godusevpn godusevpn
Feedback and questions
Please include your operating system, app version and the problem or feature you’d like to discuss.
PRIVACY AT THE SYSTEM LEVEL
Privacy protection,
at the system level.
Adapter-level IPv6 protection · Global-mode direct-traffic guard · DoH
A cross-platform sing-box client that brings privacy protection to the system level.
Windows · macOS · Linux · Android beta
GODUSEVPNOne subscription. Connections on your terms.
01 / ADAPTER PROTECTIONDisable IPv6 on network adapters
Remove public IPv6 addresses from physical adapters
Reduce the risk of apps reading your address
02 / GLOBAL GUARDGlobal-mode direct-traffic guard
Keep protection active through reconnects
Guard against traffic bypassing the tunnel
03 / ENCRYPTED DNSEncrypted DNS with DoH
Encrypt DNS queries in transit
Route DNS queries according to your policy
PRIVACY PROTECTION / IPv6 + DoH
Block IPv6 traffic.
Remove exposed IPv6 addresses.
IPv6 controls span DNS, address mapping, the core and TUN. On desktop platforms, protection also reaches the Physical adapters, reducing the exposure of public IPv6 addresses to native apps that enumerate adapters.
Layer 5 · Physical adapter protectionMechanism illustration
Address accessNative app
Lists adapters
Lists adapters
ResultPublic IPv6
No longer exposed
No longer exposed
Reduce address exposure at the adapter itself.
What it does
With this protection enabled on Windows, Linux or macOS, the client disables IPv6 on physical adapters when you connect and restores each adapter's previous state when you disconnect.
Why it matters
Even when no IPv6 packets leave the device, native apps may still read public addresses from its adapters. Once IPv6 is disabled, those adapters no longer expose their public IPv6 addresses.
Platform limits:Windows, Linux and macOS support the fifth layer. Android cannot change IPv6 on physical adapters and uses the first four layers. This illustration assumes the default IPv6-disabled configuration. Actual behavior depends on the client settings.
DNS OVER HTTPS
DNS queries,
encrypted in transit.
Use DoH for DNS queries. Remote DNS goes through the proxy; local DNS and node hostname lookups follow their own policies, with clear rules for encryption and routing.
DNS queries encrypted with HTTPS.
DNS-over-HTTPS (DoH) encrypts query contents in transit instead of sending them as plaintext DNS requests.
Different lookups, different routes.
Remote DNS, local DNS and node hostname lookups serve different purposes. The client chooses their routes based on DNS settings and protection status.
Client DNS routes · Mechanism illustration
Application DNS requestQueries handled by the client
Core DNS policyRoutes assigned by lookup purpose
Remote DNS
DoH encrypts DNS queries, and the proxy carries them to the remote resolver.
App DNS → Core → DoH → ProxyLocal and node DNS lookups
DoH is used by default. The route depends on your DNS settings, the purpose of the lookup and whether the Global-mode direct-traffic guard is active.
Core → DoH → Policy-based routeThis illustrates DNS queries handled by the client. Remote DNS uses the proxy, but that does not mean every DNS query goes through the tunnel. Local DNS and node hostname lookups have their own policies and necessary exceptions.
Explore how DNS queries take different encrypted routes according to their purpose.
02 / SYSTEM-LEVEL GUARD
Beyond the tunnel,
another layer of protection.
In Global mode, the direct-traffic guard stays active while you intend to remain connected. Protection is monitored even while the core restarts.
Global-mode direct-traffic guard
When enabled in Global mode, it restricts direct connections that bypass the tunnel.
IPv6 protection by default
Block IPv6 traffic in the tunnel and disable IPv6 on physical adapters where the platform supports it.
Visible status. Ongoing repair.
If protection is incomplete, the client tells you and shows its degraded status.
Platform requirements and limits
Windows uses WFP, Linux uses nftables, and macOS uses pf. On Android, protection after the app process exits relies on the system’s Always-on VPN and Block connections without VPN settings. macOS startup timing, older Linux kernels and bridged virtual machines have limits. The client home screen shows degraded protection.
GUARDGlobal-mode direct-traffic guard
Tunnel running; traffic follows policyIllustration: protection requirements are met
Mechanism illustration · Capabilities depend on the platform and protection status
03 / RECOVERY AND CONNECTION CARE
When connections fail,
recovery is built in.
From subscription updates to long-lived session recovery, let the client handle the retries.
Update subscriptions with your current connection in mind.
If a subscription update fails through the current proxy, the client retries through Auto, then with a direct request. It keeps the current connection when the active node is unchanged.
FIRSTCurrent proxy
THENAuto group
FALLBACKDirect request
Example: fetch the subscription through the current proxy, keeping your selected node.
The client reconnects if the active node is removed or its settings change. Direct fallback applies only to the subscription request.
Session alive, but nothing gets through?
Monitoring for Hysteria2 and TUIC detects repeated stream failures, rebuilds the session and triggers a health check.
Example: the session is still alive, but application streams keep failing.
Mechanism illustration. The chart does not show measured speeds or recovery times.
Core recovery
Illustration · Not a recovery timer
See what happens after a failure.
Assume the Global-mode direct-traffic guard is enabled and Wanted=true. Step through protection, retries and recovery checks.
Validate before startup
Retry automatically
Independent network recoveryAvailable even if the service cannot start. You choose when to release protection.
04 / ROUTING, MADE VISIBLE
Where your traffic goes,
you decide.
Choose a mode or define rules by domain, IP, port and process. Make routing decisions you can understand.
YOUR DEVICEDevice trafficCaptured by TUN
GODUSEVPNMatch rulesChoose an exit in rule order
Proxy exitPROXY
Direct connectionDIRECT
Mainland China servicesDirect by default →
Other servicesProxy by default →
Custom rulesMatched first →
Rule mode: your rule groups are checked first, then the default policy chooses an exit. The default setup sends mainland China services directly and other traffic through a proxy.
This is a routing illustration, with no live service connection. You can change the default policy in the client.
05 / TRY IT. UNDERSTAND IT.
Every action,
clearly explained.
Explore the actual client interface in a separate interactive lab. Connect, switch modes, choose nodes and edit rules, with an explanation alongside each action.
01Pick a scenario02Try it yourself03Understand the effect
Sample data · No live proxy connection · Reload to reset
Interactive labEXAMPLE
See what changes.
Understand why.
The actual interface runs on a separate page.
Key actions come with an explanation of what happened, why and what it affects.
Example: switching to Global modeNormal application traffic now uses the proxy exit. Everyday routing rules are temporarily bypassed.
Try it yourself Open source. Clear origins.
Open source under GPL-3.0. Powered by an embedded sing-box core.
Client source code and release history are public.
Updates, verified first.
An Ed25519-signed manifest and SHA-256 checks
verify the package before installation.
Troubleshoot with less exposure.
Shared redaction rules for logs and diagnostic bundles
mask subscription credentials and sensitive network details.
06 / PRIVACY JOURNAL
Privacy deserves a closer look.
From the idea behind godusevpn to everyday use, explore how each layer of protection works.
01 / JOURNAL
Browse the journal Why godusevpn exists: privacy tools more people can understand
The purpose behind godusevpn: make privacy protection easier to use, explain and control through clear interfaces and system-level safeguards.
Read article 02 / JOURNALGetting started with godusevpn: your first connection
Prepare a compatible sing-box JSON subscription, choose the right package, and learn how importing, modes, privacy settings and recovery work.
Read article 03 / JOURNALHow godusevpn handles IPv6, DNS and connection leaks
Understand packet bypass, readable adapter addresses, layered IPv6 controls, DoH routes and the platform limits of global direct-connection blocking.
Read article 04 / JOURNALChoosing a privacy client: coverage, DNS and recovery
Compare privacy clients by traffic coverage, IPv6 address exposure, DNS routes, failure handling and platform fit, including godusevpn’s trade-offs.
Read articleChoose your device. Get the right package.
Your next connection
starts here.
v0.7.15Stable release · 7 Oct 2026
Choose your system and architecture to download the matching file directly from the project's official GitHub Releases. Check the requirements and installation guide first.
For 64-bit Windows PCs with Intel or AMD processors. The standard installer downloads the WebView2 runtime if it is missing.
godusevpn-0.7.15-windows-x64-setup.exe
Download for Windows
Install in three steps
Trust prompts and install commands
View the official script
Already downloaded and extracted? Install locally
Device and installation requirementsWindows 10 1809 (build 17763) or later, including Windows 11. Installation requires administrator rights.
Package and platform notes
Unsure of the architecture? Check System type in Windows settings, then choose x64 or ARM64. The offline installer includes the WebView2 runtime.Bring a compatible sing-box JSON subscription to set up a connection. The checksum list and signature belong to the same release as the packages.
Contact and support
Support development
TRON / TRC20If godusevpn is useful to you, you can help fund its continued development.
Donation address—