ZDT-D is a root module for Android designed for advanced network compatibility, DPI circumvention, DNS handling, and local proxy orchestration.
Unlike a classic Android VPN app, ZDT-D does not rely on VpnService as its primary traffic engine.
Instead, it uses a root daemon, iptables/ip6tables, UID-based routing, NFQUEUE, and local transparent redirection to selectively pass traffic into different processing pipelines.
The project includes:
- a local Rust daemon (
zdtd) - an Android application for configuration and status control
- bundled networking tools for different routing and DPI-bypass scenarios
The app is available in Russian and English.
A traditional Android VPN usually works through VpnService, creates a virtual TUN interface, and routes traffic through a single VPN pipeline.
ZDT-D uses a different model:
- works with root privileges
- applies rules through iptables / ip6tables
- routes traffic by Android app UID
- supports NFQUEUE-based packet processing
- supports transparent redirect to local services on
127.0.0.1 - can combine multiple engines for different scenarios instead of forcing one global VPN tunnel
This makes ZDT-D closer to a root-based transparent traffic manager than to a standard VPN client.
The Android application is responsible for:
- editing settings
- enabling/disabling services
- selecting apps for routing
- importing/exporting backups
- starting module update flow
- viewing service state and logs
zdtd is the central runtime component.
It:
- waits for Android boot completion
- prepares runtime environment
- backs up and restores baseline iptables state
- starts enabled services in a controlled order
- exposes a local API on loopback
- monitors service state
- can protect critical processes from sleep/termination
ZDT-D orchestrates multiple external engines instead of implementing every protocol inside one binary.
| Program | Purpose | Upstream |
|---|---|---|
zapret (nfqws) |
DPI circumvention via NFQUEUE-based packet processing | https://github.com/bol-van/zapret |
zapret2 (nfqws2 + lua) |
Extended DPI bypass engine with lua scripts | https://github.com/bol-van/zapret2 |
| byedpi | DPI circumvention utility | https://github.com/hufrea/byedpi |
| DPITunnel-cli | Desync-based DPI tool | https://github.com/nomoresat/DPITunnel-cli |
| dnscrypt-proxy | Encrypted DNS proxy | https://github.com/DNSCrypt/dnscrypt-proxy |
| opera-proxy | Opera proxy/VPN pipeline component | https://github.com/Snawoot/opera-proxy |
| sing-box | Multi-protocol proxy engine | https://github.com/SagerNet/sing-box |
| t2s | Transparent-to-socks helper used in selected modes | bundled in project |
ZDT-D supports more than one traffic handling path.
Used for packet-level processing.
Typical logic:
- selected Android packages are converted into UIDs
iptablesrules are added inmangle- matching traffic is sent to NFQUEUE
- userspace processor handles the packets
Used for local service pipelines.
Typical logic:
- selected Android app UIDs are resolved
iptablesrules are attached toOUTPUT- traffic is redirected to local listeners on
127.0.0.1:<port> - local component processes the stream
dnscrypt-proxy can be started before the rest of the pipeline so DNS resolution can be handled in a controlled way.
ZDT-D does not blindly route all device traffic.
It can work with selected applications:
- package names are collected from user settings
- package names are resolved into Linux UIDs
- iptables rules are generated using
-m owner --uid-owner - only traffic belonging to those apps is redirected or queued
This allows more selective routing than a simple “all traffic through one tunnel” design.
ZDT-D actively manages system networking rules.
Main characteristics:
- uses iptables and ip6tables
- backs up baseline rules on first launch
- restores a clean baseline before applying new runtime rules
- works primarily with
natandmangletables - applies rules idempotently to reduce duplication
- supports IPv6 on a best-effort basis depending on device capabilities
Examples of rule types used by the module:
NFQUEUErules inmangleownermatch by UIDDNATto loopback ports- custom chains for transparent redirection
ZDT-D supports sing-box in two primary modes:
- launches one or more
sing-boxprofiles - starts
t2s - redirects selected app traffic into
t2s t2sforwards into the selected socks5 pipeline
- launches the selected
sing-boxprofile - applies transparent iptables redirect directly to the configured local port
- supports TCP or TCP+UDP capture depending on profile settings
ZDT-D includes a runtime protector for important service processes.
Depending on configuration, it can:
- acquire a kernel wake lock
- adjust
oom_score_adj - work in
Off,On, orAutomode - react differently to screen-on / screen-off states
This part is intended to improve service stability during idle or power-managed device states.
- Root: Magisk / KernelSU / APatch (or compatible forks)
- Architecture: arm64-v8a only
- Android: 11+
- working shell environment with access to:
sucmdsettingsiptablesip6tables
anyhowserdeserde_jsonlogsimpleloglibcsha2hex
- Install the Android app.
- Use the app to install or update the module.
- Reboot when prompted.
- Open the app and configure the desired programs and app routing lists.
Do not manually modify release archives unless you know exactly what you are doing.
- performed through the Android app
- requires reboot after installation
- settings migration is supported
Some bundled tools can be updated manually from their official upstream releases through the app.
Examples:
- zapret → updates
nfqws - zapret2 → updates
nfqws2+luascripts
ZDT-D does not collect, transmit, sell, share, or use personal data.
All configuration, routing, rule management, and runtime control required for the module to work are performed locally on the installed device.
The project does not require remote telemetry or analytics for core functionality.
If the application connects to external resources, it does so only for actions explicitly requested by the user, such as checking releases or downloading updates from official upstream sources.
- Some antivirus products may flag DPI-related tools because they work with low-level network behavior.
- ZDT-D is intended for advanced network compatibility, routing control, and research / enthusiast use.
- Device compatibility may vary depending on ROM behavior, SELinux handling, kernel options, and root environment.
- Some features depend on working iptables/ip6tables support on the device.
- IPv6 behavior may differ across devices and firmware builds.
- Some functions may depend on the behavior of the root environment and firmware implementation.
- For additional usage notes and explanations, see
INSTRUCTIONS.md.
GPL-3.0 License — see LICENSE