Documentation / Connection setup
Connection setup
Identify the build first
The DNS build does not require a VPN server address. Allowed DNS queries use the built-in Cloudflare upstream over HTTPS; this guide does not provide a custom-resolver selector.
DNS filtering scope
Normal mode processes DNS queries that reach the VPN interface. Apps using their own encrypted DNS or direct IP connections can bypass that path.
For single-app inspection in the DNS build, open the inspection section, select an app and start inspection. Only that app is in scope. Stop inspection with its own control before changing scenarios. Do not apply this recipe to experimental Preview.
Preview is separate
Preview requires configured participants and explicit transport policies. An empty participant list and incompatible single-app inspection mode reject startup. Its device mode means configured participants, not the entire phone.
External SOCKS5 setup is not yet a normal public-release procedure. Read the proxy evidence and limits. DNS policy and Direct/Proxy transport are separate: allowing a domain does not change its transport.