Technical routing explanation — not legal advice. Privacy and acceptable use are on Privacy and AUP.
Last updated: August 12, 2026
Berrynook is always secure: when you connect, your apps and browsing are routed through the VPN tunnel, other internet traffic is blocked while the tunnel comes up, and the VPN reconnects automatically if the tunnel drops unexpectedly.
No third-party VPN on iPhone or Mac can guarantee that 100% of all device traffic always goes through the tunnel. Apple’s Network Extension framework allows a small amount of system-owned traffic to use the normal network. That is an operating-system policy, not a Berrynook bug. The same limits apply to every App Store VPN.
| Mechanism | What it means for you |
|---|---|
| Full tunnel | Internet traffic from your apps is sent through the encrypted tunnel to the exit node |
| includeAllNetworks | Apple’s strongest setting: the OS routes app/internet traffic through the VPN while connected |
| Block while connecting | Other internet traffic is blocked until the tunnel is ready |
| Auto-reconnect | If the tunnel drops unexpectedly, the OS tries to bring VPN back (until you tap Disconnect) |
| Local network exclusion | LAN traffic (printers, 192.168.x.x) stays off the tunnel by design |
When VPN shows Connected, open Safari and visit a site like ifconfig.me — you should see your VPN exit IP, not your home IP (with other VPN apps quit).
These are OS-level exceptions. Berrynook cannot turn them off.
| Traffic type | May bypass? | Notes |
|---|---|---|
| Captive portal / network quality checks | Sometimes | Lets your device join Wi‑Fi and detect login pages |
| Push notifications / background system channels | In part | Some Apple channels may not use the third-party VPN tunnel |
| System updates, time sync, Apple daemons | Sometimes | Small, system-critical traffic Apple treats separately |
| Brief windows during VPN bring-up or reconnect | Sometimes | Usually seconds; Berrynook blocks user/app traffic while connecting |
This is not your full browsing history leaking — it is a narrow set of system packets defined by Apple.
| Traffic type | Bypasses VPN? | Why |
|---|---|---|
| Split-tunnel bypass rules you enabled | Yes, matching domains only | Banks, streaming, regional direct — you enabled these in Split tunneling |
| Local network (LAN) | Yes | Printers, NAS, AirPlay on same Wi‑Fi — intentional exclusion |
| Profile API (gate.berrynook.cc) | Yes, direct | Login, billing, and config fetch — required before VPN is up |
| Berryporch (meet.berrynook.cc / meet-signal.berrynook.cc) | Yes, direct | Control-plane hosts for browser calls stay reachable without forcing Meet through the tunnel |
| Berrynook Cloud (production) | No — through VPN | Private Cloud (berrynook.cc, office, signal) is reached via the tunnel |
| iOS | macOS | |
|---|---|---|
| Same Apple APIs? | Yes | Yes |
| System bypass visibility | Harder to inspect | Easier to verify in browser or terminal |
| Common issue | Stuck network after OS update; updating the app while VPN is connected | Another VPN app owning the default route — quit other VPN apps |
On both platforms, Berrynook uses Apple’s mandatory binding for app traffic while VPN is connected.
Disconnect before you update. Berrynook uses Apple’s strongest VPN binding (includeAllNetworks / always secure). When an update replaces the app, iOS stops the VPN extension. While the tunnel is down or reconnecting, the OS can block all internet — including the update download and Safari — until Berrynook is fully disconnected.
This is a known iOS Network Extension limitation for always-secure VPN apps, not a misconfigured split-tunnel rule. Apple CDN bypass presets do not avoid it.
If an update already stalled and the phone has no internet:
Technical routing explanation — not legal advice.