Operating modes

The operating mode (Routing mode in settings) sets how traffic reaches the Mihomo core. It is separate from the Mode menu on Proxies, which sets how rules apply.

Windows and macOS

Choose the mode with the chip under the power button, or in Settings → Connection → Routing mode. You cannot change it while connected; the new mode applies at the next connection.

Mode	What it does
System proxy (default)	Turns on the system proxy (HTTP, HTTPS, SOCKS); the core listens on 127.0.0.1 on a random free port. No password or administrator rights. Your previous proxy settings return when you disconnect, and after a crash. Programs that ignore the system proxy connect directly.
TUN	A virtual adapter that captures all traffic. Windows: the installed version uses a helper service, so there is no prompt each time; the portable build asks for administrator permission on every connection. macOS: asks for your administrator password on every connection. Allows the kill switch.
Local proxy	The core listens on 127.0.0.1 at your port (default 7890) and changes nothing in the system. Enter 127.0.0.1:<port> as an HTTP or SOCKS5 proxy in the programs you want.

To share the connection with other devices on your network, use Proxy for network devices in Network settings.

iPhone

There is one way to connect: a system VPN. iOS asks for your consent the first time. For a kill switch see System protection in iPhone settings.

Android

There is no choice: Letakof is always a system VPN service. Android asks for your consent the first time, and all traffic goes through the tunnel except apps you excluded in App routing. Android TV works the same way.

Mode menu (all platforms)

Mode	What it does
Rules	Connections follow your subscription’s rules and your custom rules.
Global	Everything goes through the selected proxy group.
Direct	Everything goes directly, without a server.
Whitelist	Android phones and iPhone (called Allowlist there), only when the provider sends letakof-wl: enable. A provider can also disable it on Wi-Fi. Everything goes through the selected server except addresses from the Allowed domains and Allowed IP addresses files, which connect directly.