# TUN, system proxy and kill switch

> How TUN and system proxy modes differ, why administrator rights are needed, how the kill switch works, and switching servers on the fly.

## Two modes

- **TUN** (the default): FlowLock creates a network adapter, and all of the system's traffic goes through the VPN:
  browsers, games, the terminal, apps that can't use a proxy. Administrator rights are needed: on macOS once, for the
  helper; on Windows, the service from the installer or a restart of the portable version as administrator; on Linux,
  the service or a password through `pkexec`.
- **System proxy**: FlowLock sets itself as the proxy in the system settings. No administrator rights are needed, but
  only apps that follow the system proxy go through the VPN. Command-line programs on Linux that read only
  `http_proxy` don't see it.

The local proxy port is shown in the settings, so you can point an app at it by hand. The proxy can also be shared
on your local network, with a username and password.

## Kill switch

If the core crashes, FlowLock first tries to reconnect (up to 3 times in 2 minutes). In system proxy mode the kill
switch keeps the proxy pointed at the crashed core: traffic is blocked instead of going around the VPN. You can lift
it with the “Lift the block” button (in the window or in the tray menu); it is lifted by itself when you quit
FlowLock.

## Switching on the fly

You can change the server without reconnecting: open connections move to the new server right away. The “Auto: best
ping” mode picks the fastest server by itself.

## Ping

Ping can go through the server (HTTP: a request through the server itself), or use TCP or ICMP. TCP and ICMP go to the
server directly, outside the VPN, so they show the delay to the server, not through the tunnel.