# Xray TUN mode and VPN Tunnel settings

Source: https://onexray.com/docs/advanced/vpn-tunnel/
Description: Set OneXray tunnel DNS, IPv6 and the Windows/Linux outbound interface. Understand what TUN mode does and which options depend on your platform.


TUN mode delivers IP traffic from a virtual network interface to Xray-core. The tunnel decides which traffic enters the client; [Smart Routing](https://onexray.com/docs/connect/smart-routing/) or your custom rules decide what Xray does with it. A TUN interface is not a proxy protocol and does not by itself select VLESS, VMess or a DNS resolver.

For split DNS or private domains, start with the [Xray DNS guide](https://onexray.com/docs/configuration/dns/). For a platform-specific task, use the [Tunnel decision guide](https://onexray.com/docs/tunnel-guide/).

Open Advanced > VPN Tunnel.

## Managed addresses and DNS

TUN addresses remain read-only. All three tunnel DNS fields are editable, with these defaults:

| Field | Default |
| --- | --- |
| IPv4 DNS | 8.8.8.8 |
| IPv6 DNS | 2001:4860:4860::8888 |
| DNS server name | dns.google |

IPv4/IPv6 DNS must be IP addresses of the corresponding family. The server name is only for Apple DNS over TLS, not a search domain. When DoT is enabled, the addresses and name must belong to the same service and match its TLS certificate.

These platform tunnel values do not replace the local DNS in [Smart Routing](https://onexray.com/docs/connect/smart-routing/) or [Custom Routing](https://onexray.com/docs/connect/custom-routing/), or change a Raw JSON configuration's own DNS addresses. Internal-name resolution usually requires changing the route's local DNS, not just this page.

Save to apply changes; effective settings affecting an active VPN require reconnecting. Inactive IPv6 or Apple DoT fields are retained without causing a reconnect. Restore defaults changes the draft only and still requires saving.

## IPv6

Use IPv6 has its own section below DNS. When off, Apple/Android and native-TUN configurations omit the managed IPv6 tunnel parameters, while DNS queries use UseIPv4 instead of UseIP. Windows MSIX/VCore keeps its platform-specific handling.

The switch does not add IPv6-blocking rules or strip arbitrary IPv6 addresses from Raw JSON. Do not treat it as a universal IPv6 kill switch.

## Xray outbound interface — Windows and Linux

Open the interface list and select a real network adapter. The current internet adapter is marked for reference, but OneXray does not automatically pick it. Loopback and OneXray's own TUN are excluded.

The choice is saved by name and checked before connecting. If it is missing or no longer available, choose another adapter. There is no automatic fallback or continuous interface monitoring. Raw JSON cannot override this choice.

When connected, changing it uses Save and reconnect. Windows binds Xray to the adapter; it does not add a VCore interface-binding requirement.

## Platform settings

[Apple](https://onexray.com/docs/advanced/apple/) · [Android](https://onexray.com/docs/advanced/android/) · [Windows](https://onexray.com/docs/advanced/windows/)