Guide — VPN Manager

General

App behaviour, startup, and appearance. Preferences → General

Start with System

What: Launches VPN Manager automatically when you log in.
For: Having it ready without opening it by hand.
How: Adds a desktop autostart entry for your session.
When: If you use a VPN daily.

Minimize to Tray

What: Closing the window keeps the app running in the system tray instead of quitting.
For: Staying connected and reachable.
How: Intercepts the window close; if no system tray is detected, the window just closes.
When: Leave on if your desktop has a tray.

Auto-reconnect

What: Re-establishes the VPN automatically if the connection drops.
For: Staying protected through network blips.
How: A health check watches the tunnel and reconnects on failure.
When: On for laptops or unstable networks.

Connection Alerts

What: Desktop notifications when the VPN connects or disconnects.
For: Knowing your protection state at a glance.
How: Sends a system notification on state changes.
When: On unless you find them noisy.

Theme

What: App appearance — System, Light, or Dark.
For: Matching your desktop.
How: Applies immediately.
When: Anytime.

Network Trust

Manage the VPN automatically based on the network you're on. Preferences → Network Trust

Enable Network Trust

What: Automatically manages the VPN based on the network you're on.
For: Connecting on untrusted Wi-Fi and relaxing at home, hands-free.
How: Watches network changes and applies your rules.
When: On if you move between trusted and untrusted networks.

New Wi-Fi networks

What: What to do when you join a network you haven't set a rule for — Ask, Auto-connect VPN, or Do nothing.
For: A sensible default for unknown networks.
How: Applied by the trust engine when the network changes.
When: "Ask" if cautious; "Auto-connect" for maximum protection.

Cut internet if the VPN fails

What: On an untrusted network, blocks all traffic if the VPN can't connect.
For: Never leaking on untrusted Wi-Fi.
How: Engages the kill switch when a connect attempt fails on an untrusted network.
When: On for strong privacy.

Trust Wired Networks

What: Treats ethernet connections as trusted by default.
For: Not forcing the VPN on a wired home LAN.
How: Ethernet is auto-trusted unless a rule overrides it.
When: On if your wired network is safe.

Manage Rules

What: Per-network (Wi-Fi SSID) trust rules.
For: Fine control — trust home, distrust cafés.
How: Opens a rules editor.
When: To override the default action for specific networks.

Tailscale

Settings for the Tailscale mesh VPN. Preferences → VPN Providers

Accept Routes

What: Accept subnet routes advertised by other Tailscale nodes.
For: Reaching subnets behind other machines.
How: Enables Tailscale's accept-routes.
When: On if you use subnet routers.

Accept DNS

What: Use your Tailscale network's DNS (MagicDNS).
For: Resolving machines by name across your tailnet.
How: Applies Tailscale's DNS settings.
When: On for MagicDNS.

Enable LAN Gateway

What: Share your Tailscale connection with other devices on your local network.
For: Getting non-Tailscale devices (TV, console) onto the VPN.
How: Sets this machine up as a gateway (needs the administrator password).
When: To bridge LAN devices through your exit node.

Advertise Exit Node

What: Offer this machine as an exit node for your other Tailscale devices.
For: Routing other devices' internet through this machine.
How: Advertises exit-node capability (must be approved in the Tailscale admin console).
When: To make this a VPN exit for your tailnet.

Shields Up

What: Block all incoming connections.
For: Hardening this machine on the tailnet.
How: Enables Tailscale's shields-up.
When: If nothing should connect to this device.

Tailscale SSH

What: Enable Tailscale-managed SSH.
For: SSH into this machine using Tailscale identity.
How: Applied on the next connect.
When: If you use Tailscale SSH.

Security

Leak protection and the kill switch. Preferences → Security

Kill Switch Mode

What: Blocks traffic to prevent leaks — Off, On Disconnect, or Always On.
For: Never leaking outside the tunnel.
How: On Disconnect is a network lock — it stays out of the way while the tunnel is healthy and blocks everything only if it drops unexpectedly (split-tunnel friendly). Always On is full lockdown — only VPN traffic for the whole session. A disconnect you request yourself never trips the lock.
When: "On Disconnect" for most people; "Always On" for maximum strictness.

Allow LAN Access

What: Permits local-network traffic while the kill switch is active.
For: Still reaching your printer or NAS with the kill switch on.
How: Allows private LAN ranges through the block.
When: On if you need local devices.

DNS Mode

What: Which DNS servers to use on the VPN — System, Cloudflare, Google, or Custom.
For: Preventing DNS leaks or choosing a resolver.
How: System is passthrough (keeps whatever DNS the VPN/system provides — good for split-tunnel and corporate names); Cloudflare/Google/Custom force that resolver via the daemon.
When: System unless you want a specific resolver.

Custom DNS Servers

What: Your own DNS server addresses (used when DNS Mode is Custom).
For: A specific or private resolver.
How: Validated and applied.
When: With Custom mode.

Block apps' own encrypted DNS

What: Stops browsers and apps doing their own DNS-over-HTTPS/TLS and bypassing your VPN's DNS.
For: Making sure DNS actually goes through the VPN.
How: Blocks known DoH provider endpoints and the DoT port (853).
When: On for consistent DNS routing (can break apps that insist on their own DNS).

IPv6 leaks

What: How IPv6 is handled — Automatic, Always block, or Allow.
For: Preventing IPv6 leaks on IPv4-only tunnels.
How: Automatic blocks IPv6 only when the VPN can't carry it; Always block disables IPv6 while connected; Allow leaves it untouched.
When: Automatic (recommended).

OpenVPN profile settings

Per-profile options, opened from a profile's settings. OpenVPN tab → profile → Settings

Two-Factor Authentication (OTP)

What: Prompts for a one-time code each time you connect.
For: OpenVPN servers protected by 2FA.
How: Asks for the code and passes it at connect.
When: If your server requires OTP.

Enable Split Tunneling

What: Route only some traffic through the VPN.
For: Keeping part of your traffic off the tunnel.
How: Turns on the route rules below.
When: To keep specific apps or sites off the VPN.

Traffic Mode

What: Include (only the listed networks use the VPN) or Exclude (everything uses the VPN except the listed networks).
For: Choosing the split direction.
How: Applied through OpenVPN's own routing at connect time.
When: Include to send only a few things through the VPN; Exclude to send everything except a few.

IPs and Networks

What: The list of networks (IP or CIDR) the split rule applies to.
For: Defining exactly what to include or exclude.
How: Each entry is validated and passed to OpenVPN as a route.
When: With split tunneling enabled.

Use NetworkManager

What: Manage this connection through NetworkManager instead of launching OpenVPN directly.
For: Integrating with the system's network stack.
How: Switches the connection backend.
When: If you prefer NetworkManager integration (only shown when NM is available).

WireGuard profile settings

How WireGuard routing works in this app.

WireGuard routing is defined by the AllowedIPs field in the profile's .conf file — not in the app. What goes through the tunnel is exactly the CIDRs listed there:

AllowedIPs = 0.0.0.0/0, ::/0 — send all traffic through the tunnel.
Specific CIDRs (e.g. 10.0.0.0/8) — split tunnel: only those networks go through the tunnel.

To change it, edit AllowedIPs in the .conf and reconnect. The app's WireGuard settings view is read-only and shows the profile name, interface, and config-file path for reference.

Every option, explained