disabled mixed inbound in VPN-mode by default

app/src/main/java/io/nekohasekai/sagernet/Constants.kt

@@ -42,6 +42,7 @@ object Key {
     const val SHOW_DIRECT_SPEED = "showDirectSpeed"
 
     const val APPEND_HTTP_PROXY = "appendHttpProxy"
+    const val REQUIRE_PROXY_IN_VPN = "requireProxyInVPN"
 
     const val CONNECTION_TEST_URL = "connectionTestURL"
 

app/src/main/java/io/nekohasekai/sagernet/bg/VpnService.kt

@@ -188,7 +188,7 @@ class VpnService : BaseVpnService(),
             }
         }
 
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q && DataStore.appendHttpProxy) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q && DataStore.appendHttpProxy && DataStore.requireProxyInVPN) {
             builder.setHttpProxy(ProxyInfo.buildDirectProxy(LOCALHOST, DataStore.mixedPort))
         }
 

app/src/main/java/io/nekohasekai/sagernet/database/DataStore.kt

@@ -155,6 +155,7 @@ object DataStore : OnPreferenceDataStoreChangeListener {
     val persistAcrossReboot by configurationStore.boolean(Key.PERSIST_ACROSS_REBOOT) { false }
 
     var appendHttpProxy by configurationStore.boolean(Key.APPEND_HTTP_PROXY)
+    var requireProxyInVPN by configurationStore.boolean(Key.REQUIRE_PROXY_IN_VPN)
     var connectionTestURL by configurationStore.string(Key.CONNECTION_TEST_URL) { CONNECTION_TEST_URL }
     var connectionTestConcurrent by configurationStore.int("connectionTestConcurrent") { 5 }
     var alwaysShowAddress by configurationStore.boolean(Key.ALWAYS_SHOW_ADDRESS)

app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt

@@ -224,15 +224,17 @@ fun buildConfig(
                     }
                 }
             })
-            inbounds.add(Inbound_MixedOptions().apply {
-                type = "mixed"
-                tag = TAG_MIXED
-                listen = bind
-                listen_port = DataStore.mixedPort
-                domain_strategy = genDomainStrategy(DataStore.resolveDestination)
-                sniff = needSniff
-                sniff_override_destination = needSniffOverride
-            })
+            if (!isVPN || DataStore.requireProxyInVPN) {
+                inbounds.add(Inbound_MixedOptions().apply {
+                    type = "mixed"
+                    tag = TAG_MIXED
+                    listen = bind
+                    listen_port = DataStore.mixedPort
+                    domain_strategy = genDomainStrategy(DataStore.resolveDestination)
+                    sniff = needSniff
+                    sniff_override_destination = needSniffOverride
+                })
+            }
         }
 
         outbounds = mutableListOf()

app/src/main/java/io/nekohasekai/sagernet/ui/SettingsPreferenceFragment.kt

@@ -61,6 +61,7 @@ class SettingsPreferenceFragment : PreferenceFragmentCompat() {
             Theme.applyNightTheme()
             true
         }
+        val requireProxyInVPN = findPreference<SwitchPreference>(Key.REQUIRE_PROXY_IN_VPN)!!
         val mixedPort = findPreference<EditTextPreference>(Key.MIXED_PORT)!!
         val serviceMode = findPreference<Preference>(Key.SERVICE_MODE)!!
         val allowAccess = findPreference<Preference>(Key.ALLOW_ACCESS)!!
@@ -148,6 +149,7 @@ class SettingsPreferenceFragment : PreferenceFragmentCompat() {
             true
         }
 
+        requireProxyInVPN.onPreferenceChangeListener = reloadListener
         mixedPort.onPreferenceChangeListener = reloadListener
         appendHttpProxy.onPreferenceChangeListener = reloadListener
         showDirectSpeed.onPreferenceChangeListener = reloadListener

app/src/main/res/values-ru/strings.xml

@@ -39,6 +39,8 @@
 <string name="app_name_long">NekoBox для Android</string>
 <string name="app_tls_version">Минимальная версия TLS протокола</string>
 <string name="app_version">Версия</string>
+<string name="require_proxy_in_vpn">Локальный прокси в режиме VPN</string>
+<string name="require_proxy_in_vpn_sum">Открывает локальный SOCKS/HTTP прокси-порт наряду с TUN-интерфейсом. Отключено по умолчанию для предотвращения обнаружения VPN через открытые порты.</string>
 <string name="append_http_proxy">Добавить HTTP-прокси к VPN</string>
 <string name="append_http_proxy_sum">HTTP-прокси будет использоваться напрямую из (браузера / некоторых поддерживаемых приложений), без использования виртуального сетевого интерфейса (Android 10+)</string>
 <string name="apply">Применить</string>

app/src/main/res/values/strings.xml

@@ -335,6 +335,8 @@
     <string name="connection_test_refused">Connection refused</string>
     <string name="connection_test_unreachable">Unreachable</string>
     <string name="connection_test_timeout">Timeout</string>
+    <string name="require_proxy_in_vpn">Enable local proxy in VPN mode</string>
+    <string name="require_proxy_in_vpn_sum">Opens a local SOCKS/HTTP proxy port alongside the TUN interface. Disabled by default to prevent VPN detection via open ports.</string>
     <string name="append_http_proxy">Append HTTP Proxy to VPN</string>
     <string name="append_http_proxy_sum">HTTP proxy will be used directly from (browser/ some
         supported apps), without going through the virtual NIC device (Android 10+)</string>

app/src/main/res/xml/global_preferences.xml

@@ -189,6 +189,11 @@
     </PreferenceCategory>
 
     <PreferenceCategory app:title="@string/inbound_settings">
+        <SwitchPreference
+            app:defaultValue="false"
+            app:key="requireProxyInVPN"
+            app:summary="@string/require_proxy_in_vpn_sum"
+            app:title="@string/require_proxy_in_vpn" />
         <EditTextPreference
             app:icon="@drawable/ic_maps_directions_boat"
             app:key="mixedPort"