diff --git a/mobile/src/main/java/be/mygod/vpnhotspot/App.kt b/mobile/src/main/java/be/mygod/vpnhotspot/App.kt
index 526a9a41..613f8c77 100644
--- a/mobile/src/main/java/be/mygod/vpnhotspot/App.kt
+++ b/mobile/src/main/java/be/mygod/vpnhotspot/App.kt
@@ -19,6 +19,7 @@ class App : Application() {
     companion object {
         const val KEY_OPERATING_CHANNEL = "service.repeater.oc"
         private const val KEY_DNS = "service.dns"
+        private const val KEY_MASQUERADE = "service.masquerade"
 
         @SuppressLint("StaticFieldLeak")
         lateinit var app: App
@@ -33,6 +34,7 @@ class App : Application() {
         } else deviceContext = this
         // workaround for support lib PreferenceDataStore bug
         dns = dns
+        masquerade = masquerade
         ServiceNotification.updateNotificationChannels()
     }
 
@@ -54,6 +56,9 @@ class App : Application() {
     var dns: String
         get() = pref.getString(KEY_DNS, "8.8.8.8")
         set(value) = pref.edit().putString(KEY_DNS, value).apply()
+    var masquerade: Boolean
+        get() = pref.getBoolean(KEY_MASQUERADE, true)
+        set(value) = pref.edit().putBoolean(KEY_MASQUERADE, value).apply()
 
     val cleanRoutings = Event0()
 
diff --git a/mobile/src/main/java/be/mygod/vpnhotspot/LocalOnlyInterfaceManager.kt b/mobile/src/main/java/be/mygod/vpnhotspot/LocalOnlyInterfaceManager.kt
index b53e45f8..83b9f04b 100644
--- a/mobile/src/main/java/be/mygod/vpnhotspot/LocalOnlyInterfaceManager.kt
+++ b/mobile/src/main/java/be/mygod/vpnhotspot/LocalOnlyInterfaceManager.kt
@@ -45,9 +45,10 @@ class LocalOnlyInterfaceManager(val downstream: String) : UpstreamMonitor.Callba
             this.dns = dns
             val strict = app.pref.getBoolean("service.repeater.strict", false)
             if (strict && upstream == null) return  // in this case, nothing to be done
-            if (routing.ipForward()                 // local only interfaces may not enable ip_forward
-                            .rule().forward(strict).masquerade(strict).dnsRedirect(dns).start()) return
-            app.toast(R.string.noisy_su_failure)
+            routing.ipForward()                     // local only interfaces need not enable ip_forward
+                    .rule().forward(strict)
+            if (app.masquerade) routing.masquerade(strict)
+            if (!routing.dnsRedirect(dns).start()) app.toast(R.string.noisy_su_failure)
         } catch (e: SocketException) {
             Toast.makeText(app, e.message, Toast.LENGTH_SHORT).show()
             Crashlytics.logException(e)
diff --git a/mobile/src/main/java/be/mygod/vpnhotspot/RepeaterService.kt b/mobile/src/main/java/be/mygod/vpnhotspot/RepeaterService.kt
index acfc55e1..3dff880d 100644
--- a/mobile/src/main/java/be/mygod/vpnhotspot/RepeaterService.kt
+++ b/mobile/src/main/java/be/mygod/vpnhotspot/RepeaterService.kt
@@ -23,7 +23,6 @@ import be.mygod.vpnhotspot.net.wifi.WifiP2pManagerHelper.startWps
 import be.mygod.vpnhotspot.util.*
 import com.crashlytics.android.Crashlytics
 import java.lang.reflect.InvocationTargetException
-import java.net.InetAddress
 
 class RepeaterService : Service(), WifiP2pManager.ChannelListener, SharedPreferences.OnSharedPreferenceChangeListener {
     companion object {
diff --git a/mobile/src/main/java/be/mygod/vpnhotspot/TetheringService.kt b/mobile/src/main/java/be/mygod/vpnhotspot/TetheringService.kt
index fc943d15..ee8cdcb5 100644
--- a/mobile/src/main/java/be/mygod/vpnhotspot/TetheringService.kt
+++ b/mobile/src/main/java/be/mygod/vpnhotspot/TetheringService.kt
@@ -51,7 +51,9 @@ class TetheringService : IpNeighbourMonitoringService(), UpstreamMonitor.Callbac
                         if (value?.stop() == false) failed = true
                         // system tethering already has working forwarding rules
                         // so it doesn't make sense to add additional forwarding rules
-                        val routing = Routing(upstream, downstream).rule().forward().masquerade().dnsRedirect(dns)
+                        val routing = Routing(upstream, downstream).rule().forward()
+                        if (app.masquerade) routing.masquerade()
+                        routing.dnsRedirect(dns)
                         if (app.pref.getBoolean("service.disableIpv6", false)) routing.disableIpv6()
                         routings[downstream] = routing
                         if (!routing.start()) failed = true
diff --git a/mobile/src/main/res/drawable/ic_social_people.xml b/mobile/src/main/res/drawable/ic_social_people.xml
new file mode 100644
index 00000000..25056626
--- /dev/null
+++ b/mobile/src/main/res/drawable/ic_social_people.xml
@@ -0,0 +1,6 @@
+<vector android:autoMirrored="true" android:height="24dp"
+    android:viewportHeight="24.0" android:viewportWidth="24.0"
+    android:width="24dp" xmlns:android="http://schemas.android.com/apk/res/android"
+    android:tint="?attr/colorControlNormal">
+    <path android:fillColor="#FF000000" android:pathData="M16,11c1.66,0 2.99,-1.34 2.99,-3S17.66,5 16,5c-1.66,0 -3,1.34 -3,3s1.34,3 3,3zM8,11c1.66,0 2.99,-1.34 2.99,-3S9.66,5 8,5C6.34,5 5,6.34 5,8s1.34,3 3,3zM8,13c-2.33,0 -7,1.17 -7,3.5L1,19h14v-2.5c0,-2.33 -4.67,-3.5 -7,-3.5zM16,13c-0.29,0 -0.62,0.02 -0.97,0.05 1.16,0.84 1.97,1.97 1.97,3.45L17,19h6v-2.5c0,-2.33 -4.67,-3.5 -7,-3.5z"/>
+</vector>
diff --git a/mobile/src/main/res/values-zh-rCN/strings.xml b/mobile/src/main/res/values-zh-rCN/strings.xml
index a39e4e5a..5bb9d3bc 100644
--- a/mobile/src/main/res/values-zh-rCN/strings.xml
+++ b/mobile/src/main/res/values-zh-rCN/strings.xml
@@ -57,6 +57,8 @@
     <string name="connected_state_failed">%s (已断开)</string>
 
     <string name="settings_service">服务</string>
+    <string name="settings_service_masquerade">IP 掩蔽</string>
+    <string name="settings_service_masquerade_summary">建议使用广告拦截器与 socksfier 等虚拟 VPN 应用时禁用此选项。</string>
     <string name="settings_service_repeater_oc">Wi\u2011Fi 运行频段 (不稳定)</string>
     <string name="settings_service_repeater_oc_summary">"自动 (1\u201114 = 2.4GHz, 15\u2011165 = 5GHz)"</string>
     <string name="settings_service_repeater_strict">严格模式</string>
diff --git a/mobile/src/main/res/values/strings.xml b/mobile/src/main/res/values/strings.xml
index b70a370a..da9eb218 100644
--- a/mobile/src/main/res/values/strings.xml
+++ b/mobile/src/main/res/values/strings.xml
@@ -60,6 +60,9 @@
     <string name="connected_state_failed">%s (lost)</string>
 
     <string name="settings_service">Service</string>
+    <string name="settings_service_masquerade">IP Masquerade</string>
+    <string name="settings_service_masquerade_summary">Recommended to disable this option for dummy VPNs like
+        ad-blockers and socksifiers.</string>
     <string name="settings_service_repeater_oc">Operating Wi\u2011Fi channel (unstable)</string>
     <string name="settings_service_repeater_oc_summary">Auto (1\u201114 = 2.4GHz, 15\u2011165 = 5GHz)</string>
     <string name="settings_service_repeater_strict">Strict mode</string>
diff --git a/mobile/src/main/res/xml/pref_settings.xml b/mobile/src/main/res/xml/pref_settings.xml
index b89703bf..034bef5b 100644
--- a/mobile/src/main/res/xml/pref_settings.xml
+++ b/mobile/src/main/res/xml/pref_settings.xml
@@ -6,6 +6,12 @@
             android:key="service.clean"
             android:icon="@drawable/ic_action_settings_backup_restore"
             android:title="@string/settings_service_clean"/>
+        <SwitchPreference
+            android:key="service.masquerade"
+            android:icon="@drawable/ic_social_people"
+            android:title="@string/settings_service_masquerade"
+            android:summary="@string/settings_service_masquerade_summary"
+            android:defaultValue="true"/>
         <SwitchPreference
             android:key="service.repeater.strict"
             android:icon="@drawable/ic_action_pan_tool"