What's configured where
SMProxy has two independent layers of configuration — don't confuse them. The provider's configuration always owns routing, chains, balancers and DNS rules. App settings only adjust how the client behaves around that configuration.
Connection
Run mode — VPN or proxy only
Proxy-only mode is useful when another VPN or an MDM profile already owns the system VPN slot, or when only one application should be routed. It requires SOCKS or HTTP (below) to be enabled — otherwise the app refuses to start with an explanatory message rather than showing a misleading “connected” state.
Other connection settings
MTU
1280 · 1280–1500Leave at the default unless you have a reason to change it. Higher isn't automatically better: at 1500, large downloads can stall completely on some networks, because oversized packets are silently dropped rather than fragmented.
Preferred IP type
autoauto / ipv4 / ipv6. On auto the app routes IPv6 into the tunnel only when the device genuinely has IPv6 upstream — advertising IPv6 with no real upstream makes apps prefer AAAA records and then fail on anything routed directly.
Kill switch
offWhen enabled, disconnecting is blocked while the tunnel is active, so traffic can't silently fall back to the open network.
Silent reconnect
onRestores the connection after an unexpected drop, without notifications (still written to the connection log). An explicit Connect always takes over the VPN slot even from another VPN app; a silent reconnect deliberately does not — if another VPN took the slot, SMProxy stands down.
Auto-connect
offConnects to the last used server when the app starts. Separate switches connect automatically on Wi-Fi or mobile data — see section 03d.
Launch at boot / login
offOn Windows this requires the signed build (section 06). Not available on iOS and tvOS — the system doesn't permit apps to launch themselves.
“The server is not answering the handshake”
When a WireGuard or AmneziaWG tunnel is up but the server stays silent, the main screen shows a banner: “The server is not answering the handshake — still retrying. If it never connects, contact your provider: keys, Endpoint and AmneziaWG parameters must match the server.”
- •Appears about 20–30 seconds after connecting; the app keeps retrying in the background.
- •Disappears on its own as soon as real traffic starts flowing, on disconnect, or when you switch servers.
- •The check is passive: the app reads its own traffic counters and never sends probe requests.
- •If the banner never goes away, the config does not match the server — wrong keys, Endpoint, or AmneziaWG obfuscation parameters (
S1/S2,H1–H4,Jc…). Ask your provider for a corrected config.
Local proxy
All platforms. Both proxies listen on 127.0.0.1 only — never on the local network.
Ports are configurable and persist when the proxy is toggled off. Defaults sit outside the 10808–10810 range on purpose, because subscription configs commonly use those ports for internal chain hops — a collision would silently drop the inbound. On Apple platforms these proxies exist only while the tunnel is connected.
DNS
All platforms. These live in their own DNS section in Settings — they apply in ordinary VPN mode too, not only when the local proxy is in use.
Local DNS
off · port 10853Resolves DNS inside the tunnel instead of through the system resolver. A subscription's own DNS section always takes precedence.
DNS leak protection
onCaptures every DNS query the OS or an app makes (ports 53 and 853) into the tunnel, so lookups can't slip out to your ISP's resolver over the physical connection. Leave it on unless a specific setup needs the system resolver reachable directly.
DNS-over-HTTPS (DoH)
offResolves DNS over an encrypted HTTPS connection (dnsforge.de by default) instead of plaintext UDP, so the network can't read or tamper with your lookups. You can point it at any DoH endpoint; the query goes through the tunnel, not the physical network. A subscription's own DNS section always takes precedence; a provider can also enable DoH via a subscription header, and your toggle overrides it locally.
Fallback DoH resolvers
offIf the resolver your provider specified doesn't answer, the address is looked up through a small built-in list of resolvers instead (dnsforge.de, 42l.fr, ffmuc.net and others — all known to work with the app). Off by default: with it off, a resolver that doesn't answer simply falls back to your system DNS.
Turn it on if your network blocks the resolver your provider uses.
s-resolve header → the RemoteDNSDomain field of the active routing profile → your own setting → the built-in fallback list (if enabled) → your system DNS.Subscriptions
All platforms.
A subscription is also refreshed regardless of these settings when it looks expired, so a renewal on the provider's side is picked up rather than reported as “expired”.
Netflix / streaming instead of VLESS | TCP | Reality). This only appears for subscriptions whose provider is active.
Split routing
Decide what actually goes through the tunnel and what goes straight out — by address, and on Android by app. Both lists work the same way: the list itself is just a list, and a mode decides what it means.
By address
Add domains, IP addresses and subnets (one field takes both a single address like 1.2.3.4 and a subnet like 10.0.0.0/8), then pick a mode:
The default matches how the old exclusion list behaved, so nothing changes for existing users after an update.
*.example.com is treated as literal text and simply never matches. To cover a domain together with its subdomains, write domain:example.com.
How domain entries match
example.comdomain:example.comfull:example.comregexp:…By app
Choose which apps use the tunnel and which go around it, with the same three modes:
The picker shows each app's icon, name and package name, with search and a “show system apps” toggle — user apps only by default, system apps marked with an asterisk. On iOS, Mac and Windows, routing by address covers the same need using addresses instead of apps.
Quick toggle
Turn the tunnel on and off without opening the app. On both platforms you add the control yourself, once.
Quick Settings tile
A tile in the notification shade: swipe down and tap to connect or disconnect. It shows the current state, and you never leave the app you're in. The tile doesn't appear on its own — add it once by editing your shade.
Widget
A widget with a single button, on the home screen or in Control Centre. Tap to connect or disconnect without opening the app. Connect from the app at least once first — that's when iOS asks permission for the VPN profile. The widget's state can lag a second or two behind.
Connect automatically on Wi-Fi or mobile
Two switches in settings — “on Wi-Fi” and “on mobile data”. Turn on the ones you want, and the VPN comes up by itself in those networks and goes down in the rest. Disconnecting by hand is always respected: the tunnel stays down until the network changes or you connect again yourself.
Using another VPN alongside SMProxy? On iOS the rules belong to the system, so if you connect a different VPN while SMProxy isn't running, a network change can hand the slot back to SMProxy. Turn these switches off if you rely on another VPN.
Routing profiles
A routing profile is a complete rule set — what goes straight out, what goes through the tunnel and what is blocked, plus optional DNS. Where the routing rules above are a short list of addresses you keep by hand, a profile is a ready-made set, usually supplied by your provider.
Where profiles come from. You import one by a link (from a message or a QR code), or it arrives with your subscription. A profile is only added to the list — switching it on stays your decision.
Choosing one. Settings → Routing → Routing profiles: pick a profile, or Off to use none. A profile marked ↻ updates itself from its source on its own schedule.
Per subscription. A subscription can use its own profile regardless of the global choice — set it while editing that subscription:
The routing rules above keep working independently of profiles. The profile format and how providers hand them out are in the developer docs → routing profiles.
Censorship bypass
TLS fragmentation
Splits the TLS handshake so DPI systems can't match the SNI in a single packet. A provider can also drive it for its own users via a subscription header, and that value wins over your toggle — including when the provider turns it off. Your toggle applies only when the provider sends nothing. Defaults suit most blocking setups — change them only if a specific network needs it.
packetslengthintervalmaxSplitFull technical reference and the provider-side header are in the developer docs → TLS fragmentation.
Noise packets
Sends junk data before the handshake so DPI can't recognise the start of the connection. Works alongside fragmentation — the two share the same egress and don't conflict.
TypePacketDelayServer address over DoH
Looks up the server's address over HTTPS before connecting. Use it where the local DNS returns a forged answer for the server's domain — without it the app would get a wrong address and never connect.
DoH resolverResolver IPIf the resolver doesn't answer within a second and a half the normal lookup is used — the setting can only help, never block a connection. The provider's setting takes precedence over yours.
Multiplexing
Multiplexing carries several logical connections over one physical connection to the server. It can reduce handshake overhead, but it is not automatically better — leave both toggles off unless you have a reason.
Mux
XMUX
On any transport other than XHTTP it does nothing.
If the subscription specifies its own multiplexing settings, those always take precedence over these toggles.
Privacy, data & appearance
Diagnostics
off · opt-inApple platforms ask for consent before sending any diagnostic check-in. This gate is intentionally Apple-only, to satisfy App Store requirements.
Traffic statistics
offCounts uploaded/downloaded bytes locally. Nothing is transmitted.
Signature check
offRequires subscriptions to carry a valid provider signature; unsigned subscriptions are rejected.
Logs
Grouped into tabs — connections, subscriptions and statistics (plus per-connection core logs) — each viewable, copyable and clearable in the app. Trimmed automatically (oldest first) and never grow without bound. Nothing is uploaded.
Theme
SystemSystem (default), light, or dark.
Language
Russian and English. Follows the system language and can be changed in-app; the interface updates immediately.
Reset
Removes every subscription, setting and log, returning the app to a freshly installed state.
Log actions
Every individual log has its own actions, so you don't have to wipe everything to get rid of one entry.
Sharing sends a file rather than pasted text, so long logs arrive as an attachment instead of an unreadable wall of text. Logs are shared only when you choose to — the app never sends them anywhere on its own.
System requirements
- •Windows installs a TUN driver and therefore requires administrator rights during installation.
- •Windows 7, 8 and 8.1 are not supported, nor is 32-bit Windows. The app is built on Electron 33, which runs only on Windows 10 and newer, 64-bit; on an older or 32-bit system the executable is not even recognised as a Windows application. From desktop build 202 the installer checks this first and stops with a clear message instead of installing a copy that cannot start.
- •Linux packages install a small root helper service, so connecting doesn't prompt for a password every time. Proxy-only mode needs no root at all.
- •Android requires the system VPN permission, granted once on first connect. Devices with aggressive battery management may need SMProxy excluded from optimisation for the tunnel to survive long background periods; the always-on option makes this more robust.