TUN Mode

In TUN mode, Throne creates a virtual network adapter and sends the traffic of the whole computer through it. This covers apps that ignore proxy settings, and DNS queries too. Use it when the system proxy is not enough. For a comparison of both modes, see Which mode to use.

Turn on TUN mode

1. Tick Tun Mode on the main window, or use Operation Mode → Tun Mode in the tray menu.
2. The first time, Throne asks for the rights that TUN needs. Accept the request (see below).
3. Start a profile, if none is running.

While TUN mode is active, the window title shows [Tun]. It starts with [Admin] when Throne has the rights for TUN. Turning TUN mode on or off restarts the running profile.

TUN mode works only while a profile runs. When you stop the profile, your apps use your normal connection again. Throne has no kill switch; see FAQ. With Program → Remember last profile on, Throne starts the last profile again when it starts, and turns TUN mode back on if it was on when you quit.

What happens the first time:

• Windows: Throne asks "Please run Throne as admin". Click Yes. Throne closes and starts again as administrator, with TUN mode on; Windows shows a user account control prompt first. Windows Firewall may then ask about ThroneCore. Allow it: if you block it, TUN connects, but nothing loads.
• Linux: Throne asks "Please give the core root privileges". Click Yes and enter your password in the system prompt. Throne then gives the core root rights. Tick Tun Mode again.
• macOS: Throne asks "Please give the core root privileges". Click Yes. Terminal opens and runs a sudo command. Enter your password in Terminal, then tick Tun Mode again.

Privileges

TUN mode needs system rights to create the adapter and change the routes of the computer.

Windows

• Throne must run as administrator. The first click on Tun Mode offers a restart as administrator.
• After Throne has run as administrator once, it asks for administrator rights each time it starts. To stop this, tick Settings → Basic Settings → Security → Always Start as Standard User. Throne then asks again each time you turn on TUN mode.
• If you turn on Program → Start with system while Throne runs as administrator, Throne starts with administrator rights at sign-in, without a prompt.

See also FAQ.

Linux

• Only the core, ThroneCore, needs root rights. Throne gives it these rights with pkexec: it makes root the owner of ThroneCore and sets the SUID bit (chown root:root and chmod u+s).
• pkexec is part of polkit. If it is missing, Throne shows "Please install "pkexec" first."
• Never start Throne itself with sudo.
• Instead of the SUID bit, you can give the core these five capabilities: CAP_NET_ADMIN, CAP_NET_RAW, CAP_NET_BIND_SERVICE, CAP_SYS_PTRACE and CAP_DAC_READ_SEARCH. Throne accepts the core as privileged only if it has all five.

sudo setcap cap_net_admin,cap_net_raw,cap_net_bind_service,cap_sys_ptrace,cap_dac_read_search+ep /path/to/Throne/ThroneCore

Some third-party packages cannot change the core themselves. They show "This installation cannot grant the core privileges by itself." together with instructions from the package. See also FAQ.

macOS

• Move Throne.app to /Applications before you turn on TUN mode. The rights are set from Terminal, and this can fail while the app is in Downloads.
• Throne opens Terminal with a sudo chown root:wheel … && sudo chmod u+s … command for the core. Enter your password there, then tick Tun Mode again.
• sudo needs an administrator account. On a standard account you can use the system proxy, but not TUN mode.

Turn off the requests

Settings → Basic Settings → Security → Disable Privilege request stops Throne from asking for rights. Throne then starts TUN mode with the rights it has, and the log says "User opted for no privilege req, some features may not work". Use this only if you give the rights yourself, for example when you always start Throne as administrator, or when you set the capabilities shown above.

TUN settings

Open Settings → Tun Settings. If TUN mode is on when you click OK, Throne shows "Restart Tun to take effect". Turn Tun Mode off and on again.

Setting	Default	What it does
Stack	system on Windows 10 and later and on Linux, gvisor on macOS	How the core processes the adapter's traffic. system uses the network stack of the operating system, gvisor a network stack inside the core, and mixed uses system for TCP and gvisor for UDP. On Windows 7 and 8 it is always gvisor.
MTU	1500	The largest packet size of the adapter. Choose 1500 or 9000, or type a value from 1000 to 10000. Other values are replaced with 9000.
Tun Enable IPv6	off	Gives the adapter an IPv6 address, so that IPv6 traffic goes through the tunnel.
Strict Route	on for Windows 10 and later, off elsewhere	On Windows, blocks DNS queries that try to go around the tunnel. See Windows DNS Leak Protection.
Enable Tun Routing	off	Leaves the IP ranges and geoip-* rule-sets that your routing sends direct out of the tunnel, so the system routes them past the core. Large rule-sets can cause very high CPU use on Windows.
Auto Redirect	on	Linux only. Needed on newer kernels for the system and mixed stacks. While it is on, this computer cannot be used as a network gateway for other devices.
L3 Bridge Bypass	off	Sends UDP and ICMP traffic that your rules send direct straight out of the network adapter, instead of opening a new connection for it. This is faster and keeps NAT working for games and P2P. TCP keeps the normal direct path. Not available on Windows on ARM.
IPv4 CIDR	172.19.0.1/24	The IPv4 address of the adapter. Change it only if it clashes with a network you use. Restore default addresses resets both addresses.
IPv6 CIDR	fdfe:dcba:9876::1/96	The IPv6 address of the adapter. Used only with Tun Enable IPv6.
Private Range Bypass	on	Address ranges that go straight to your network adapter instead of through the core, one per line. Restore default ranges restores the list. Loopback and broadcast addresses always bypass the tunnel.
Troubleshooting → Reset	–	Restarts the core process. Use it when TUN mode does not start.

The default Private Range Bypass list is 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 224.0.0.0/4, fc00::/7, fe80::/10 and ff00::/8.

Side effects

Local network

With Private Range Bypass on, your computer reaches printers, network drives, your router's settings page and other local devices directly, outside the tunnel. If you turn it off, local traffic goes through the core, and your routing rules decide where it goes. A routing rule that sends a private range to the proxy, or blocks it, keeps that range in the tunnel so that the rule works.

Mobile hotspot and connection sharing on Windows

If Windows Mobile Hotspot or Internet Connection Sharing shares your normal network adapter, Windows ignores the settings that keep Throne's own connections out of the tunnel. TUN mode then fails, and Throne warns "IPv4 forwarding breaks Tun mode". Share the hotspot from the throne-tun adapter instead: in the Windows settings for Mobile hotspot, set "Share my internet connection from" to throne-tun. Or turn the hotspot off while you use TUN mode. See Recipes.

Docker, WSL and virtual machines

Containers and virtual machines have their own virtual networks. Traffic between them and your computer uses private addresses, so it usually bypasses the tunnel. If such a network uses a range that is not in the Private Range Bypass list, add it. On Linux, remember that Auto Redirect stops the computer from working as a network gateway. See Recipes.

Other VPNs

Two VPNs on the same computer compete for routes and DNS. Turn off other VPN apps while TUN mode is on. To reach a company network at the same time, see Recipes.

IPv6

Tun Enable IPv6 is off by default. Turn it on only if your server supports IPv6. Otherwise, you can get connection problems.

DNS

In TUN mode, the DNS queries of all apps reach Throne. A DNS leak test can still show the DNS server of your Internet provider for sites that your rules send direct. This is expected; see DNS.

Troubleshooting

Open the Logs tab and look for errors when TUN mode starts. For general steps, see Troubleshooting.

Windows

Connected, but nothing loads. Windows Firewall may block ThroneCore. Windows asks only once, when you first turn on TUN mode. If you blocked it then, allow ThroneCore in Windows Security → Firewall & network protection → Allow an app through firewall, for private and public networks.

Antivirus. Some antivirus programs, for example Avast and ESET, block the adapter or the core. Add an exception for the Throne folder.

Another stack. Set Stack to gvisor in Tun Settings and try again.

"Strict routing unavailable". Windows could not turn on strict routing. Untick Strict Route in Tun Settings and start the profile again. Without it, DNS queries can leak; see Windows DNS Leak Protection.

"Tun device misbehaving". Click Reset to restart the core, then start the profile again.

After a crash or force-quit. The virtual adapter can be left behind. Restart Windows.

TUN mode takes very long to start. Throne clears the DNS cache of Windows when TUN mode starts. A very large HOSTS file, for example an ad-blocking list with 100,000 entries, makes this very slow. Make the HOSTS file smaller.

Mobile hotspot. See Mobile hotspot and connection sharing.

Linux

"Please install "pkexec" first." Install polkit with your package manager, or set the capabilities shown in Linux privileges.

"file exists" when TUN mode starts. This error came from Auto Redirect and was fixed in 1.2.2. If you still see it, turn off Auto Redirect and set Stack to gvisor.

No DNS with systemd-resolved. If DNSOverTLS is turned on for all interfaces in /etc/systemd/resolved.conf, TUN mode breaks. Turn it off there, or turn it off for the Throne adapter while the adapter exists:

sudo resolvectl dnsovertls throne-tun no

Packages from AUR, Nix or other repositories. They are maintained by the community. If TUN mode fails there, try the official build; see FAQ.

Throne was started with sudo. Quit it and start it as your normal user. Only the core needs root.

macOS

macOS says that the app is damaged or cannot be opened. Remove the quarantine flag:

xattr -d com.apple.quarantine /Applications/Throne.app

The rights request fails. Move Throne.app to /Applications, start it from there, and tick Tun Mode again.

Standard account. TUN mode needs an administrator account. Use the system proxy, or sign in with an administrator account.

For DNS leak hardening on Windows, see Windows DNS Leak Protection.

On Android

In VPN mode, Throne for Android works like TUN mode. Its settings are in Settings → TUN / VPN. There, the default stack is gVisor, the default MTU is 9000, and strict route is always on. See VPN & Proxy Modes.