Routing
Decide what Tunna proxies, sends direct, or blocks.
Updated
Routing is Tunna's traffic decision screen and one of the app's main strengths. The Default Route segmented picker handles anything that no rule matches and has three choices: Proxy, Freedom, and Blackhole. Proxy uses the currently selected outbound node. Rules are checked from top to bottom, paused rules are skipped, and the first matching rule wins.
Main Routing view controls
The Routing screen is intentionally short: choose the fallback, then maintain the ordered Rule Set below it.
Default Route
The segmented picker shows Proxy, Freedom, and Blackhole. Changing it saves immediately, so there is no separate Apply button for the fallback choice.
Rule Set
Existing rules appear below Default Route. Each row shows the rule name, its outbound choice, and an attribute count so you can scan how specific it is.
Empty state
When there are no rules, Tunna shows No Rules Available with a pencil control for the first New Rule and a clipboard control for pasteboard import.
Plus menu
The plus menu offers New Rule and Paste. Paste can process shared rule links, ordinary subscription URLs, and pasted rule data, then opens Resources when review is needed.
Route outcomes
Use this comparison when choosing the default route or a rule outcome.
| Outcome | Meaning | Use for |
|---|---|---|
| Proxy | Send traffic through the currently selected outbound node. | Normal full-tunnel use or selected traffic that must use the provider node. |
| Freedom | Send traffic directly without using the selected proxy node. | Trusted destinations, local services, or websites that should bypass the proxy. |
| Blackhole | Drop matching traffic. | Blocking unwanted domains, networks, ports, or categories. |
How Tunna decides
Default Route is the fallback
Changing Default Route saves immediately. It does not move, pause, or rewrite your rules. It only decides what happens after Tunna reaches the end of the unpaused rule list without a match.
Many route edits are meant for a live workflow
Tunna is designed for changing node choices, rules, and route plans without making a manual tunnel restart the normal workflow. Still change one thing at a time: a bad node profile, broken asset, or conflicting rule can still make the tunnel reconnect or fail.
Common routing plans
Everything through proxy
A simple full-tunnel plan.
Good fit You want Tunna to proxy normal traffic unless a rule says otherwise.
Not ideal You only want a few selected destinations to use the provider node.
Only selected sites through proxy
A split plan with direct traffic as the default.
Good fit You only need the proxy for specific websites, assets, or networks.
Not ideal You expect all apps and sites to use the provider node automatically.
Block unwanted traffic
A blocking plan using Blackhole rules.
Good fit You want to drop trackers, categories, ports, or known destinations.
Not ideal You are not sure the rule is narrow enough to test safely.
Rule priority and quick actions
Reorder rules
Drag rules into priority order. The new order saves, and the topmost matching unpaused rule takes the traffic decision.
Pause without deleting
Swipe from the leading edge to Pause an active rule or Unpause a paused one. Paused rules stay visible but do not match traffic.
Share or delete
Swipe from the trailing edge to Share a rule link or Delete the rule. Shared rule links can include asset source information for review in Resources.
On-Demand depends on eligible routing material
On-Demand lives in Tunnel settings, but its useful wake triggers come from Routing. Use unpaused Proxy rules with ordinary domain entries or usable GeoSite records when you want Apple to start Tunna for specific destinations. Default Route, Freedom, Blackhole, IP, port, TCP, UDP, application-protocol, paused, and GeoIP-only rules still help route traffic after the tunnel is running, but they should not be treated as wake triggers.
Direct tunnel traffic is still tunnel traffic
Freedom means traffic does not use the selected proxy node. It can still travel through the system VPN tunnel. Add Proxy rules for destinations that must use the selected outbound.