Home Page » News » Tutorials » How to Set Up a Local HTTP Proxy on Android with Tinyproxy (No Root)

How to Set Up a Local HTTP Proxy on Android with Tinyproxy (No Root)

12 min read Step‑by‑step guide to install, configure and run Tinyproxy on Android using Termux, turning your phone into a local HTTP proxy without rooting. October 12, 2026 06:30

Why you might want a local HTTP proxy on Android

Developers, privacy‑conscious users, and power users often need a lightweight HTTP proxy that runs directly on their phone. A local proxy can help you:

Inspect or log outgoing HTTP requests for debugging web‑based apps.
Force all traffic through a content‑filtering tool such as AdGuard Home without leaving the device.
Test how a website behaves under a different User‑Agent by chaining Tinyproxy with a custom header injector.
Provide a simple “gateway” for other devices on the same Wi‑Fi network when you enable port forwarding.

All of this can be achieved without rooting, thanks to the Termux environment and the tiny, well‑maintained tinyproxy package.

Before you start

Prerequisites

A phone running Android 7.0 (Nougat) or newer. The steps work on most OEM skins, but menu wording may differ.
Termux installed from F‑Droid (recommended) or the Google Play Store.
An active Wi‑Fi or mobile data connection for downloading packages.
At least 100 MB of free internal storage for the Termux environment and Tinyproxy logs.
Optional but highly recommended: Termux:API and Termux:Boot add‑ons for automation.

Safety note: Tinyproxy will listen only on the loopback interface (127.0.0.1) by default, meaning no external device can reach it. Do not change the Listen address unless you understand the security implications.

Step 1 – Install and update Termux

Open Termux. The first launch will ask for storage permission; grant it by tapping Allow.
Update the package repository and upgrade existing packages:
```
pkg update && pkg upgrade -y
```
This ensures you get the latest apt metadata and avoids compatibility warnings.
Install the core utilities you will need later:
```
pkg install nano curl wget proot -y
```
nano is a simple editor; curl and wget will be used for testing.

Step 2 – Install Tinyproxy

Enable the unstable-repo (required for Tinyproxy on some architectures):
```
pkg install unstable-repo
```
Now install Tinyproxy:
```
pkg install tinyproxy -y
```
Termux will pull the pre‑compiled binary and its minimal dependencies.
Verify the installation:
```
tinyproxy -v
```
You should see a version string such as Tinyproxy/1.10.1.

Step 3 – Create a basic configuration file

Tinyproxy looks for /data/data/com.termux/files/usr/etc/tinyproxy.conf by default. Open the file with nano (it will be created if missing):
```
nano $PREFIX/etc/tinyproxy.conf
```
Paste the following minimal configuration (replace the # comments as needed):
```
# Tinyproxy minimal config for local use
User nobody
Group nogroup
Port 8888
Listen 127.0.0.1
MaxClients 100
Timeout 600
LogLevel Info
LogFile "${HOME}/tinyproxy.log"
```
Explanation of the key lines:
- Port 8888 – the port you will point your Android proxy settings to.
- Listen 127.0.0.1 – restricts access to the device itself.
- LogFile – stores request logs in your home directory for later analysis.
Save the file by pressing Ctrl+O, Enter, then exit with Ctrl+X.

Step 4 – Test the proxy manually

Start Tinyproxy in the foreground to see its output:
```
tinyproxy -c $PREFIX/etc/tinyproxy.conf
```
You should see a line like INFO: Tinyproxy 1.10.1 started on port 8888.
Open a second Termux session (swipe from the left edge or use the split‑screen feature) and run a curl request through the proxy:
```
curl -x 127.0.0.1:8888 -I https://httpbin.org/ip
```
If the proxy works, the response will include a JSON payload showing your public IP (the request still goes out to the internet, but Tinyproxy forwards it).
Check the log file for the request entry:
```
cat ~/tinyproxy.log | tail -n 5
```
You should see a line containing GET https://httpbin.org/ip.
Press Ctrl+C to stop the foreground instance.

Step 5 – Run Tinyproxy as a background service

Termux provides a simple way to daemonise a command using nohup and &:
```
nohup tinyproxy -c $PREFIX/etc/tinyproxy.conf &
```
The process will detach and continue running after you close the session.
Confirm it is running:
```
ps -A | grep tinyproxy
```
You should see a line with the PID and the command.
Optionally, keep the process alive across device sleep using termux-wake-lock:
```
termux-wake-lock && nohup tinyproxy -c $PREFIX/etc/tinyproxy.conf &
```
Remember to release the lock later with termux-wake-unlock if you stop the proxy.

Step 6 – Point Android’s system proxy to Tinyproxy

Open Settings → Network & internet (or Wi‑Fi & internet on some skins).
Tap your active Wi‑Fi network to open its details.
Scroll to Advanced → Proxy. Choose Manual.
Enter Hostname: 127.0.0.1 and Port: 8888. Leave the Bypass proxy for field empty.
Save the settings. Android will now route all HTTP and HTTPS traffic from apps that respect the system proxy through Tinyproxy.

Some apps (e.g., Chrome, Firefox) use their own proxy settings or ignore the system proxy. In those cases you can configure the proxy directly inside the app’s network preferences.

Step 7 – Verify that Android is using the proxy

Open a browser and navigate to https://httpbin.org/headers. The page will display the request headers received by the server.
In the Tinyproxy log, you should now see a line for this request. Example:
```
INFO: 127.0.0.1 - - "GET https://httpbin.org/headers"
```
If you do not see any log entries, double‑check the proxy settings and make sure the Tinyproxy process is still running (use ps -A | grep tinyproxy).

Step 8 – Advanced configuration options

8.1 Enabling CONNECT for HTTPS tunnelling

By default Tinyproxy permits the CONNECT method, which is required for HTTPS. If you disabled it in a custom config, re‑enable it:

Allow CONNECT 443

Place the line in tinyproxy.conf under the # Allow CONNECT comment.

8.2 Adding basic authentication

To prevent other apps on the device from abusing the proxy, you can require a username and password:

BasicAuth user1 password123

After adding the line, restart Tinyproxy (kill the old PID and start a new one). When the system asks for credentials, enter the pair you defined.

8.3 Restricting access to specific apps using `iptables`

If you want only a handful of apps to use the proxy, you can redirect their traffic at the kernel level. This requires the iptables binary, which is available via the termux-root package on devices that allow rootless iptables (most recent Android versions do). Example for the app with package com.example.myapp:

iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner $(pm list packages -3 | grep com.example.myapp | cut -d: -f2) --dport 80 -j REDIRECT --to-ports 8888

Because this command manipulates the network stack, it may require su on some devices. Use it only if you understand the impact.

Step 9 – Automate startup with Termux:Boot

Install the Termux:Boot add‑on from F‑Droid.
```
pkg install termux-api termux-boot -y
```

Create a script that starts Tinyproxy when the device boots:

mkdir -p $HOME/.termux/boot
cat > $HOME/.termux/boot/start-tinyproxy.sh <<'EOF'
#!/data/data/com.termux/files/usr/bin/sh
termux-wake-lock
nohup tinyproxy -c $PREFIX/etc/tinyproxy.conf &
EOF
chmod +x $HOME/.termux/boot/start-tinyproxy.sh

Reboot the device. After the boot finishes, open Termux and run ps -A | grep tinyproxy to confirm the daemon is active.
If you need to stop the service later, use:
```
pkill tinyproxy
termux-wake-unlock
```

Step 10 – Troubleshooting common issues

Port already in use: Another app (often a VPN or a built‑in proxy) may already listen on 8888. Change the Port line in tinyproxy.conf to an unused number (e.g., 8899) and update the Android proxy settings accordingly.
“Permission denied” when starting Tinyproxy: Ensure the configuration file is readable and that the LogFile path points to a location you own. Use chmod 600 $HOME/tinyproxy.log if needed.
No log entries appear: Verify that the proxy is actually being used. Some apps bypass the system proxy; try a different app or use curl as shown in Step 4.
HTTPS sites fail with “SSL handshake failed”: Make sure the Allow CONNECT directive is present and that the Port you chose is not blocked by Android’s built‑in firewall (rare on modern versions).
Proxy stops after the screen turns off: Android may kill background processes to save battery. Using termux-wake-lock (Step 5) or enabling the “Battery optimization” exception for Termux (Settings > Apps > Termux > Battery > Unrestricted) solves this.

Never expose Tinyproxy to the public internet by changing Listen 127.0.0.1 to 0.0.0.0 unless you add firewall rules and strong authentication. An open proxy can be abused for illicit traffic and may violate your carrier’s terms of service.

Step 11 – Stopping and cleaning up

Terminate the running daemon:
```
pkill tinyproxy
```
Remove the wake lock if you set one:
```
termux-wake-unlock
```
Optionally delete the configuration and log files:
```
rm $PREFIX/etc/tinyproxy.conf ~/tinyproxy.log
```
Return Android’s proxy setting to None to avoid accidental routing through a stopped service.

What you have achieved

By following this tutorial you now have a fully functional, locally‑bound HTTP/HTTPS proxy that runs entirely in user space. You can use it for:

Capturing request headers and bodies for debugging mobile web apps.
Testing how a site reacts to altered User‑Agent strings by chaining Tinyproxy with sed or iptables tricks.
Providing a simple, on‑the‑fly content filter for your own browsing without installing third‑party VPN apps.

The setup is lightweight, respects Android’s security model, and can be started or stopped with a single command. Because everything runs in Termux, you can also script more complex workflows (e.g., rotating logs, rotating proxy ports, or integrating with mitmproxy for deeper inspection).

Feel free to experiment with the configuration – Tinyproxy supports ACL files, upstream proxy chaining, and even basic caching. Just remember to keep the service confined to 127.0.0.1 unless you have a clear security plan.

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.