TUN and IPv6

The `tun` section is ignored

On iPhone and iPad, and in TUN mode on Mac, MeowX captures traffic through the system’s VPN framework. The tunnel’s addresses, routes and DNS are set by the app, so the whole tun: section of a configuration — enable, stack, auto-route, auto-detect-interface, dns-hijack, mtu, strict-route, inet4-address, route-exclude-address, and so on — is ignored. You don’t need to remove it.

What the tunnel captures

	iPhone / iPad	Mac, TUN mode
IPv4	All IPv4 traffic.	All IPv4 traffic except local networks: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `100.64.0.0/10`, multicast `224.0.0.0/4` and broadcast. Printers, NAS and screen sharing keep working directly.
IPv6	Not captured (IPv6 mode is always Off).	Depends on the IPv6 mode.
DNS	The system’s DNS is pointed into the tunnel for all domains.	Same.

In TUN mode on Mac, MeowX by default also sets the system HTTP / HTTPS proxy to its own local proxy while connected. Proxy-aware apps (browsers and most others) then send domain names directly, which is faster on macOS than capturing their packets; other apps are still captured by the tunnel.

On Mac in system proxy mode there is no tunnel: only apps that honor the system proxy settings go through MeowX, and the IPv6 mode doesn’t apply.

Internal addresses

The tunnel uses 172.19.0.0/30 for itself, and fake-ip addresses come from 198.18.0.0/16 by default. Don’t configure a fake-ip-range that overlaps 172.19.0.0/30. In IPv6 Blackhole or Proxy mode the tunnel’s IPv6 address comes from the documentation prefix 2001:db8::/32, which is never routed on the internet; seeing it as an interface address is expected.

IPv6 modes

On Mac, the IPv6 setting is in the menu bar panel’s settings. Changing it reconnects the tunnel if it is running. On iPhone and iPad there is no setting; the mode is always Off.

Mode	What happens to IPv6 traffic	Default
Off	IPv6 isn’t routed into the tunnel. Apps that connect over IPv6 do so directly on the physical network, outside your rules.	iPhone, iPad and Mac
Blackhole	IPv6 is routed into the tunnel and refused: TCP gets a reset, UDP is dropped. Apps fall back to IPv4, which is proxied, so nothing leaks over IPv6. Apps that don’t fall back to IPv4 on their own may fail to connect.	—
Proxy	IPv6 is routed into the tunnel and proxied like IPv4. Rules see IPv6 destinations (`IP-CIDR6`, `GEOIP`, `ipcidr` providers), and the IPv6 address is sent to the node, so the node needs working IPv6 egress. Experimental.	—

Notes:

There is no fake-ip range for IPv6 (mihomo doesn’t have one either). In fake-ip mode, fake-ip domains never get IPv6 answers, so apps reach them over IPv4.
In Proxy mode on Mac, link-local (fe80::/10), unique local (fc00::/7), multicast (ff00::/8) and loopback addresses stay outside the tunnel so that local-network features such as AirDrop and Bonjour keep working.
WireGuard nodes can’t carry IPv6 destinations.

IPv6 and DNS

Two independent switches decide what happens with IPv6:

dns.ipv6 in the configuration decides whether apps receive IPv6 addresses for domains.
The IPv6 mode decides what happens to IPv6 traffic.

The top-level ipv6 key is ignored.

`dns.ipv6`	IPv6 mode	Result
`false` (default)	Off	Apps get IPv4 addresses for domains and connect over IPv4 through MeowX. IPv6 is only used by apps that connect to IPv6 addresses on their own, and that traffic goes direct. This is the default on all devices.
`false`	Blackhole	Same as above, and IPv6 that apps try on their own is refused, so it can’t bypass MeowX.
`true`	Off	Not recommended. Apps get IPv6 addresses and connect to them directly, bypassing your rules.
`true`	Blackhole	Apps get IPv6 addresses, the attempt is refused, and well-behaved apps fall back to IPv4. Adds delay; no benefit.
`true`	Proxy	Full IPv6: apps connect over IPv6, and that traffic is proxied according to your rules (Mac only, experimental).