Privacy VPN
Send ordinary client traffic through a VPN you control or subscribe to. MintFlow does not supply VPN servers.
Configure a WireGuard output
Import a WireGuard configuration from Files/iCloud, scan a provider-supplied QR code, or create an interface using your own server's settings. Use credentials from your provider; do not share private keys.
On Home, choose Simple Mode and select that WireGuard VPN as the output. Configure its VPN DNS under DNS & Routing. Prefer the DNS addresses supplied by your VPN provider; public DNS addresses are also possible if reachable through the selected output.
Simple Mode keeps MintFlow DNS running. For an explicit Rules Mode setup, enable App Routing, configure VPN DNS, and use a default route and DNS fallback pointing to the VPN. Encrypted VPN DNS upstreams with domain names additionally require the VPN-DNS-SERVER-DOMAINS rule described in the profile reference.
Save, inspect compilation diagnostics, and start or restart VPN.
Expected result
Matching client traffic uses the selected VPN output, not Direct. Verify the observed public IP and DNS behavior on a real device. An IPv4 default route alone is not a guarantee about IPv6 or traffic excluded by Apple's tunnel settings.
If the remote network overlaps private LAN ranges, do not enable LAN exclusion. See architecture.