godusevpn godusevpnPRIVACY AT THE SYSTEM LEVEL
Privacy protection,
at the system level.
Adapter-level IPv6 protection · Global-mode direct-traffic guard · DoH
A cross-platform sing-box client that brings privacy protection to the system level.
Windows · macOS · Linux · Android
Five layers working together
Explore leak protection ↗GODUSEVPNOne subscription. Connections on your terms.
01 / ADAPTER PROTECTIONDisable IPv6 on network adapters
Remove public IPv6 addresses from physical adapters
Reduce the risk of apps reading your address
02 / GLOBAL GUARDGlobal-mode direct-traffic guard
Keep protection active through reconnects
Guard against traffic bypassing the tunnel
03 / ENCRYPTED DNSEncrypted DNS with DoH
Encrypt DNS queries in transit
Route DNS queries according to your policy
PRIVACY PROTECTION / IPv6 + DoH
Block IPv6 traffic.
Remove exposed IPv6 addresses.
IPv6 controls span DNS, address mapping, the core and TUN. On desktop platforms, protection also reaches the Physical adapters, reducing the exposure of public IPv6 addresses to native apps that enumerate adapters.
Layer 5 · Physical adapter protection
Address accessNative app
Lists adapters
Lists adapters
ResultPublic IPv6
No longer exposed
No longer exposed
Reduce address exposure at the adapter itself.
What it does
With this protection enabled on Windows, Linux or macOS, the client disables IPv6 on physical adapters when you connect and restores each adapter's previous state when you disconnect.
Why it matters
Even when no IPv6 packets leave the device, native apps may still read public addresses from its adapters. Once IPv6 is disabled, those adapters no longer expose their public IPv6 addresses.
Platform support
Windows, Linux and macOS support the fifth layer. Android cannot change IPv6 on physical adapters and uses the first four layers. This illustration assumes the default IPv6-disabled configuration. Actual behavior depends on the client settings.
DNS OVER HTTPS
DNS queries,
encrypted in transit.
Use DoH for DNS queries. Remote DNS goes through the proxy; local DNS and node hostname lookups follow their own policies, with clear rules for encryption and routing.
Client DNS routes · Mechanism illustration
Application DNS requestQueries handled by the client
Core DNS policyRoutes assigned by lookup purpose
Remote DNS
DoH encrypts DNS queries, and the proxy carries them to the remote resolver.
App DNS → Core → DoH → ProxyLocal and node DNS lookups
DoH is used by default. The route depends on your DNS settings, the purpose of the lookup and whether the Global-mode direct-traffic guard is active.
Core → DoH → Policy-based routeThis illustrates DNS queries handled by the client. Remote DNS uses the proxy, but that does not mean every DNS query goes through the tunnel. Local DNS and node hostname lookups have their own policies and necessary exceptions.
02 / SYSTEM-LEVEL GUARD
Beyond the tunnel,
another layer of protection.
In Global mode, the direct-traffic guard stays active while you intend to remain connected. Protection is monitored even while the core restarts.
Global-mode direct-traffic guard
When enabled in Global mode, it restricts direct connections that bypass the tunnel.
IPv6 protection by default
Block IPv6 traffic in the tunnel and disable IPv6 on physical adapters where the platform supports it.
Visible status. Ongoing repair.
If protection is incomplete, the client tells you and shows its degraded status.
Platform requirements and limits
Windows uses WFP, Linux uses nftables, and macOS uses pf. On Android, protection after the app process exits relies on the system’s Always-on VPN and Block connections without VPN settings. macOS startup timing, older Linux kernels and bridged virtual machines have limits. The client home screen shows degraded protection.
GUARDGlobal-mode direct-traffic guard
Tunnel running; traffic follows policyIllustration: protection requirements are met
Mechanism illustration · Capabilities depend on the platform and protection status
03 / RECOVERY AND CONNECTION CARE
When connections fail,
recovery is built in.
From subscription updates to long-lived session recovery, let the client handle the retries.
Update subscriptions with your current connection in mind.
If a subscription update fails through the current proxy, the client retries through Auto, then with a direct request. It keeps the current connection when the active node is unchanged.
FIRSTCurrent proxy
THENAuto group
FALLBACKDirect request
Example: fetch the subscription through the current proxy, keeping your selected node.
Session alive, but nothing gets through?
Monitoring for Hysteria2 and TUIC detects repeated stream failures, rebuilds the session and triggers a health check.
Example: the session is still alive, but application streams keep failing.
Core recovery
Keep protection · Retry · Check recovery
Explore what happens after a failure.
Explore recovery after a core failure, with direct-traffic protection enabled and the connection still requested.
Independent network recoveryAvailable even if the service cannot start. You choose when to release protection.
04 / ROUTING, MADE VISIBLE
Where your traffic goes,
you decide.
Choose a mode or define rules by domain, IP, port and process. Make routing decisions you can understand.
YOUR DEVICEDevice trafficCaptured by TUN
GODUSEVPNMatch rulesChoose an exit in rule order
Proxy exitPROXY
Direct connectionDIRECT
Mainland China servicesDirect by default →
Other servicesProxy by default →
Custom rulesMatched first →
Rule mode: your rule groups are checked first, then the default policy chooses an exit. The default setup sends mainland China services directly and other traffic through a proxy.
This is a routing illustration, with no live service connection. You can change the default policy in the client.
05 / TRY IT. UNDERSTAND IT.
Every action,
clearly explained.
Explore the actual client interface in a separate interactive lab. Connect, switch modes, choose nodes and edit rules, with an explanation alongside each action.
Sample data · No live proxy connection · Reload to reset
Interactive labEXAMPLE
See what changes.
Understand why.
The actual interface runs on a separate page.
Key actions come with an explanation of what happened, why and what it affects.
Example: switching to Global modeNormal application traffic now uses the proxy exit. Everyday routing rules are temporarily bypassed.
Try it yourself Open source. Clear origins.
Open source under GPL-3.0. Powered by an embedded sing-box core.
Client source code and release history are public.
Updates, verified first.
An Ed25519-signed manifest and SHA-256 checks
verify the package before installation.
Troubleshoot with less exposure.
Shared redaction rules for logs and diagnostic bundles
mask subscription credentials and sensitive network details.
06 / PRIVACY JOURNAL
Privacy deserves a closer look.
From the idea behind godusevpn to everyday use, explore how each layer of protection works.
01 / JOURNAL
Browse the journal godusevpn adapter-level IPv6 protection: privacy that reaches into the system
Explore godusevpn’s physical-adapter IPv6 controls and five coordinated layers across DNS, fake-ip, the core and TUN, bringing desktop privacy protection into the system.
Read article 02 / JOURNALgodusevpn’s Global-mode direct-traffic guard and automatic recovery
See how godusevpn coordinates its Global-mode guard, system protection, core rebuilding and retry backoff to handle connection gaps and make recovery visible.
Read article 03 / JOURNALDoH and fake-ip in godusevpn: coordinated DNS, routing and protection
Learn how godusevpn brings encrypted DoH, IPv4 fake-ip mapping, TUN and routing together into a clear path from a domain query to its connection.
Read article 04 / JOURNALOpen, verifiable and maintained: privacy for everyday use with godusevpn
From GPL-3.0 source and verified updates to redacted diagnostics, discover how godusevpn combines cross-platform connections, system protection and ongoing maintenance.
Read articleChoose your device. Get the right package.
Your next connection
starts here.
v0.7.15Stable release · 7 Oct 2026
For 64-bit Windows PCs with Intel or AMD processors. The standard installer downloads the WebView2 runtime if it is missing.
godusevpn-0.7.15-windows-x64-setup.exe
Download for Windows
Install in three steps
Trust prompts and install commands
View the official script
Already downloaded and extracted? Install locally
Device and installation requirementsWindows 10 1809 (build 17763) or later, including Windows 11. Installation requires administrator rights.
Package and platform notes
Unsure of the architecture? Check System type in Windows settings, then choose x64 or ARM64. The offline installer includes the WebView2 runtime.All installersContact and support
Support development
TRON / TRC20—