# XKeen 2.0 forks a Keenetic router proxy toolkit and rewrites its component handling > XKeen is a community instruction set and installer for putting Xray or Mihomo on a Keenetic router, and the 2.0 fork adds KeeneticOS 5 support, DNS proxying, IPSET handling and a rewritten download path. It fits an operator with a Keenetic device who wants transparent proxying on the router itself, and it does not fit you if you need a licensed, audited package or a router that is not a Keenetic. **Corvus-Malus/XKeen** — Инструкция от сообщества | Рекомендуемая для быстрой настройки - Repository: https://github.com/Corvus-Malus/XKeen - Website: https://t.me/+SZWOjSlvYpdlNmMy - Stars: 1,372 · Forks: 96 - Language: Unknown - License: not declared - Published: 2026-10-16 · Updated: 2026-10-16 · Language: en - Canonical page: https://hysenlabs.com/projects/corvus-malus-xkeen ## The repository is a fork announcement, and the code lives with the upstream project The XKeen project is delivered as a community instruction set rather than as a conventional software package. The repository description is in Russian and reads as an instruction from the community, recommended for quick setup. The homepage is a Telegram channel rather than a documentation site, and the only file in the repository is README.md. There is no LICENSE file listed, no source tree and no release script in the entries the repository exposes. The README states that XKeen has been updated to version 2.0 on 06 June 2026, and that this is a fork from the JamesZero XKeen project. Everything in the file is a changelog against that original: what the fork adds, what it changes, and the wiki pages of the upstream project that hold the configuration details. That structure tells you what kind of artifact you are adopting. This is a written procedure with a script behind it, distributed by community channels, not a released library with a changelog, a test suite and a published package. The single release listed for the repository is a Configs entry dated 2024-09-15, and the last push was on 2026-06-11. The absence of a licence file is the practical constraint: the permissions for reuse are not stated in the repository itself. ## KeeneticOS 5 and a choice of proxy core are the two headline changes The added list opens with compatibility with KeeneticOS 5+ firmware, which is the prerequisite for everything else. The second item is support for the Mihomo core and the ability to switch the proxying core, Xray or Mihomo, with the launch parameters -xray and -mihomo. The same pattern repeats throughout the changelog with parameters for every capability, so the script is driven almost entirely by command line flags. The core flags the fork documents are worth listing as a set, because they are the actual interface. -xray and -mihomo select the core. -dns enables DNS proxying. -pr proxies Entware traffic. -ipv6 toggles the IPv6 protocol in KeeneticOS. -gips and -dgips work with IPSET and let you exclude Russian IP subnets from proxying. -channel selects the update channel between the Stable and Dev branches. -xtest and -mtest check the Xray and Mihomo configurations for errors, which is the one flag here that reads like a dry run. The remaining flags cover lifecycle operations. -i is the install path, -io is an offline install, -cbr disables backing up XKeen during an update, -remove performs a full uninstall of XKeen rather than a component-by-component removal, and -toff disables the download timeout for slow GitHub connections. A usage example given in the text is xkeen -i -toff. -um updates or installs the Mihomo core and supports both upgrading and downgrading, with -rrm refreshing the Mihomo registration, -drm removing it and -dm uninstalling the core. For Xray there is -ux for the core update, also supporting version changes, and -g for reinstalling or removing the geofiles. The geofile jobs have their own set: -ug updates geofiles, -ugc manages the cron job that updates them, -dgc deletes it, and -di sets the router startup delay before the proxy client launches. ## Ports and addresses moved out of the script into list files One change in the fork addresses a limit that would have bitten anyone running a busy router. The technical restriction that allowed no more than 15 proxying ports and no more than 15 excluded ports has been removed, and the logic for adding and removing proxying and excluded ports has been reworked. Ports are now handled entirely through external files, ip_exclude.lst, port_proxying.lst and port_exclude.lst, which live in the /opt/etc/xkeen/ directory and are used to specify IPs and ports for proxying or for exclusion from proxying. That is a meaningful operational shift. Before, the port set was passed as arguments to the script; now it is data in files that a user can edit, and that a script can rewrite. The fork also reworked the logic for applying iptables and ip6tables rules, because the previous behaviour applied all rules even when the IPv6 component was not installed. Two behavioural fixes are worth calling out because they were user-visible failures. The autostart of XKeen at router startup was broken in some cases, and in others XKeen started for the whole device rather than only for its own policy. And the joint operation of TProxy mode and socks5 was broken, because XKeen ran in Mixed mode, which made transparent proxying non-functional. The Mixed mode has been renamed to Hybrid, and the script now reports the operating mode on start or restart: TProxy, Hybrid, Redirect or Other. On Keenetic Skipper 4G and Keenetic 4G models, the fork states that after installation you no longer need to replace the proxy client binary, since a compatible one is installed straight away. ## Downloads assume GitHub is reachable, which is why the offline path exists The download logic was rewritten to reduce the chance of XKeen, Xray, Mihomo or the geofiles arriving corrupted, and the fork adds a fallback release source for XKeen, Xray and Mihomo when the GitHub API is unavailable. There is also a self-hosted proxy option for loading components through your own proxy when GitHub cannot be reached, configured with the gh_proxy parameter in the xkeen.json configuration file. Retries are configurable too. The parameters retries_download and retry_delay_download in xkeen.json set the number of attempts and the pause between them. The documentation states this applies to downloading XKeen, Xray, Mihomo, Yq, the GeoSite, GeoIP and GeoIPSET data, and to fetching the release lists through the GitHub API or jsDelivr. The -toff flag disables the download timeout entirely for slow GitHub connections. The offline install, the -io parameter, exists because of all of this. The practical judgement for an operator is that a router in a region with a poor link to GitHub needs either the offline path or a configured gh_proxy before the install will complete reliably. The Yq YAML parser and Mihomo are installed and registered in entware as full ipk packages, so component presence on the device is handled by the router's own package manager. ## Geofiles, QoS marks and the split between Xray and Mihomo The fork splits the geofile story across two projects, zkeen.dat and zkeenip.dat, and adds a way to schedule their update. The -ug parameter updates the geofiles, -ugc manages the cron job that updates them, and -dgc deletes that job. The README states that the zkeen.dat and zkeenip.dat updates are scheduled by XKeen itself, and that installing the GeoIP database zkeenip.dat is now an option during install. It also notes that the outdated GeoSite and GeoIP antifilter-community data have been replaced with the Re:filter lists, and that the separate scheduler tasks for GeoSite and GeoIP have been merged, which is why the parameters -ugs, -ugi, -ugsc, -ugic, -dgsc and -dgic were removed. DSCP QoS marks get explicit support, with 62 meaning exclusion from proxying and 63 meaning proxying. This is the mechanism for marking traffic at the source, and it is a better fit than IP lists when the devices on the network are known but their addresses are not. A configuration difference also has to be respected: on Keenetic Skipper 4G and Keenetic 4G the client binary no longer has to be swapped after installation, and the launch script S24xray has been renamed to S05xkeen for compatibility with the IPSET component. Configuration backup and restore for Mihomo are handled by -mb and -mbr, and -fd controls the open file descriptor limit, with -extmsg enabling extended output when the proxy client starts. ## What this is not, and the boundary a careful operator has to hold The honest limits are visible in the repository itself. There is no licence file, so the terms for reuse, modification and redistribution are not stated by the project, and anyone intending to build on it needs to resolve that before distributing anything. There is also no packaged release with a signature, no test suite and no CI visible, and the update path reaches out to GitHub, jsDelivr and a fallback release source, which means a supply-chain decision is being made by the operator rather than by the project. It is also Keenetic-specific by construction. The installation, the autostart integration, the entware registration, the KeeneticOS 5 compatibility work and the Skipper 4G handling are all tied to that platform. The same procedure on another router or on a Linux box is a different project, and the upstream wiki pages referenced throughout the changelog document the Keenetic configuration model. The comparison to draw is with a self-built setup. Doing it by hand means managing Xray or Mihomo binaries, the routing policy, the geofiles and the firewall rules yourself, and repeating all of it after every core update. XKeen automates that and adds the two things a hand-built setup usually lacks, which are the split routing by list files and the recovery path when a download fails midway. What it adds on top is a layer of shell scripting that you will be running as root on a device that routes your traffic, so the flags deserve to be read before they are used rather than copied from a forum post. ## Conclusion XKeen fits a person who owns a Keenetic router and wants Xray or Mihomo running on the device with split routing, and it does not fit an environment that needs a licensed, reproducible package, a support contract, or a router from another vendor. Before installing, confirm the exact launch parameters you need for your topology, since the fork distinguishes TProxy, Hybrid, Redirect and Other modes and only TProxy requires freeing port 443 on the router interface, and keep the offline install path in mind, because the download logic depends on GitHub being reachable. ## FAQ ### What is XKeen and what does the 2.0 fork add? XKeen is a community instruction set and installer for running Xray or Mihomo on a Keenetic router, and the 2.0 fork is based on the JamesZero XKeen project. The fork adds KeeneticOS 5+ compatibility, the Mihomo core with the -xray and -mihomo parameters, DNS proxying with -dns, IPSET support with -gips and -dgips, and an offline install with -io. ### Which proxy modes does XKeen support? The script reports its operating mode on start or restart as TProxy, Hybrid, Redirect or Other. The Mixed mode was renamed to Hybrid, and port 443 on the router interface now has to be freed only for TProxy mode, not for Hybrid. ### How do you change proxying ports in XKeen 2.0? Ports and addresses are handled through files rather than script arguments, with ip_exclude.lst, port_proxying.lst and port_exclude.lst in the /opt/etc/xkeen/ directory. The 2.0 fork also removed the earlier restriction that limited the number of proxying and excluded ports. ### What licence does XKeen use? The repository does not include a licence file, and the project description is a community instruction set with a Telegram channel as its homepage. The last push to the repository was on 2026-06-11 and the only listed release is a Configs entry from 2024-09-15. ## Sources - [Corvus-Malus/XKeen on GitHub](https://github.com/Corvus-Malus/XKeen) - [Issues](https://github.com/Corvus-Malus/XKeen/issues) - [Project website](https://t.me/+SZWOjSlvYpdlNmMy) - [README](https://github.com/Corvus-Malus/XKeen/blob/main/README.md) - [Releases](https://github.com/Corvus-Malus/XKeen/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/corvus-malus-xkeen