One inbound client Socket, one cellular-bound target Socket

Why the client Socket stays on the ingress network

The accepted client Socket already belongs to the Wi-Fi or hotspot path that delivered it to the phone. Binding that Socket to cellular would break the local client connection instead of changing the destination’s egress route.

How the target Socket uses cellular

For each proxy request, CellRoute creates a new outbound Socket from the cellular Network’s socket factory and connects it to the allowed destination. This per-connection operation avoids process-wide network binding.

val socket = cellularNetwork.socketFactory.createSocket()
socket.connect(targetAddress, timeout)

Simplified illustration: error handling, policy checks and lifecycle management are omitted.

Why DNS follows the cellular Network

Resolving a target through the same cellular Network keeps name resolution aligned with the route used by the target Socket. CellRoute validates the returned addresses against the destination ACL before connecting.

val addresses = cellularNetwork.getAllByName(host)

Simplified illustration: error handling, policy checks and lifecycle management are omitted.

HTTPS CONNECT is a TCP tunnel

After an HTTP client requests CONNECT and passes policy checks, CellRoute relays the TCP byte stream. TLS stays between the client and destination: there is no CA certificate, man-in-the-middle decryption or TLS plaintext logging.

Why this is not a VPN or transparent router

CellRoute does not capture packets, create a tunnel interface, rewrite Android routes, provide NAT or change a system-wide proxy. Only applications that send supported TCP traffic to the configured proxy participate.