Tunnel Network Routing
Decide which Apple traffic categories enter the Tunna VPN tunnel, including private subnets, cellular services, push, and IPv6.
Use this page when local networks, Apple service traffic, cellular behavior, nearby-device communication, or IPv6 should be allowed or kept outside Tunna.
Network Routing controls
Turn a control on when you want that traffic category to enter the VPN tunnel. Leave it off when that traffic should stay outside Tunna and go direct.
Use these cards as a map of the visible labels in this view. Each card names one field, control, or status item and explains what it is for before you change it or rely on it.
Visible choices
These are controls, states, or measurements in the view. Read them as reference, not as feature claims.
Private Subnets
Available in this section by default. Turn on when local routers, printers, NAS, or home services should enter the tunnel. Leave off for normal direct local access.
Push Notification Service
Shown on iOS 16.4 and later when Apple exposes the control. Turn on only when Apple push notification traffic should enter the tunnel. Leave off for the quieter reliability default.
Cellular Services
Shown on iOS 16.4 and later when Apple exposes the control. Turn on only when carrier service traffic should enter the tunnel. Leave off when mobile behavior is sensitive.
Device Communications
Shown on iOS 17.4 and later when Apple exposes the control. Turn on only when Apple device-to-device communication should enter the tunnel. Leave off for normal nearby-device behavior.
Enable IPv6 only when the route plan is ready
If sites behave inconsistently after enabling IPv6, test again with IPv6 disabled. Your network, provider, and rules all need to support the path you expect.