TUN

On macOS and Windows, Enhanced Mode uses a virtual network interface (TUN). The operating system routes traffic into it and Core applies your rules. On Linux use eBPF instead; type = "tun" is rejected there.

[enhanced-mode]
enable = true
type = "tun"

[enhanced-mode.tun]
stack = "system"
auto-route = true
auto-detect-interface = true

Fields

Field	Default	Notes
stack	"system"	system or lwip
auto-route	true	install routes that send traffic into the interface
auto-detect-interface	false	find the physical interface for outgoing traffic automatically
routes	automatic	list of CIDRs; when present, replaces the automatic routes (an empty list installs none)
extra-routes	[]	CIDRs added to the automatic routes
dns-hijack	[]	extra DNS destinations whose queries Core answers

Invalid CIDRs in routes or extra-routes are rejected with the field name.

Notes

• TUN needs the helper or service installed by the desktop app, or administrator rights.
• Core changes system routes and DNS while TUN is active and restores them when it stops normally. Quit the app or stop Core normally; do not force-kill it.
• Domain rules for captured traffic rely on Core's DNS answers; see DNS.