Components
App and profile editor
The app manages profile text, VPN/proxy definitions, routes, certificates, diagnostics, and captures. When starting VPN, it compiles the active profile into a runtime database. Compilation checks syntax and feature access; the database is an internal runtime artifact, not the normal configuration editor.
The packet tunnel can continue running when the app UI is closed, subject to Apple's NetworkExtension lifecycle.
Packet tunnel
The NetworkExtension receives traffic routed by Apple into the UTUN interface. MintFlow 2.1.0 uses these components:
- VPPRS: Rust packet processing, route selection, WireGuard/AmneziaWG, and typed stream/datagram integration.
- DNS: MintFlow DNS, encrypted upstreams, and domain-to-route hints.
- proxy: L4 protocols such as Shadowsocks, VMess, AnyTLS, VLESS, Trojan, HTTP, and SOCKS5.
- HTTP Engine: selected HTTP/HTTPS inspection, capture, URL rules, and jq/JavaScript body rewrites.
- Experimental Tailscale provider: tailnet control and transport state, integrated with MintFlow's route selection. Apple Keychain holds its device-local identity.
A Direct route sends traffic to the normal network after applicable processing; it does not require a remote server. Excluding LAN networks changes which traffic enters the tunnel in the first place.