The switch snaps back, the VPN icon stays off
Tunnel and system permission. Tunnel, System. Not rules yet.
Manual
Read by objects on screen, not by “step N.”
This app holds a switch, policy, records, containers, configurations, rewrite, DNS, and two counters at the same time. They are independent. Treat two of them as one import and every later isolation will scramble. Copy follows the version on the device. The client does not include a server. Get the app on the Store page.
Reading order
Tell the objects apart, then start the tunnel.
The order below is a suggestion, not a procedure. If you already tell them apart, enter any chapter. Every chapter is in the top bar.
- 01Tunnel · Switch, permission, Config / Proxy / Direct
- 02Objects · Records and containers
- 03Rules · The list, order, FINAL
- 04Data · How to isolate the four signals
- 05System · iOS VPN limits
- 06Config · Multiple files, import / export, iCloud
- 07Rewrite · Not the same as routing
- 08DNS · Two resolvers, IPv6
- 09Store · Nameplate, one-time purchase, restore
Home screen
The home screen does three jobs at once
It shows the currently selected server record, provides the connect switch, and chooses global policy. Other tabs at the bottom manage the rule file, counters, and options; they do not replace these three jobs. The highlighted row in the list is the exit after the switch is on. Turning the switch on with no highlight is version-dependent; do not rely on “it will connect without a selection.”
Latency on the list is probe round-trip, not bandwidth. It only says whether this hop probes right now, not whether a page can open. The full isolation is in Data.
Four things not to mix
Change one; leave the other three still
- Switch
- Whether Network Extension is up. On only means the tunnel is up. Details in Tunnel.
- Record
- The currently highlighted exit. A container is not an exit; child records have to be refreshed before they can be highlighted. Details in Objects.
- Policy
- Config is what asks rules. Proxy forces the record. Direct forces the system path. Details on the Tunnel page.
In one isolation, move only one of them. Refreshing a container, editing FINAL, changing the highlight, and switching policy at once lets every on-screen change be explained by the other three variables — which is no explanation.
What each chapter answers
Which page to open for a phenomenon
Connected, but the page looks like the proxy is off
See whether policy is Direct first, then which Data counter is rising. Data, Rules.
The list is empty after save
If you saved a container, empty is normal; you need a refresh. Objects. If you saved a record and there is no row, the type or the paste field was wrong.
The same site is sometimes proxied, sometimes direct
The engine saw different information twice: sometimes a name, sometimes only an address; GEOIP follows the CDN. Rules, DNS.
Only one App fails
Try the same host in another client under Proxy first. If only this one fails, that App is likely refusing the tunnel; see System.
Refresh failed
The URL, the network path of that moment, and whether the system allowed background refresh are three different things. Objects, Config, System.
You want to change a path inside HTTPS
That is rewrite plus decryption, not rules. Rewrite, System. Routing itself does not need decryption.
Not installed yet
Store. Check developer Shadow Launch Technology Limited and id932747118.
License
You bought the client; configuration stays on the device
The App Store client license, $2.99 once. It does not include a server, and there is no in-app renewal. Configuration lives on this device, optionally synced to your own iCloud. There is no account system; the developer does not hold your list. There is no official Android / desktop build.
The product overview is still on the home page. The rule tester there is a sample list, not the file on the device. Posts that unpack the same phenomenon are in the Blog.