Routers
Keenetic / Netcraze
Keenetic Keenetic Jun 9, 2026
Posted Tue, Jun 9, 2026 6:41 AM
Edited Tue, Jun 9, 2026 7:35 AM

How to setup Stealth Proxies on Keenetic (XKeen)

This guide was created by a community member and reviewed by us. Firmware and router interfaces may change over time, so some steps may differ depending on your device or version.

Introduction

XKeen is a set of utilities for Keenetic (which is labeled NetCraze in some locations) routers to setup a proxy connection using Shadowsocks, VMess, VLESS, Trojan protocols. It uses XRAY or Mihomo cores to establish connection. It was developed by Russian community to circumvent censorship, but it is suitable to use in any region with internet restrictions.

XKeen is a powerful tool to circumvent internet censorship, but it is a little hard to configure by hand. We would cover setting up XKeen user interface (XKeen-UI) to configure it using Mihomo core. XKeen-UI provides an editor interface and an ability to configure running core.

XKeen can be installed using OPKG software manager and is distributed using the software repository called Entware. In this guide, we will walk you through the steps of installing the repository and configuring XKeen.

Prerequisites

  1. Keenetic routers that can connect a USB drive are only supported to install additional packages using Entware
  2. You must have an additional USB drive to connect to your Keenetic router. This drive will be constantly used to power XKeen so it has to stay connected to the router.
  3. You must install Keenetic OS system components to support ext4 file system, format your drive and insert it into your router. Please refer to Keenetic User Manuals for your router model at support.keenetic.com on how to install system components and format the drive. User Manual on how to install system components and ext4 filesystem support are generally available under the "KeeneticOS components installation/removal" and "Using the ext4 file system on USB drives" title accordingly. We will provide a few links for some modern router models:
    • Keenetic Skipper (KN-1912): Using the ext4 file system on USB drives, System components installation
    • Keenetic Hero (KN-1012): Using the ext4 file system on USB drives, System components installation
    • Keenetic Hopper SE (KN-3812): Using the ext4 file system on USB drives, System components installation
    • Keenetic Titan (KN-1812): Using the ext4 file system on USB drives, System components installation

After the drive formatting insert it into the USB port of your router.

  1. You must also install the following list of system components:

    • SMB file and printer sharing
    • Open Package support
    • DNS-over-TLS proxy
    • DNS-over-HTTPS proxy
    • Kernel modules for NetFilter

  2. You must have registered devices you want to proxy in your network. By default, any device appearing in the Home Segment is registered. Use the Keenetic User Manual "Connected devices registration" for the instructions.

  3. We will connect to a router using command line interface. To connect, you must have a terminal program. You can download PuTTY terminal for Windows OS for this purpose. Navigate to putty.exe in the "Alternative binary files" section. On macOS, you can use the built-in Terminal application and connect using CLI.

1. Installing Entware

  1. Download appropriate software repository installer for processor architecture of your router. Here's the list of architectures of known models:
    For Keenetic/NetCraze: 4G (KN-1212), Omni (KN-1410), Extra (KN-1710/1711/1713), Giga (KN-1010/1011), Ultra (KN-1810), Viva (KN-1910/1912/1913), Giant (KN-2610), Hero 4G (KN-2310/2311), Hopper (KN-3810), use mipsel installer archive — EN_mipsel-installer.tar.gz

    For Keenetic/Netcraze: Ultra SE (KN-2510), Giga SE (KN-2410), DSL (KN-2010), Skipper DSL (KN-2112), Duo (KN-2110), Ultra SE (KN-2510), Hopper DSL (KN-3610) use mips installer archive — EN_mips-installer.tar.gz

    For Keenetic/Netcraze: Peak (KN-2710), Ultra (KN-1811), Ultra (NC-1812), Giga (KN-1012), Hopper (KN-3811) и Hopper SE (KN-3812) aarch64 — EN_aarch64-installer.tar.gz

    If you couldn't find your router model in the lists above then refer to Keenetic User Manual named "Installing the Entware repository on a USB drive" for your router model at support.keenetic.com

    For this guide we had mipsel router architecture so we will download it.

  2. Refer to an Applications page (Management → Applications) in the web management interface of your router.

  3. Switch the SMB Server to enable it

  4. Click on the SMB Server title to open configuration

  5. Check Anonymous access to enable it

  6. Add shared resource of your USB drive (it is labeled by the name you specified while formatting drive, in this guide we used OPKG label). Use "Add shared resource" button for this purpose. Press "Save".

  7. Open File Explorer in your operating system.

    1. Enter your router IP into the path bar in the following format: \\192.168.1.1 (remember to change to your router IP address).
    2. Enter your USB drive folder.
    3. Create install folder. Enter this folder.
    4. Move installer you downloaded on the first step into this folder.

  8. Navigate to OPKG page. Select your drive. Press "Save".

    After you press "Save" button it will take some time for OS to start the installation, web interface may become unresponsive for a while. After web interface made available, you may go to the Diagnostics page and press "Show log" button to see Entware installation progress. Installation completes with printing username and password and "'Entware' installed" into this log. Username is root and password is keenetic by default.

  9. Now open terminal program (PuTTY or whatever you would use in your system) and connect to the router:

  1. Enter your router IP address into the address field

Note: if the SSH Server system component is installed in the router you should specify 222 port in the connection settings (otherwise leave it empty or with default value)

  1. Enter root for the username and keenetic password.

Note: password is not shown while you are typing it by default in SSH connections. It's okay not to see any symbols you type.

  1. The program you use will prompt you to save a connection key to ensure connection security next time. Choose "Yes".
  1. Change user password using passwd command. You will be prompted for the password and its confirmation. You will use this password next time you connect to the router

Entware is now ready to install XKeen.

2. XKeen installation

  1. This command will upgrade packages to the latest versions, install curl, tar packages and XKeen. Copy and paste it into the terminal

    opkg update && opkg upgrade && opkg install curl tar && cd /tmp
sh -c "$(curl -sSL https://raw.githubusercontent.com/jameszeroX/XKeen/main/install.sh)"

Note: to paste text in PuTTY you may press Shift+Insert.

  1. After you enter these commands, you will be prompted to choose XKeen options to download. Since it was developed by the Russian community, it doesn't provide any other language during installation. At the first step, we will go with Mihomo (option 2) core to establish connections and with the stable version. Mostly, it is fine to go with the first (1) option.

    Installation options are explained in the video

  2. After XKeen installation succeeds you have to setup new policy.

    1. Navigate to the Connection Policies menu

    2. Click "+ Add policy" button

    3. Enter policy name "XKeen"

    4. Press "Save" button

    5. Check Ethernet ISP

    6. Press "Save" button

    7. Click on devices you want to be proxied, choose "XKeen" in the "Move to" dropmenu and press "Confirm".

      Devices you chose would be proxied.

  3. To make XKeen work you have to change web panel SSL port.

    1. Navigate to the router CLI: click the gear icon and then click "Command line" link.
    2. Now we will change the port. Enter ip http ssl port <port>. Replace <port> with one of the following ports: 8083, 8443, 5083, 5443, 65083. Press "Send query". The message should contain SSL Port changed to <port>.
    3. Now we will save router configuration. Enter system configuration save command. The message should show saving (http/rci)

Note: the router panel using the name of the router (if you set one) would be accessible using this port (https://mykeen.keenetic.link:<port> for e.g.)

  1. To prevent ISP hijacking of DNS queries, configure DNS over HTTPS. Go to the Internet Safety tab in Web Management interface. Open DNS configuration pane. Press Add server. Choose DNS server type "DNS-over-HTTPS" and enter address in the "DNS server address" bar. You are free to choose servers on your own, but we would provide a starting list for you to use:

    1. Quad9: https://dns.quad9.net/dns-query
    2. Cloudflare DNS: https://cloudflare-dns.com/dns-query
    3. Cloudflare Alternate: https://one.one.one.one/dns-query
    4. Cisco Umbrella DoH: https://doh.opendns.com/dns-query

  2. It is recommended to disable "Transit requests" for a System DNS profile. It would not let network clients to make direct DNS requests which are the subject to hijack. Press Edit (✏️ Pencil icon) in the right of the System profile. Uncheck "Transit requests". Press "Save".

    It is recommended to keep the DNSv4 provider enabled (it is the default option)

XKeen-UI installation

  1. Copy and paste the following command in the terminal and press Enter. This would setup XKeen-UI.

    You will be prompted whether to install, delete, update or reinstall the UI. You should choose to install the UI (first option).

    curl https://raw.githubusercontent.com/zxc-rv/XKeenUI/main/setup.sh | sh

  2. After the installation the UI is ready to use. It is served under 1000 port of your router by default, so the address to connect would be http://192.168.1.1:1000 (remember to change to your router IP address). Open this address in your browser.

  3. It is recommended to enable selective ports proxying under the "port_proxying" tab.

    We would use ports 80 and 443 for this guide, but for different applications, it might be necessary to add specific app ports.

  4. XKeen-UI provides configuration templates to configure core used by XKeen. Press "··· Утилиты" (Utilities) button and then "📄 Шаблоны конфигураций" (Configuration Templates). This menu provides templates for the configuration, in this example we would use "Config (все в прокси, кроме RU)" ("Config (everything proxied, except RU)"). Press "Импортировать" (Import) button. Configuration is now imported from the template and should appear in the editor.

  5. Now we will enter the Xeovo Stealth Proxy configuration address. Press "··· Утилиты" (Utilities) and then "🔗 Добавить прокси" (Add proxy). Enter the Xeovo Stealth Proxy link for Clash Meta (it is available for Android devices). Press "Сгенерировать" (Generate). You will now be able to add this to the template; press "+ В начало" (To the beginning) or "+ В конец" (To the end) to append the link.

  6. At this step XKeen is ready to use and will configure the core (Mihomo) to import configurations provided by the Xeovo Stealth Proxy link. It provides a big list of connections so it would take some time for core to check their availability and you wouldn't be able to access internet before this process ends. It is recommended to add some configuration filtering using the following techniques:

    1. Some connection protocols may be filtered in your location (you can check this at status.xeovo.com) and this is okay to exclude such protocols. To exclude connection protocols insert following rule exclude-type: "<connection types>". <connection types> should be the list of protocols delimited by |, for e.g. exclude-type: "ss|hysteria2|vless". Use the following list to filter protocols:

      • ss for Shadowsocks
      • vmess for VMess
      • vless for VLESS
      • trojan for Trojan
      • hysteria2 for Hysteria (Xeovo actually provides Hysteria2 under the Hysteria name)

    2. Choose the closest location for you at status.xeovo.com and insert filter rule filter: xeovo <short location name> (unfold the location in the status page to see its short name). For e.g. for Finland it would be filter: xeovo fi.

  7. After the configuration is complete press "💾 Сохранить" (Save) button. It will save the core configuration.

  8. Press start button (▶️ icon in the upper left side). It will start the core.

  9. Navigate to "Селекторы" (Selectors) page.

    After the configurations will be checked for an availability you will be able to browse internet. Available configurations would appear under the ⭕ PROXY title.

Troubleshooting: In case of lost internet connection try to press lightning ⚡ button and choose one of the available configuration (fastest, for example)

Note: Selectors page provides an ability to choose a proxy for different groups. The imported template in this guide provides groups for Discord, Steam, Twitch and other types of services. We can choose whether to directly connect to this service (DIRECT) through the fastest proxy (Fastest), use some group (PROXY group is provided), use some specific configuration (the list of configuration is provided). The first option in each group is the default option (except the PROXY group). Feel free to experiment with the settings after you finish this guide.

  1. Open DoesMyVPN.work in your browser to check your connection.
0 ⁨0⁩ ⁨comments⁩
Comment You don't have permission to do this. Controls