GhostMesh on Linux: choosing TUN vs proxy mode
The GhostMesh Linux client (Beta) supports two connection modes with different trade-offs: TUN mode redirects the whole device's routes and DNS through the tunnel, while proxy mode changes nothing at the routing level and only serves a local SOCKS/HTTP proxy.
Quick answer
Use proxy mode if you only need specific apps or browsers tunneled and want zero routing risk. Use TUN mode if you want every process on the machine covered by default — it is guarded by an automatic rollback watchdog, but it does redirect the default route and DNS.
TUN vs proxy: what each mode actually changes
The two modes differ in blast radius, not in the underlying SRSP transport. Picking the wrong one for your setup is the most common source of Linux VPN confusion.
| Proxy mode | TUN mode | |
|---|---|---|
| Routing table | Untouched | Default route redirected through the tunnel |
| DNS | Untouched | Redirected through GhostMesh |
| Coverage | Only apps configured to use the local proxy | Every process on the device by default |
| Failure behavior | Nothing to roll back if the tunnel drops | Guarded by an automatic rollback watchdog |
| Best for | Servers, scripts, specific browsers/tools | Whole-machine coverage, routers |
Choosing between them
On a headless server or a box you administer over SSH, proxy mode is the safer default — it has nothing to roll back, so a bad config can't strand the session. Reserve TUN mode for machines where whole-device coverage is worth the extra risk, and where you have a second way to reach the box (console access, a second SSH session) the first time you enable it.
Checklist
- ✓Download the archive for your target (x86_64 or aarch64) from the Linux download page.
- ✓Verify the SHA256 checksum before running the installer.
- ✓Run the installer as root — it asks for server / SNI / UUID / REALITY key and lets you pick Proxy vs TUN.
- ✓If choosing TUN on a remotely administered box, keep a second access path open before reconnecting.
First checks after connecting
Confirm the tunnel is actually carrying traffic before relying on it, regardless of which mode you picked.
- In proxy mode, test with curl through the local proxy port and confirm the egress IP changed.
- In TUN mode, check your default route and DNS resolver point at GhostMesh, then confirm normal browsing works.
- Check for a newer Beta build any time with the CLI's update-check command before reporting an issue as a bug.
FAQ
Which mode should I use on a server I only reach over SSH?
Proxy mode. It never touches routing or DNS, so there is nothing for a misconfiguration to strand — the safer default when your only way back into the box is the connection TUN mode would redirect.
What happens if TUN mode misconfigures routing?
An automatic rollback watchdog reverts only what GhostMesh itself changed — never your prior default route — if no upstream becomes reachable within the confirm timeout. See the router/rollback watchdog guide for the full mechanism.
Does the Linux client support IPv6 in TUN mode?
Not yet in this Beta. Keep OS/browser IPv6 disabled while TUN mode is active to avoid a partial leak around the tunnel.