L×Box: VPN & Proxy Client
VPN client: 12+ protocols, subscriptions, app routing, balancing, traffic stats
L×Box is a high-performance proxy client with no compromises.
You choose the servers. You set the rules. You control the traffic. L×Box does exactly what you told it to.
12+ protocols, your Tailscale network, advanced routing, full DNS control, detour chains, per-app split tunneling and built-in diagnostics.
THE CORE IS OURS
L×Box runs on sing-box-lx, our own fork of sing-box, developed together with the app. On top of stock sing-box the core adds:
• AmneziaWG 3.1 — obfuscated WireGuard;
• XHTTP — Xray transport, including stream-one;
• VLESS + ML-KEM-768 — post-quantum protection;
• MASQUE — Cloudflare WARP as a full node and a chain link.
And it is tuned for real life on a phone:
• DNS groups — several resolvers with failover;
• smart urltest — pools, sticky selection, lazy health checks;
• load balancing — connections spread across the pool;
• self-healing of stuck connections;
• idle tunnel sleep — less memory, less battery;
• observability — DNS, connections and chains visible from the app.
12+ PROTOCOLS
VLESS, VMess, Trojan, Shadowsocks, Hysteria2, TUIC v5, NaiveProxy, AnyTLS, SSH, SOCKS, WireGuard, Tailscale, AmneziaWG 3.1, MASQUE over QUIC/HTTP-3.
Cloudflare WARP in one tap: simple registration right in the app, the private key is generated on your device and never leaves it — Cloudflare receives only the public half. WireGuard or MASQUE.
Import any familiar format: subscriptions and links, Base64, Xray arrays, WireGuard URI/INI, Amnezia vpn://, sing-box JSON configs, local files, plain text.
TAILSCALE WITHOUT A SECOND APP
Android runs one VPN at a time, so a Tailscale app and a proxy client cannot run together. In L×Box the Tailscale node runs inside the core: the phone joins your tailnet, and the rest of the traffic follows your rules.
• devices answer by name through MagicDNS;
• exit to the internet through an exit node of your tailnet;
• sign-in, device list and ping with the path in the app;
• your own control server is supported.
SUBSCRIPTIONS WITHOUT MANUAL WORK
Add a subscription — L×Box parses it and creates nodes with no duplicates. Unwanted nodes can be switched off and stay off through every update, even if the provider renames them.
Processing rules with regex and capture groups rename, rewrite or disable nodes on every refresh — and show in advance which nodes a rule will hit.
ROUTING YOU ACTUALLY CONTROL
One device can host several environments at once: work, home, travel. Each with its own rules and its own route.
Conditions: domain, IP and CIDR, port, protocol, app, network type.
DNS UNDER YOUR CONTROL
Several resolvers at once. A separate DNS per rule. FakeIP.
FULL DIAGNOSTICS ON BOARD
Ping and speed-test a node, a folder or the whole subscription — with the tunnel up or down. One-way connections get flagged. Full log right in the app. In real time the built-in tools show: which app opened a connection, where to, how much it transferred, which DNS it used, which route it took. Speed and traffic per app and per connection.
AUTOMATION
Works with automation tools (such as Tasker or MacroDroid): start, stop, switch node, query state. Your phone reshapes the setup to your scenarios — at home, on the road, when Wi-Fi changes.
WE SEND YOUR DATA NOWHERE
No account. No ads, no analytics, no advertising ID, no crash reporters. L×Box connects only to the servers and update endpoints you configured. Full backup and restore moves your setup to a new device.
A CLIENT, NOT A VPN SERVICE
L×Box provides no servers and sells no access to anyone's network — you choose your servers and subscriptions.
L×Box is a professional tool for network security, routing and network health checks. Use is allowed only in strict compliance with the laws of the country where the tool is used. Full responsibility for compliance lies with the user.
OPEN SOURCE
Free software under GPLv3. English and Russian UI, light and dark themes.
GitHub: github.com/Leadaxe/LxBox
You choose the servers. You set the rules. You control the traffic. L×Box does exactly what you told it to.
12+ protocols, your Tailscale network, advanced routing, full DNS control, detour chains, per-app split tunneling and built-in diagnostics.
THE CORE IS OURS
L×Box runs on sing-box-lx, our own fork of sing-box, developed together with the app. On top of stock sing-box the core adds:
• AmneziaWG 3.1 — obfuscated WireGuard;
• XHTTP — Xray transport, including stream-one;
• VLESS + ML-KEM-768 — post-quantum protection;
• MASQUE — Cloudflare WARP as a full node and a chain link.
And it is tuned for real life on a phone:
• DNS groups — several resolvers with failover;
• smart urltest — pools, sticky selection, lazy health checks;
• load balancing — connections spread across the pool;
• self-healing of stuck connections;
• idle tunnel sleep — less memory, less battery;
• observability — DNS, connections and chains visible from the app.
12+ PROTOCOLS
VLESS, VMess, Trojan, Shadowsocks, Hysteria2, TUIC v5, NaiveProxy, AnyTLS, SSH, SOCKS, WireGuard, Tailscale, AmneziaWG 3.1, MASQUE over QUIC/HTTP-3.
Cloudflare WARP in one tap: simple registration right in the app, the private key is generated on your device and never leaves it — Cloudflare receives only the public half. WireGuard or MASQUE.
Import any familiar format: subscriptions and links, Base64, Xray arrays, WireGuard URI/INI, Amnezia vpn://, sing-box JSON configs, local files, plain text.
TAILSCALE WITHOUT A SECOND APP
Android runs one VPN at a time, so a Tailscale app and a proxy client cannot run together. In L×Box the Tailscale node runs inside the core: the phone joins your tailnet, and the rest of the traffic follows your rules.
• devices answer by name through MagicDNS;
• exit to the internet through an exit node of your tailnet;
• sign-in, device list and ping with the path in the app;
• your own control server is supported.
SUBSCRIPTIONS WITHOUT MANUAL WORK
Add a subscription — L×Box parses it and creates nodes with no duplicates. Unwanted nodes can be switched off and stay off through every update, even if the provider renames them.
Processing rules with regex and capture groups rename, rewrite or disable nodes on every refresh — and show in advance which nodes a rule will hit.
ROUTING YOU ACTUALLY CONTROL
One device can host several environments at once: work, home, travel. Each with its own rules and its own route.
Conditions: domain, IP and CIDR, port, protocol, app, network type.
DNS UNDER YOUR CONTROL
Several resolvers at once. A separate DNS per rule. FakeIP.
FULL DIAGNOSTICS ON BOARD
Ping and speed-test a node, a folder or the whole subscription — with the tunnel up or down. One-way connections get flagged. Full log right in the app. In real time the built-in tools show: which app opened a connection, where to, how much it transferred, which DNS it used, which route it took. Speed and traffic per app and per connection.
AUTOMATION
Works with automation tools (such as Tasker or MacroDroid): start, stop, switch node, query state. Your phone reshapes the setup to your scenarios — at home, on the road, when Wi-Fi changes.
WE SEND YOUR DATA NOWHERE
No account. No ads, no analytics, no advertising ID, no crash reporters. L×Box connects only to the servers and update endpoints you configured. Full backup and restore moves your setup to a new device.
A CLIENT, NOT A VPN SERVICE
L×Box provides no servers and sells no access to anyone's network — you choose your servers and subscriptions.
L×Box is a professional tool for network security, routing and network health checks. Use is allowed only in strict compliance with the laws of the country where the tool is used. Full responsibility for compliance lies with the user.
OPEN SOURCE
Free software under GPLv3. English and Russian UI, light and dark themes.
GitHub: github.com/Leadaxe/LxBox
版本
尽管下面提供了 APK 安装包的下载选项，但你应该注意，以这种方式安装将不会收到更新通知，这是一种不太安全的下载方式。 我们建议你安装使用 F-Droid 客户端。
下载 F-Droid-
x86_64该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。
-
arm64-v8a该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。
Core 1.14.2-lx.11: Tailscale traffic to peers over a direct path works again; the coordination server is reached over port 443 from the start. Repeats of one server in a subscription are merged with a note on the node that stays. Preset rules written without conditions are kept, rules that lost their conditions are dropped. Xray JSON balancers pool servers by selector.
-
armeabi-v7a该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。
-
x86_64该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。
-
arm64-v8a该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。
-
armeabi-v7a该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。
-
x86_64该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。
-
arm64-v8a该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。
-
armeabi-v7a该版本需要 Android 7.0 及以上版本。
此包由原始开发者构建并签名，并保证对应于此源代码 tarball。
新版本 2.25.8
Tailscale: routing preset instead of node sections, Network tab with devices and exit node switching, NETWORKS on Home. Hand-written sing-box nodes go to the core as written; unknown types and openvpn-client accepted. DNS cache settings. Back twice to exit. Core 1.14.2-lx.8: MASQUE hangs fixed, XHTTP keeps at most 3 connections. Since 2.25.5 also: WireGuard node on/off without restart, folder as group, TLS fragmentation from Xray finalmask, Wi-Fi name on Android 12+.
新版本 2.25.7
Xray nodes that set TLS fragmentation in finalmask.tcp now get the core's fragmentation; these fields used to be ignored. A node that goes through another node (a chain or a subscription detour) no longer carries TLS fragmentation and shows an info notice, including nodes with tls.fragment in sing-box JSON. Fewer "field not read" notices on Xray nodes; notices with the same code are grouped into one entry. Parser and build follow contract 1.1.84.