A system-level defence beyond the tunnel
When the direct-traffic guard is enabled, Global mode is active and you still want to connect, godusevpn restricts traffic outside the tunnel. Ordinary application traffic follows tunnel policy and waits during core rebuilding. This adds a system-side defence during connection gaps, reducing opportunities for applications to bypass an unavailable proxy.
Node connections, loopback traffic, permitted LAN access and essential subscription-update fallback each retain explicit rules. The guard supports the complete connection process: constraining ordinary bypass attempts while preserving necessary paths for reaching nodes, maintaining the connection and accessing allowed local resources.
Recovery continues after the core exits
An unexpected core exit does not make the background service forget your choice to remain connected. Recovery detects the failure, prepares a new configuration, validates it before startup and retries with backoff. Once the core is rebuilt, it checks TUN and the relevant protections again, working towards a usable connection.
Backoff avoids hammering the system with repeated failed starts. Configuration validation catches some problems before startup. Users do not need to keep pressing Connect: visible progress shows which part of recovery is underway, leaving more attention for the task that needed a connection in the first place.
Repair the connection that is actually failing
Sometimes the core is running while application requests repeatedly fail. For the relevant Hysteria2 and TUIC sessions, godusevpn uses application-failure signals to attempt a new session with the same node, followed by health checks. This targets a stuck connection state rather than assuming a running process means traffic is healthy.
Subscription updates also respect existing connections. If the current proxy cannot fetch an update, the client tries the Auto group, then an essential direct fallback for that update request. Unchanged nodes retain their connection where possible. The update exception does not switch other applications to direct access.
Clear status and an independent recovery route
Incomplete protection can produce a degraded protection state and an explicit warning while repairs continue where possible. System capabilities and startup timing affect the result. godusevpn exposes these conditions, so an available connection button does not have to stand in for a complete picture of protection.
When you need to restore system networking deliberately, the independent recovery entry provides a route even if the service cannot start. The user initiates the action, which releases the relevant protections and restores network settings through its recovery process. Automatic retries, visible warnings and deliberate recovery work together.