Applications must choose to use a system proxy
A system proxy supplies a proxy address or automatic configuration. How an application reads and uses it depends on that application's implementation. Browsers, system services and command-line tools can use different networking components. A program that opens its own sockets may ignore those proxy settings entirely.
The godusevpn desktop client provides a local mixed port, normally 127.0.0.1:2080, which applications supporting HTTP or SOCKS5 can use explicitly. Disabling TUN and relying on that port does not capture the whole device. It can suit a particular tool, provided you check that tool's proxy settings.
TUN captures traffic; the mode decides its route
TUN creates a virtual network interface and uses routing to send traffic into the proxy core. godusevpn enables TUN by default with automatic and strict routing, reducing bypasses caused by applications ignoring proxy settings. Desktop operation requires the relevant system privileges; Android requires VPN authorization.
TUN and Global mode are separate choices. Rule mode routes according to rules, Global mode sends ordinary external access through the proxy, and Direct mode connects directly. LAN access, the tunnel's own connections and explicit exceptions retain their particular handling. Having TUN enabled does not mean every connection uses a proxy exit.
Add the guard for strict Global operation
Capturing traffic with TUN still leaves the question of what happens during a core rebuild or an unavailable node. godusevpn's direct-connection guard applies when the option is enabled, Global mode is selected and you still intend to stay connected. System controls constrain access that would bypass the tunnel, making waiting for recovery an explicit behavior instead of silently reverting to direct access.
First confirm that the home screen reports the guard as active, then inspect routes for different applications on the Connections page. Do not simulate a failure by pressing Disconnect: that withdraws your request to stay connected and releases the guard. On Android, protection across process termination and restarts also requires the system's Always-on VPN and Block connections without VPN settings.
Check coverage with the applications you use
After connecting, visit an ordinary website, run a network tool and open an application you normally use. Inspect the process, destination and route on the Connections page or in core logs. If a connection is direct in Rule mode, check the matching rule before deciding that traffic capture has failed.
For virtual machines, check whether networking uses NAT or a bridge. A bridged guest behaves like another machine on the LAN and falls outside the host's TUN and guard coverage. godusevpn's practical advantage is bringing traffic capture, routing, DNS and protection status into one inspectable chain, making privacy settings easier to apply correctly.