Security model
Conservative defaults for a deliberately local proxy
CellRoute is designed for trusted local ingress, authenticated access and restricted destinations. It reduces common open-proxy and server-side request risks, but it does not replace broader network security tools.
Local-only ingress by default
- Allow only LAN clients or sources you explicitly trust.
- Do not expose the listening port with router port forwarding or public firewall rules.
- Keep authentication enabled, use the generated high-strength password and regenerate credentials periodically.
Destination protection
Default policy denies private, loopback, link-local, multicast, CGNAT 100.64.0.0/10 and IPv6 ULA destinations. Domain destinations are checked again after cellular DNS resolution so restricted returned addresses are not trusted merely because the original request used a host name.
Traffic privacy
- HTTPS CONNECT creates a TCP tunnel; CellRoute does not decrypt TLS, install a CA or read TLS plaintext.
- Request bodies, cookies, Authorization and Proxy-Authorization headers are not recorded.
- Google Play purchase tokens are excluded from logs.
- Targets and identifiers in diagnostic logs are redacted.
Credential storage
- Proxy passwords are stored with Android Keystore-backed AES/GCM encryption.
- Empty passwords are rejected.
- Credential checks use constant-time comparison.
- Repeated authentication failures are rate-limited.
Security limitations
A local proxy is not a VPN, enterprise zero-trust gateway, firewall, intrusion detection system, anonymity service or complete device traffic controller. Client applications and destination services remain responsible for their own security and end-to-end encryption.