# Use Proton VPN or Windscribe WireGuard configs with MintFlow and secure DNS

Canonical: https://galaxnet.dev/mintflow/articles/wireguard-provider-secure-dns/
Language: en-US

Import Proton VPN or Windscribe WireGuard configs on iPhone and iPad with MintFlow, then set up DNS over HTTPS (DoH) or DNS over TLS (DoT).







Bring a provider's WireGuard connection into MintFlow, then choose your own encrypted DNS resolver and routing rules. MintFlow does not sell VPN servers; you need a provider account with access to WireGuard configurations.

## Download a configuration

**Proton VPN:** sign in to your account, open **Downloads → WireGuard configuration**, name the configuration, choose a platform, options, and server, then create and download the `.conf` file. Available servers/options depend on your plan. Follow [Proton's official instructions](https://protonvpn.com/support/wireguard-configurations).

**Windscribe:** sign in and open **My Account → Config Generator → WireGuard**. Choose a location, port, and key pair, then download. Manual configs require a paid account; Build-a-Plan access is limited to paid locations. See [Windscribe's official instructions](https://windscribe.com/knowledge-base/articles/where-do-i-access-my-wireguard-configs).

The file contains a private key. Keep it private and generate a separate configuration for another device when the provider requires it.

## Import into MintFlow

1. Select the intended MintFlow profile. From Home's VPN controls, add **WireGuard → Import from File** and choose the downloaded `.conf`.
2. Review and save the interface and peer. Check its address, endpoint, keys, and Allowed IPs; Internet routing needs the peer to allow the destinations you intend to send.
3. Choose that interface as the traffic output. Simple Mode is convenient for one output. The Rules Mode example below gives explicit DNS and IP defaults.
4. Save, check compilation diagnostics, and start VPN. Use the in-app connection diagnostics and check your public IP; an imported definition alone does not prove traffic uses it.

## Add encrypted DNS

For Rules Mode, keep your imported VPN and peer definitions, then adapt this fragment. Replace `my-wireguard` with the actual interface name. These settings are an example using Cloudflare, not a requirement to use that resolver.

```ini
[dns]
app-routing-enabled=true
direct-dns=tls://1.1.1.1
vpn-dns=https://cloudflare-dns.com/dns-query
bootstrap-dns=1.1.1.1,8.8.8.8

[routing]
VPN-DNS-SERVER-DOMAINS,L3VPN,my-wireguard
DNS-FALLBACK,L3VPN,my-wireguard
DEFAULT,L3VPN,my-wireguard
```

`vpn-dns` uses DoH for VPN-selected names. `VPN-DNS-SERVER-DOMAINS` sends the resolver-hostname bootstrap through the chosen VPN. `DNS-FALLBACK` handles unmatched names; `DEFAULT` routes ordinary IP traffic. Review existing specific rules, which can select other paths. This is an IPv4 routing example, not a claim about all provider app features or a system-wide kill switch.

For DoT instead, set `vpn-dns=tls://1.1.1.1`; that IP-based upstream needs no resolver-hostname bootstrap. A bare `1.1.1.1` is plain DNS. Verify effective upstreams in **Tools → DNS Runtime**.

## What privacy improves?

DoH/DoT encrypts the DNS query payload between MintFlow and the selected resolver. With an independent resolver, the VPN provider does not receive those application queries as plaintext DNS, even when the encrypted connection travels through its tunnel. The resolver still receives them. [Cloudflare explains DoT encryption](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls/).

This separates DNS resolution from the VPN provider; it does not make browsing anonymous. The provider still observes destination IPs, timing, volume, and potentially hostnames from other protocol metadata. Hostname bootstrap is a separate lookup. Apps using their own DNS may behave differently.

Provider DNS filtering such as NetShield or R.O.B.E.R.T. may not apply when you replace provider DNS. You can enable [MintFlow's local ad filter](/mintflow/articles/dns-ad-blocking/) independently.

[Internal DNS](/mintflow/manual/core-components/internal-dns/) · [Routing engine](/mintflow/manual/core-components/routing-engine/)