Open Advanced > VPN Tunnel > Apple system VPN. Availability follows the installed Apple OS and app edition.

Always on and on demand

Always on is off by default. Turning it on asks the system to connect on available networks. This uses Apple’s on-demand mechanism; it is not the supervised-device Always On VPN feature or a guarantee that traffic can never leave without a VPN.

With Always on off, the On-demand controls become available. On-demand is also off by default.

Wi-Fi rules have two separate lists:

• Connect VPN when connected to these Wi-Fi networks.
• Disconnect VPN when connected to these Wi-Fi networks.

Enter exact SSID names. A name cannot belong to both lists. Unlisted Wi-Fi networks keep the current connection behavior rather than implicitly joining either list.

iOS adds a separate cellular action; macOS adds an Ethernet action. Choose connect or disconnect for that network type. Save the settings to apply the policy.

Capture all traffic

Off by default. Turning it on reveals four exclusion options, each on by default where supported:

• Local networks
• Cellular services
• Apple push notifications
• Communication with connected Apple devices

These are system-level exceptions, separate from Xray routing rules. An unsuitable combination can make the network unavailable or disrupt local services. Keep the defaults unless you understand the intended change.

Networks that bypass VPN

With Capture all traffic off, open the network-list page and add IPv4/IPv6 CIDRs, such as 192.168.50.0/24. The default list is empty; private networks are not automatically added. The system routes listed networks outside VPN, before Xray rules apply.

Turning full capture back on preserves the list but disables it. Turning IPv6 off similarly retains IPv6 entries without applying them. Save changes to the effective list and reconnect an active VPN.

Excluded networks do not change DNS automatically or provide automatic enterprise split DNS. For internal names, also configure the route’s local DNS.

Hide VPN icon on iOS/iPadOS

Turn on Hide VPN icon on this page. It is off by default and appears only on iOS/iPadOS, not macOS or other platforms.

It takes effect only while Capture all traffic is off. Turning full capture on disables the icon toggle but keeps your saved preference. Do not turn off required full capture just to hide the icon. Save effective changes and confirm reconnecting an active VPN; when disconnected, the setting applies on the next connection.

The app keeps the default tunnel routes and adds 0.0.0.0/31 to the runtime route exclusions. With IPv6 enabled, it also adds ::/127; no IPv6 route is added when IPv6 is off. You do not need to enter these networks manually. They are not written back to your exclusion list and do not rewrite Xray configuration or VPN connection status. The setting applies to both ordinary configurations and Raw JSON, but cannot be set by importing Xray JSON.

This indirectly hides the icon through system routing behavior. Results can differ across iOS/iPadOS versions, and Wi-Fi/cellular switching may be affected. Check network changes and recovery after locking the device on real hardware. If problems occur, turn the option off and reconnect. Icon visibility is not proof of whether the VPN is connected.

Tunnel DNS over TLS

Apple tunnel settings provide DNS over TLS. Edit DNS addresses and the server name under VPN Tunnel; the default name is dns.google. Addresses, name, and the service’s TLS certificate must match. This platform setting does not replace Xray’s local/proxy DNS.

macOS editions and quitting

Mac App Store uses Packet Tunnel. OneXraySE uses a System Extension and does not provide the Xray file-log section.

Closing the main window hides it. Quit exits the app without stopping the system VPN; Quit and Stop VPN disconnects first. Use the latter when you want the tunnel stopped, including its on-demand behavior.