System Proxy vs TUN Mode: Three Ways to Route Your Traffic

There are two ways to get a device’s traffic into an encrypted tunnel. A system proxy registers a proxy address in your system settings and leaves each program to decide for itself whether to use it — browsers usually do, command-line tools and games often don’t. TUN mode creates a virtual network adapter that captures traffic from every program at the network layer, no cooperation needed. Once traffic is captured, global or split routing decides what goes through the tunnel and what connects directly.

1. ① System proxyA proxy address registered in system settings
2. ② Programs that opt inBrowsers and others follow the sign
3. ③ Programs that don'tGames and the terminal slip out the side door
4. ④ TUN modeOne gate that every packet must pass
5. ⑤ Overseas servicesSent into the encrypted tunnel by rule
6. ⑥ Local sitesGo direct by rule — no detour

System proxy: only programs that opt in

Every operating system has proxy settings: on Windows under Settings → Network & internet → Proxy, on macOS under System Settings → Network → Details → Proxies. When a VPN client turns on system proxy mode, it starts a proxy service on your machine and registers its port there.

The catch is that this is only a notice — each program decides whether to follow it:

Program	Honours the system proxy?
Browsers such as Chrome, Edge and Safari	Usually
Most desktop and mobile apps	Some do, depending on the developer
Command-line tools (git, curl, npm, pip…)	Usually not — they need environment variables
Games, some chat and video apps	Often not — they connect directly

Hence the classic “the browser works, but git clone in the terminal still times out” or “the game still can’t connect”.

TUN mode: capture everything at the network layer

TUN is a virtual network adapter provided by the operating system. It works at the network layer and handles IP packets. Once the client creates one and points the system’s default route at it:

• every packet any program sends — whether or not it reads proxy settings — is handed to the virtual adapter first;
• the client reads packets from the adapter and decides, by rule, whether each goes through the tunnel or direct;
• the programs themselves never need to know.

TUN mode captures UDP and DNS as well as TCP. To stop domain lookups escaping the tunnel (a “DNS leak”), clients usually intercept queries to port 53 and resolve them inside the tunnel.

Global vs split: what goes through the tunnel

However traffic is captured, something has to decide where it goes next:

Mode	What it does	Good for
Global	Everything goes through the tunnel	Quick troubleshooting; making the whole device exit overseas
Split (Smart)	Rules decide connection by connection: local sites direct, overseas services through the tunnel, ads can be blocked	Everyday use: local sites stay fast, overseas services stay reliable
Direct	Nothing goes through the tunnel	Pausing without disconnecting

Rules can match by domain, IP range, country and more — see Custom routing rules for rule types, order and syntax.

Sequence diagram: the two approaches step by step

Step	What happens
①–②	In system proxy mode, the program reads the system’s proxy settings and gets the port of the local proxy (the client)
③	The program hands its request to the client
④–⑤	The client encrypts it to the server, which visits the site
⑥	Programs that ignore proxy settings (command-line tools, games) connect straight to the site, bypassing the proxy entirely — the gap in system proxy mode
⑦	In TUN mode, the program sends packets as usual, with no settings at all
⑧	The system checks its routing table, sees the default route points at the virtual adapter, and hands the packet over; the client reads it from there
⑨	The client applies the routing rules to decide where the packet goes
⑩	Overseas services: encrypted and sent to the server
⑪	Local sites: sent directly out of the real network card, no detour

Why you approve a network configuration the first time

A virtual adapter reroutes the whole device, so every operating system requires your explicit consent and tightly limits what it can do:

Platform	System mechanism	What you see on first connect
iPhone / iPad	Network Extension (packet tunnel)	“Would Like to Add VPN Configurations”, confirmed with your passcode or Face ID
Mac	System extension + Network Extension	Allow the system extension, then allow the VPN configuration
Android	VpnService	A “Connection request” dialog
Windows	TUN adapter driver	A User Account Control (administrator) prompt

Pangolin uses TUN on all four platforms with Smart routing on by default, so command-line tools, games and every other app are covered without extra setup. Each platform’s approval steps are in its install guide, e.g. Install on iPhone / iPad and Install on Mac.

Related reading

• Previous: What does HTTPS actually encrypt?
• Next: Split tunneling explained
• VPN vs proxy: what’s the difference?
• Custom routing rules