Peak, and various Zyxel-era models. Architectures include mipsel, mips, and aarch64 depending on the model.

The main alternative to XKeen for Keenetic routers is flashing OpenWrt entirely and running a full proxy stack, but that loses Keenetic's stock firmware features (mesh networking, parental controls, ISP-specific optimizations). XKeen's value is that it adds transparent proxying without replacing the firmware.

**Repo:** https://github.com/Corvus-Malus/XKeen — ~1,000 stars, 86 forks, 148 commits. Community fork, actively maintained.