Network settings

Network settings live on the Connection page (Settings → Connection). Letakof reads them when it starts the connection. If you change one while the VPN is on, a banner appears: Changes have not been applied to the running VPN with an Apply now (reconnect) button.

Windows and macOS share the same options. Android has no operating-mode choice, because it always works as a system VPN service. Differences are marked in each section.

Routing mode (Windows, macOS)

How Letakof connects your computer to the network. This is the operating mode; the Mode menu on the Proxies page is a different thing. You cannot change it while connected; disconnect first. The new mode applies to the next connection. See Operating modes for the details of each one.

Value	Default	What it does
System proxy	Yes	Turns on the system proxy (HTTP, HTTPS and SOCKS). Programs that ignore the system proxy connect directly.
TUN		A virtual network adapter that captures all traffic. Needs administrator rights.
Local proxy		The core listens on 127.0.0.1 only and does not change system settings. You enter the address in each program. Setting: Port, default 7890, allowed range 1024–65535.

Kill switch (TUN only)

Setting	Default	Platform
Block traffic if the VPN drops	Off	Windows, macOS

While TUN is connected, everything that does not go through the tunnel is blocked, except the home network. On Windows it uses Windows Firewall rules; on macOS it uses a pf anchor. Blocking is removed when you disconnect normally. If the app stops unexpectedly, use Remove block now (Windows) or Remove block (macOS, asks for the administrator password).

On iPhone the counterpart is System protection; see iPhone settings. On Android Letakof cannot block traffic by itself. Block traffic without VPN shows the state of the system options Always-on VPN and Block connections without VPN and opens the Android VPN settings, where you turn them on.

Traffic

Setting	Default	Options
IPv6	On	When off, IPv6 is disabled in the core and in DNS. Apps get IPv4 only; the tunnel’s IPv6 route stays in place, so nothing leaks.
DNS	System	See below.

DNS

Option	What it does
System (default)	Uses the DNS servers of the network you are currently on. On Android they update on the fly when you move between Wi-Fi and mobile data.
DoH	DNS over HTTPS to 1.1.1.1, 8.8.8.8 and 77.88.8.8 in parallel.
Custom	Your own servers, one per line (up to 8 on Windows and macOS). An IP, IP:port, or a udp://, tcp://, tls://, https:// or quic:// address. An empty list means System. On Android you pick the type (UDP, TCP, DoT, DoH, DoQ) and can add servers from presets.
From profile	Uses the DNS section of your subscription. On Android, if the subscription has none, System is used.

Server names from your subscription are always resolved with the system DNS.

Proxy for network devices

Setting	Default	Platform
Proxy for network devices	Off	Windows, macOS
Share proxy on LAN	Off	Android (phone)

Opens an HTTP and SOCKS5 proxy (TCP only) on all addresses of your device so that other devices on your network can use your connection. Access needs a password: the username is letakof, the password is generated once and shown in settings (you can show, hide and copy it). Only this computer and private networks (10.x, 172.16–31.x, 192.168.x) are accepted. It works while the VPN is on.

The port is 7890 by default and configurable (1024–65535, it must differ from the local proxy port) on Windows and macOS. On Android it is fixed at 7890. A Wi-Fi network with client isolation blocks access. On first use Windows may ask for a firewall permission for private networks.

Latency test

HTTP 204 service is the address the core requests through each server to measure delay. It is also applied to the automatic groups of your profile, replacing the address from the subscription.

Option	Address	Default
GStatic	https://www.gstatic.com/generate_204	Yes
Google	https://www.google.com/generate_204
Cloudflare	https://cp.cloudflare.com/generate_204

Other addresses cannot be entered.

GEO databases

The files that rules such as GEOIP, GEOSITE and IP-ASN need. Each one shows its size and age and has a download button; Update all downloads everything.

Setting	Default	Notes
ASN	GeoLite2-ASN.mmdb from the MetaCubeX meta-rules-dat release
GeoIP, GeoSite	No address	The address comes from the geox-url section of the profile, or you enter it in File URL (https://…).
Auto-update	Off	Once a week, updates only the files already downloaded.

Files are read at the next connection. On Android phones and iPhone, when the provider enables Whitelist mode, there are two more files for it: Allowed domains (WLD) and Allowed IP addresses (WLI).

Android only

App routing

Option	Meaning
All (default)	All apps go through the VPN.
Only selected	Only the checked apps go through the VPN. At least one app must be checked to connect.
Except selected	Checked apps connect directly.

Applies at the next connection.

Autoconnect and network scenarios (phone)

Turn on Enable network scenarios (off by default) to choose what Letakof does depending on the network. A scenario has a condition (Any Wi-Fi, Specific Wi-Fi by exact name, or Mobile network), an action (Connect, Disconnect, Leave connection unchanged) and, for Connect, a mode (Keep manual mode, Rules, Global, Whitelist if available, or Direct). The first matching scenario wins; Other networks applies when none matches. While scenarios are on, a background service with a permanent notification watches the network.

A scenario for a specific Wi-Fi needs the precise location permission and location turned on, because Android only reveals the network name that way. Letakof does not read your coordinates.

Background operation (phone)

Unrestricted battery use and Autostart open the system or manufacturer screens that stop Android from closing Letakof in the background. Letakof does not start the VPN by itself when the phone boots.