VeilBox is a modern Windows VPN client designed to provide fast profile import, clean routing control, and a simple daily workflow. It supports VLESS/Xray, System Proxy, TUN mode, split tunneling, subscriptions, and AmneziaWG import in one desktop app.
Key Features:
Full VLESS transport support with protocols like RAW, TCP, WS, gRPC, XHTTP, HTTPUpgrade, and mKCP.
Import profiles from VLESS URI, JSON, subscriptions, AmneziaWG, or via clipboard (Ctrl+V).
System Proxy and TUN modes for flexible connection management.
Split tunneling to route specific apps or networks through the VPN while others bypass it.
Subscription management with grouped profiles and profile ping for quick testing.
User-friendly interface with tray support, autostart, auto-reconnect, and light/dark themes.
Audience & Benefit:
Ideal for users seeking secure access to restricted content, remote workers needing reliable connectivity, or privacy-focused individuals managing multiple VPN profiles. VeilBox simplifies the workflow of importing, organizing, and connecting via VLESS or AmneziaWG profiles while offering system-level control through TUN mode.
VeilBox can be installed via winget, making it easy to integrate into your daily routine on Windows 10/11 systems.
README
VailBox
VailBox is a Windows-only MVP desktop VPN client for VLESS built with Tauri 2, React, TypeScript, and Rust. It uses xray.exe as a bundled sidecar and routes traffic through Windows System Proxy mode only.
Unsupported VLESS variants such as kcp, quic, httpupgrade, h2, or tcp+tls
Threat / Risk Notes
The app does not implement its own VPN transport. Security depends on the supplied xray.exe build and the imported profile.
System Proxy mode only affects applications that respect Windows proxy settings.
Startup proxy cleanup clears local loopback proxies that look like stale VailBox sessions. If a user intentionally uses another localhost proxy, review this behavior before shipping.
Secrets are masked in UI and log output, but profile JSON on disk still contains real credentials because Xray needs them.
Temporary Xray config is written under app-local runtime storage and deleted on normal disconnect. Crash recovery removes stale files on next launch.
Local Storage
App data is stored in the Tauri app data directory for com.vailbox.desktop.
Files created there:
profiles.json
settings.json
runtime/session.json
runtime/xray-active.json
logs/app.jsonl
logs/connection.jsonl
How Proxy Cleanup Works
On connect, the app starts Xray and waits for the local HTTP proxy port to accept connections.
Only after that it enables Windows System Proxy.
On disconnect, it disables the system proxy before stopping Xray.
On unexpected app/core termination, the next launch checks saved runtime state and clears loopback proxy settings that look like the previous VailBox session.
If autoReconnect is enabled and the previous session was active, the app can safely attempt to restore the last profile after cleanup.
Development on Windows
Prerequisites:
Node.js 20+
Rust stable toolchain with Windows MSVC target
Visual Studio Build Tools with Desktop C++ workload
The profile is invalid, the remote server is blocked, or Xray failed before readiness. Check the Logs page.
System proxy verification failed
Another application may be modifying Windows proxy settings at the same time.
The app closes instead of going to tray
Enable Minimize to tray in Settings.
Connect from tray does nothing
Select an active profile first in the Profiles page.
Known Limitations
This repository assumes a Windows environment and does not attempt cross-platform support.
System Proxy mode does not cover traffic from applications that ignore proxy settings.
The tray and proxy code target Tauri 2 APIs and should be rechecked against the exact crate versions used in your environment.
In this workspace I could not run cargo check or npm build because the Rust toolchain is not installed in the shell environment, so final API-level verification must be done locally after installing the toolchain.
Version 2 Improvements
Add TUN mode with explicit driver and privilege handling
Add subscription management and profile groups
Add connection latency tests and richer diagnostics
Add selective auto-reconnect policy and exponential backoff tuning
Add signed Xray bundle management and upgrade workflow