Learn how to set up Tunna, import provider profiles, choose proxy nodes, build routing rules, and troubleshoot the Apple VPN tunnel.

June 2, 2026 1138 words 6 min

Tunna is a proxy tunnel app for iPhone, iPad, and Mac. It is built around Xray-powered, V2Ray-compatible profiles, but the manual uses everyday language first: bring your own provider profile or server details, choose a node, decide what traffic should use it, and start the Apple Network Extension tunnel.

Before using the manual

A working setup starts with provider or server material. Tunna does not sell servers, accounts, or subscriptions.

Have a node link, QR code, subscription URL, provider profile, or manual server details ready.
Keep protocol, transport, security, address, port, and credential values together from the same provider profile.
Use one selected node and simple routing for the first test before adding automation.
Treat node links, subscription URLs, Reality keys, UUIDs, and passwords as private credentials.

How the manual is organized

Use these areas together. Outbound proves the node, Routing decides traffic outcomes, and Settings controls tunnel behavior.

Outbound

Add local nodes, scan QR codes, paste provider links, maintain subscriptions, read latency, and select the node Proxy uses.

Routing

Build ordered rules for domains, IP ranges, ports, TCP or UDP, HTTP or TLS, and GeoSite or GeoIP assets.

Tunnel Settings

Control manual Power, Always On, On-Demand, trusted networks, IPv6, and what enters the Apple VPN tunnel.

Troubleshooting

Work from symptoms such as a failed start, wrong route, stale subscription, missing asset, quiet log, or stuck VPN entry.

Everyday workflow

Use this order when you are setting up a profile, testing it, and then adding more automation.

Add or import material

Start in Outbound for nodes and subscriptions, or paste shared routing material from Routing. If Resources appears, review it before saving.
Pick a working node

Let RTT checks run, compare latency or stats, choose a node manually, or use ZAP after checks have enough recent results.
Choose routing behavior

Set the Default Route, then add specific rules for destinations that should use Proxy, Freedom, Blackhole, or one selected node.
Automate only after testing

Keep startup manual until the node and route plan work, then enable On-Demand or trusted networks if they match your use case.

Routing

Routing is Tunna's traffic decision screen and one of the app's main strengths. The Default Route segmented picker handles anything that no rule matches and has three choices: Proxy, Freedom, and Blackhole. Proxy uses the currently selected outbound node. Rules are checked from top to bottom, paused rules are skipped, and the first matching rule wins.

Tunnel and Routing are two different decisions

Tunnel settings control the Apple VPN tunnel lifecycle. They are separate from Routing. Tunnel settings decide what enters the VPN tunnel; Routing decides whether matching traffic uses Proxy, Freedom, or Blackhole after it is inside Tunna. On-Demand and sleep behavior are where Tunna's automation and battery-aware design meet Apple's Network Extension system.

Subscriptions

A subscription is a provider profile that can contain many nodes and optional profile information. Tunna fetches the profile, processes the nodes, and shows them in Outbound under that subscription. This is how Tunna keeps managed node lists usable without asking you to edit every server by hand.

Assets

Assets are reusable lists of destination records. GeoSite records describe domain groups. GeoIP records describe IP ranges. After adding assets, the Rule editor can search their records and attach them to routing rules.

Route outcomes

Use this comparison when choosing the default route or a rule outcome.

Outcome	Meaning	Use for
Proxy	Send traffic through the currently selected outbound node.	Normal full-tunnel use or selected traffic that must use the provider node.
Freedom	Send traffic directly without using the selected proxy node.	Trusted destinations, local services, or websites that should bypass the proxy.
Blackhole	Drop matching traffic.	Blocking unwanted domains, networks, ports, or categories.

Connection lifecycle choices

Never

Tunna connects only when you start it manually.

Good fit You are testing, diagnosing, or only use the tunnel sometimes.

Not ideal You expect Tunna to reconnect automatically after network changes.

Always On

Tunna tries to keep the tunnel connected.

Good fit You want the tunnel to return after wake or interruption.

Not ideal You are still proving a node works.

On-Demand

The system can start the tunnel when Apple evaluates a matched domain from eligible routing material. Tunna refreshes these Apple On-Demand rules when routing changes. On mobile devices, Apple's On-Demand behavior can also cause tunnel failures and restarts; if that happens, return to manual start, prove the node, then re-enable On-Demand only for a stable domain-triggered plan.

Good fit Your unpaused Proxy rules include ordinary host, base, or full domain entries, or non-RegEx GeoSite records that Tunna can give to the system.

Not ideal Your plan relies on Default Route, RegEx patterns, short keywords, IP ranges, ports, TCP or UDP rules, application-protocol rules, direct rules, or drop rules; those are not reliable wake triggers.

Before pressing power

At least one local node or subscription node is visible in Outbound.
The node details still match the provider profile: protocol, transport, security, address, port, and credentials.
The Default Route is simple for the first test, usually Proxy.
The current network is available if a subscription or asset must update first.
Trusted Networks will not immediately stop the tunnel on the Wi-Fi or cellular network you are using.

Network Extension is the system tunnel entry

Apple shows Tunna as a VPN because the app uses Network Extension to receive traffic. That system entry only decides whether traffic can enter Tunna; your Routing rules still decide whether the traffic is proxied, sent direct, or blocked.

What a fetch updates

During a fetch, Tunna sends the selected User Agent, downloads the provider profile, reads provider metadata when available, then parses node links from the response. If no usable nodes are found, the subscription is marked failed. When a provider sends metadata, Tunna can update usage, expiry, profile link, support link, profile title, and profile update interval.

Troubleshooting

Use this page as a run book. Start with one known node and simple routing, make one clean attempt, then read the newest facts Tunna gives you. Most problems come from the selected node, the route plan, the Apple Network Extension, provider updates, assets, imports, or logs that are too quiet.

Plain language with technical terms when they matter

The manual explains user-visible Tunna behavior first, then names the technical terms you may see in provider profiles, including VLESS, VMess, Trojan, Shadowsocks, Xray, routing rules, GeoSite, GeoIP, TLS, REALITY, and Network Extension.