Android VPN Networks Can Advertise an HTTP Proxy

Android API 29 introduced VpnService.Builder.setHttpProxy for attaching an HTTP proxy recommendation to a VPN network. In an existing VPN service, before establishing its configured interface:

builder.setHttpProxy(
    ProxyInfo.buildDirectProxy("proxy.example", 8080));

Here builder is the service’s VpnService.Builder and ProxyInfo is android.net.ProxyInfo. Supply the proxy host and port separately. This fragment adds the proxy information to a builder whose other VPN parameters are already configured.

PAC proxies are unsupported by this API. Creating a ProxyInfo from a PAC URI does not turn it into a supported VPN proxy configuration; use a reachable direct HTTP proxy endpoint. For permitted public traffic, the HTTP proxy list supplies host and port candidates, whose reachability must be checked under the VPN’s routing arrangement.

The setting is advisory. Applications may ignore it, so it cannot guarantee that every connection uses the proxy. In a split tunnel, applications following the recommendation may also try to send HTTP requests for destinations outside the VPN through that proxy. Those applications cannot distinguish the two route groups when applying the proxy information. Check the intermediary’s reachability under that routing arrangement before treating the setting as complete.