Use TYO Reach with any app

While the proxy is switched on, the Reach tray app listens on two local ports. Anything that can be told to use a proxy — a second browser, a terminal, a game launcher, a download manager — can be pointed at them and will exit through your selected gateway.

Proxy	Address	Use for
HTTP / HTTPS (CONNECT)	`127.0.0.1:8082`	Almost everything: browsers, curl, git, package managers
SOCKS5	`127.0.0.1:1080`	Apps that prefer SOCKS: ssh, some chat and torrent clients

Both addresses are shown in the tray menu (HTTP: 127.0.0.1:8082, SOCKS: 127.0.0.1:1080) and are the defaults; if the tray shows different numbers, use those. Neither port needs a username or password — they only accept connections from your own machine.

The rules

Only while Reach is on. When the proxy is off nothing is listening; apps configured to use it will fail to connect rather than silently going direct. Browsers that Reach manages for you are switched to direct automatically — apps you configured by hand aren't.
Counts toward your allowance. Everything you send through the ports is metered like browser traffic on personal plans. Team plans are unmetered.
Same routing rules apply. Domain rules and the exit region you picked apply to proxied apps exactly as they do to a browser — see proxy modes.
Local and LAN addresses can't go through. The gateway can't reach 192.168.x.x, 10.x.x.x or .local; leave those out of the proxy (see NO_PROXY below).

Environment variables (terminal, scripts)

Most command-line tools honour these:

export HTTP_PROXY=http://127.0.0.1:8082
export HTTPS_PROXY=http://127.0.0.1:8082
export NO_PROXY=localhost,127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.local

Or the SOCKS form, for tools that support it:

export ALL_PROXY=socks5h://127.0.0.1:1080

socks5h:// asks the proxy to resolve hostnames; if a tool only accepts socks5://, that works too. Lower-case variants (http_proxy, https_proxy, all_proxy, no_proxy) are read by many tools — set both if in doubt. Put the exports in ~/.bashrc / ~/.zshrc to make them permanent, remembering they'll break those tools whenever Reach is off.

Per-tool examples (curl, wget, git, ssh, npm, pip): Use Reach from the terminal.

Windows apps

On Windows, switching Chrome, Edge or Brave on in the tray sets the Windows system proxy (Internet Settings → Proxy) to 127.0.0.1:8082, so any app that follows the system proxy — most Microsoft apps, Electron apps, winget — is already routed. For PowerShell:

$env:HTTP_PROXY  = "http://127.0.0.1:8082"
$env:HTTPS_PROXY = "http://127.0.0.1:8082"

macOS apps

Switching Safari on in the tray sets the system-wide HTTP/HTTPS proxy on your active network services, which most Mac apps honour. Chromium browsers get their own per-profile setting instead, so you can route Chrome without routing the whole system. Terminal tools use the environment variables above.

Linux apps

Linux gets per-browser routing (a PAC file per browser) rather than a system-wide proxy by default, so other apps see nothing until you configure them. Use the environment variables above, or the app's own proxy dialog with the HTTP address.

Common questions

Can I change the ports?

They're read from Reach's config file (http_port / socks_port) at startup; there's no setting in the tray. If a port is taken Reach reports the error in its log — free the port or edit the config and restart the app.

Is the local proxy encrypted?

Traffic between your app and 127.0.0.1 never leaves your machine. From Reach to the gateway it travels inside an authenticated tunnel, and HTTPS inside it stays end-to-end encrypted — Reach never decrypts it. Plain http:// requests are readable by the gateway, as with any forward proxy. See Security.

Does this work for apps that ignore proxy settings?

No. Reach doesn't install a VPN adapter, so an app that talks to the network directly and ignores proxy configuration can't be routed on the desktop. The Android and iOS apps and the Mac App Store build use a system-level tunnel and don't have this limitation.