FAQ
Connections and nodes
Section titled “Connections and nodes”What do “—” and “Timeout” mean next to a node?
Section titled “What do “—” and “Timeout” mean next to a node?”— means the node has not been tested yet. Timeout means the latency test got no successful answer within the time limit (5 seconds). Common reasons:
- The node is down, or your provider has changed or removed it. Refresh the subscription.
- Your network blocks that server or protocol (some Wi-Fi networks, for example, block UDP, which affects protocols such as Hysteria 2 and WireGuard).
- The test URL is unreachable through that node. Try another URL in Me › Proxy & Speed Test › Test URL.
- A test was cut short because the connection was still starting. MeowX then shows “Test incomplete” with the reason and keeps the earlier results; try again.
A latency chip that is dimmed is simply being tested at that moment.
Why are the latency numbers different from another client?
Section titled “Why are the latency numbers different from another client?”Clients measure different things. MeowX’s default, HTTPS latency, times a single round trip on an already-open connection, so it leaves out handshake cost. Real connection latency includes every handshake and is typically three to four times higher; TCPing only measures the TCP handshake to the server. Pick the method in Me › Proxy & Speed Test › Test method. The color thresholds adjust to the method. See Nodes.
I picked a node in an “Auto” group, and now it never switches. Why?
Section titled “I picked a node in an “Auto” group, and now it never switches. Why?”Tapping a member of a url-test or fallback group pins it. MeowX keeps using a pinned node as long as it is alive, and only falls back to automatic selection if it is judged dead. To go back to automatic selection, tap the pinned node again or turn Auto select back on. See Auto select and pinning.
Some nodes from my subscription are missing or never connect
Section titled “Some nodes from my subscription are missing or never connect”MeowX drops nodes it cannot use instead of rejecting the whole subscription. Examples: a protocol it does not support (such as TUIC), an unsupported Shadowsocks cipher or plugin, or missing required fields. The engine logs a warning like “Skipped node name (type=…, reason)”. Open Activity › Logs, choose the Engine source, and look for it. Warnings are recorded even when Record logs is off.
Groups of type load-balance are not implemented yet and currently behave like select groups.
Why do my custom rules not do anything?
Section titled “Why do my custom rules not do anything?”Check these in order:
- Custom rules only apply in Rule mode. In Global or Direct mode they are ignored (the app tells you so).
- They only affect new connections. Close the old ones on the Activity tab or reload the page.
- Entries in the bypass list always win: they go direct before any rule is checked.
- An IP rule matches only connections whose destination is exactly that IP. In Fake-IP mode, domain-based connections target placeholder addresses, so use a domain rule instead.
See Custom rules.
Can other devices use my iPhone’s or Mac’s connection?
Section titled “Can other devices use my iPhone’s or Mac’s connection?”Yes. Turn on the local proxy, enable Allow LAN connections, and set the other device’s HTTP or SOCKS5 proxy to your device’s LAN address and port (7890 by default). Setting a username and password protects LAN access; connections from the device itself never need credentials. On iPhone, the local proxy only runs while MeowX is connected.
Why do push notifications bypass the proxy?
Section titled “Why do push notifications bypass the proxy?”By default, Apple Push Notification traffic always goes direct, regardless of mode and rules, so notifications keep arriving even if a node is slow or down. If you want push traffic to follow your rules, turn on Proxy APNs in Traffic control.
What is the difference between Fake-IP and Redir-Host?
Section titled “What is the difference between Fake-IP and Redir-Host?”Both let MeowX know which domain a connection is for, so domain rules work.
- Fake-IP answers DNS queries instantly with placeholder addresses from
198.18.0.0/16and maps them back to the domain when the app connects. Proxied connections hand the domain to the node, which resolves it. Fast, but apps see addresses that are not real, IP-based bypass entries cannot match, and IPv6 (AAAA) answers are empty. - Redir-Host performs a real lookup and returns real addresses. The most compatible choice; connection setup can be slightly slower.
Follow subscription (the default) uses whatever the subscription specifies, or Redir-Host if it specifies nothing. More in Concepts and DNS.
An app works without MeowX but not with it. Should I change the DNS mode?
Section titled “An app works without MeowX but not with it. Should I change the DNS mode?”It is a good quick test. Switch modes (tap the DNS tile on the Home tab to cycle through them), let MeowX reconnect, and try again. If the app works in Redir-Host but not in Fake-IP, keep Redir-Host or add the app’s domains to the bypass list.
How do I force a domain to a specific IP?
Section titled “How do I force a domain to a specific IP?”Use DNS hijack in Traffic control. It maps a domain (exact, *. one level, or +. including subdomains) to an IPv4 address and takes priority over the subscription’s hosts and DNS settings.
HTTPS decryption (MITM)
Section titled “HTTPS decryption (MITM)”Why does an app stop working when HTTPS decryption is on?
Section titled “Why does an app stop working when HTTPS decryption is on?”Most likely the app uses certificate pinning: it only trusts its own server’s certificate, so it refuses MeowX’s certificate and closes the connection. No proxy can decrypt such an app without breaking it.
MeowX detects this pattern (for example, the app closing the connection right after the handshake, or TLS alerts that mean “bad certificate”). When the same host shows it twice within 5 minutes, MeowX stops decrypting that host for an hour and passes its traffic through unchanged. To fix it for good, remove the host from your decryption list.
On the Mac, command-line tools such as curl, Python or Node and services running as root do not read the login keychain, so they do not trust MeowX’s certificate either. Do not add the hosts they use.
Details in HTTPS Decryption.
Does HTTPS decryption change anything when it is off?
Section titled “Does HTTPS decryption change anything when it is off?”No. When it is off, connections are handled exactly as before.
Battery and performance
Section titled “Battery and performance”Does MeowX drain my battery?
Section titled “Does MeowX drain my battery?”Any VPN costs some battery, because every packet passes through it. MeowX is designed to keep that low:
- Fast mode and the user-space TCP stack (both on by default, in Me › Network settings) cut CPU use during heavy traffic. Keep them on.
- The once-per-second status refresh only runs while the Home tab is on screen in the foreground.
- Node statistics and Record logs are off by default. Leave them off unless you need them.
What you can influence:
- Health checks. url-test and fallback groups periodically test their members. A subscription with many large auto groups and short test intervals wakes the radio more often. This is set by the subscription’s
interval. - Weak or unstable nodes cause retries and reconnects. A stable node uses less power.
- Detailed logging and HTTPS decryption add CPU work.
Why did MeowX disconnect by itself on iPhone?
Section titled “Why did MeowX disconnect by itself on iPhone?”Possible reasons:
- iOS limits VPN extensions to about 50 MB of memory and stops the extension if it goes over. The Memory tile on the Home tab shows current usage; tap it while connected for a breakdown. Very large configurations or an unusually high number of simultaneous connections push it up.
- Another VPN app was started, or the VPN configuration was removed in iOS Settings (MeowX then shows Not installed).
- A Wi-Fi automation rule turned it off.
Platform questions
Section titled “Platform questions”Does MeowX support IPv6?
Section titled “Does MeowX support IPv6?”- iPhone / iPad: IPv6 traffic is not routed through the tunnel. In Fake-IP mode DNS returns no IPv6 addresses, so apps use IPv4.
- Mac (TUN mode): an IPv6 setting offers Off (default), Blackhole (pull IPv6 into the tunnel and refuse it, so apps fall back to IPv4) and Proxy (experimental real IPv6 proxying). This setting only applies to TUN mode.
Do PROCESS rules work?
Section titled “Do PROCESS rules work?”Not on iPhone and iPad: iOS does not tell VPN apps which app opened a connection, so PROCESS-NAME and similar rules cannot match there. Use domain or IP rules instead.
Can I edit the configuration inside the app?
Section titled “Can I edit the configuration inside the app?”No. View config shows the running config.yaml read-only (you can select and copy text). To change routing, use custom rules and the traffic control settings, which survive subscription refreshes, or edit the configuration at its source. See the configuration reference.
Can I use MeowX together with another proxy app?
Section titled “Can I use MeowX together with another proxy app?”On iPhone and iPad only one VPN can be active, so starting one stops the other. On the Mac, two clients that both set the system proxy will fight over it. Quit the other client, or turn off MeowX’s System proxy toggle and use TUN mode or the local proxy port.