How to use Tun2Socks with Trump Proxies on Android

Tun2Socks is the more technical Android option for customers who want explicit control over routing, DNS, IPv6, per-app selection and the virtual-interface MTU. It takes ordinary SOCKS5 details—including username/password authentication—creates a TUN interface with Android VpnService, and converts the phone's captured connections into SOCKS5 connections.

This guide is for Tun2Socks by elseplus, package com.elseplus.tun2socks, available on Google Play. The developer's current feature reference documents the exact fields used below. It is an Android app built around the tun-to-SOCKS technique; it is not the same thing as cloning the xjasonlyu tun2socks Go library and expecting a ready-made phone UI.

Copy the proxy details first

• SOCKS5 Address — the hostname shown in your Trump Proxies portal, without a scheme or port.
• SOCKS5 Port — the exact port assigned to the line.
• Username — the proxy username, copied exactly.
• Password — the proxy credential, not your portal password.

The ideal Tun2Socks settings

Add the SOCKS5 profile

1. 01Open Tun2Socks and make sure it is disconnected.
2. 02Tap the proxy address under the connection button, or open Config → Proxy → proxy list.
3. 03Tap Add Proxy.
4. 04Give it a specific Profile Name that includes country and account identity.
5. 05Paste the portal hostname into SOCKS5 Address and the supplied number into SOCKS5 Port.
6. 06Paste the proxy Username and Password. Do not leave them blank or select anonymous authentication.
7. 07Tap Add Proxy, then select the new profile so its checkmark is active.
8. 08Back in Config, confirm the read-only Proxy card shows the intended host and port—not 127.0.0.1:1080.

Choose Global Mode or Per-App Mode

Global Mode adds every app to the tunnel and is the right default for a dedicated work phone. Per-App is useful when only one or two apps should consume the proxy, but everything you do not tick stays on the real Wi-Fi/mobile connection.

• Dedicated phone / one account: turn Global Mode on. This gives you the smallest leak surface and the simplest mental model.
• Mixed personal and work phone: open the Apps tab, choose Per-App, search for the target app and any browser used for verification, and tick each one deliberately.
• Do not forget helper apps: authentication browsers, WebView-based login helpers and link-opening browsers may be separate packages. If they are not selected in Per-App mode, they go direct.

Configure Network and DNS

1. 01Open Config → Network and turn IPv4 on.
2. 02Turn IPv6 on so the app installs both default TUN routes. Reconnect after changing route families.
3. 03Leave IPv4 DNS at 8.8.8.8 initially. The resolver choice matters less than making sure the query follows the proxy.
4. 04Open Config → DNS and switch Remote DNS on.
5. 05Leave MapDNS Address at 198.18.0.2, MapDNS Port at 53 and DNS Cache Size at 10000.
6. 06Return to Home and confirm the quick toggles show Global Mode (or your deliberate Per-App selection), IPv6 and Remote DNS enabled.

MapDNS does not mean the phone is sending DNS to the reserved address on the public internet. Tun2Socks maps requested names to a synthetic internal address, carries the lookup through the SOCKS path and restores the real destination when it opens the proxy connection. That is why changing 198.18.0.2 to a favourite public DNS server is wrong.

Leave UDP over TCP off

Tun2Socks exposes UDP over TCP under the Proxy section. The name is tempting because standard Trump Proxies lines are TCP, but it does not magically make the remote endpoint UDP-capable. The developer describes it as an encapsulation mode for compatible restricted/forwarded environments; our standard endpoint does not advertise that server-side transport. Leave the switch off.

For browser and account traffic, blocking or failing UDP is acceptable because QUIC falls back to TCP. If the workload is voice, live video, gaming or anything with a hard UDP requirement, use a full mobile VPN line. Do not keep toggling UDP modes until one happens to stop showing an error—that can create a direct leak or an unstable half-working path.

Keep LAN sharing off

The Allow LAN Connection switch turns the phone into a SOCKS5 relay for other devices, normally on port 7890. That is a useful lab feature but a poor default on hotel, office or shared Wi-Fi. It expands who can reach the client, makes traffic attribution harder and can consume the line from a second device. Leave it off unless you are intentionally building a secured gateway and understand Android firewalling.

Connect, then verify every layer

1. 01Disconnect any other VPN, firewall or ad blocker that uses Android's VPN slot.
2. 02Tap the large Tun2Socks connection button. On first use, approve Android's VPN connection dialog.
3. 03Wait for Connected and confirm upload/download packet counters move when you open a page.
4. 04Open api.ipify.org in a fresh private tab and confirm the public IP differs from your direct connection.
5. 05Check the country. The exact mobile address may change after rotation, but it should remain in the purchased country.
6. 06Run a DNS leak test. With Remote DNS on, the local Wi-Fi ISP or mobile carrier should not appear as the resolver path.
7. 07Run an IPv6 leak test. It must not show the phone's direct IPv6 address. A proxied IPv6 result or no IPv6 result is safer than a direct one.
8. 08Open the intended platform and perform one normal action. A local green status is not a substitute for testing the actual customer path.

When to change the MTU

Leave the app's Android MTU at 8500 while the connection works. MTU is not a speed slider. Only lower it when small pages work but larger uploads or image-heavy pages consistently hang on one network. Change one step at a time—try 1500, then 1400 if needed—reconnect, and repeat the same transfer. Put it back if the symptom does not change.

Troubleshooting by symptom

Rotation does not require a new profile

End the account session, trigger rotation from the customer portal, wait for the mobile line to return, then reconnect Tun2Socks and verify the new public IP. Do not edit the saved SOCKS5 Address, Port, Username or Password. Rotation changes the carrier exit behind the endpoint, not the endpoint itself.