Use TUN mode and split routing on Windows

Enable TUN for an imported Xray profile

1. Import a valid profile and select it. Disconnect before changing connection settings, then open Settings and select TUN as the connection mode.
2. Choose Full tunnel for a simple initial setup. Connect and approve the Windows administrator relaunch if VeilBox requests it. Creating and configuring the tunnel requires elevated permissions.
3. Once the connection works, add split-tunnel rules if needed. Bypass listed sends matching entries directly; Only listed sends matching entries through the VPN and leaves other traffic direct.
4. Add the appropriate domain, IP or process entries and reconnect to check the result. Process entries accept executable names such as telegram.exe or absolute executable paths. Test both a matching destination and an unlisted one.

Understand routing limits

Full tunnel still includes the implementation's local-network and server-connection bypass rules. Split routing happens on the client. GeoIP decisions depend on resolved destination addresses, so CDN placement and DNS responses can affect geographic rules.

System Proxy does not capture all programs or UDP traffic. If TUN fails, check the application logs, administrator permissions and bundled runtime components; the source build requires Wintun. Do not assume every connection is protected merely because the interface exists, and do not treat TUN as a documented kill switch. The AmneziaWG engine has its own runtime; these Xray routing steps are not a guarantee of identical behavior there.

Download VeilBox

Windows: 2.2.0. macOS Apple Silicon: 2.1.0 beta. VeilBox does not include VPN servers.

Related guides