Technical routing explanation — not legal advice. Privacy and acceptable use are on Privacy and AUP.
Last updated: October 1, 2026
Berrynook is always secure on Mac, iPhone, iPad, Windows, and Android: when you connect, your apps and browsing are routed through the encrypted VPN tunnel, other internet traffic is blocked while the tunnel comes up, and the VPN reconnects automatically if the tunnel drops unexpectedly (until you tap Disconnect).
Each platform implements always secure differently — see §5. Apple’s Network Extension has extra system-traffic limits that do not apply to Windows or Android.
In the app, open Trust and always secure for home network, WebRTC, and split tunneling, or VPN routing help for this page.
| Mechanism | What it means for you |
|---|---|
| Full tunnel | Internet traffic from your apps is sent through the encrypted tunnel to the VPN exit |
| Block while connecting | Other internet traffic is blocked until the tunnel is ready |
| Auto-reconnect | If the tunnel drops unexpectedly, Berrynook tries to bring VPN back (until you disconnect) |
| Local network (optional) | If you choose Local devices first under Trust → Home network routing, traffic to home LAN devices (printers, NAS, private ranges such as 10.x and 192.168.x) can stay off the tunnel. Stricter home network routes more home traffic through the VPN. You control this; default is Stricter home network. Tap Apply after you change it. |
When VPN shows Connected, visit a site like ifconfig.me in your browser — you should see your VPN exit IP, not your home IP (with other VPN apps quit).
While connected, Berrynook blocks QUIC / HTTP‑3 (UDP port 443) inside the tunnel so apps and browsers fall back to normal HTTPS (TCP) right away. That traffic still leaves through your VPN exit — the block happens on your device, not on the open internet.
This avoids long stalls when QUIC over the tunnel performs poorly and keeps everyday browsing on the same encrypted path as always secure. On networks that throttle UDP, fast TCP fallback helps once you are connected. Sites may load over HTTP/2 instead of HTTP/3 — that is not a leak. If the tunnel cannot connect, that is separate from QUIC to websites — see §7.
A normal IP check in the browser should show your VPN exit while Berrynook is connected. Private addresses on leak-test sites usually come from WebRTC in the browser — and with Local devices first, home Wi‑Fi routing can still expose a local address on those pages. That is not the same as your public VPN exit.
Do not confuse a private/WebRTC address with your ISP public IP. If a leak-test page shows your home or ISP public address while status is Connected, Disconnect, quit other VPN apps, reconnect Berrynook, and test again. If it still shows your ISP address, open Diagnostics.
For choices and browser guidance: Trust and always secure → Home network routing (Local devices first / Stricter home network) and Browser and WebRTC.
While connected, DNS for your apps is handled through the VPN tunnel. The Auth server (gate.berrynook.cc) stays on a direct path so sign-in, billing, and VPN settings work before and during connect.
Berrynook is tuned for IPv4 through the VPN exit. IPv6 behavior can differ by platform; on Android, Settings → VPN → Always-on VPN and Block connections without VPN for Berrynook help when IPv6 would otherwise skip the tunnel.
Some routes are by your choice in the app; others are fixed so Berrynook works while VPN is on.
| Traffic type | Bypasses VPN? | You control? | Why |
|---|---|---|---|
| Split-tunnel bypass rules you enabled | Yes, matching domains only | Yes | Banks, streaming, regional direct — you enable these in Split tunneling |
| Local network (LAN) | Yes, when you choose it | Yes | Trust → Home network routing — Local devices first vs Stricter home network; Apply after change |
Auth server (gate.berrynook.cc) | Yes, direct | No | Sign-in, billing, VPN config — required before VPN is up |
Berryporch (meet.berrynook.cc / meet-signal.berrynook.cc) | Yes, direct | No | Berryporch: same direct route as the Auth server, so guest calls work in the browser while you are on VPN; guests are not required to use the Berrynook app. |
Berrynook Cloud (berrynook.cc, office.berrynook.cc, signal.berrynook.cc) | No — through VPN | No | Private workspace hosts. Talk on Berrynook Cloud is internal to your team and uses the VPN tunnel. |
When you disconnect: VPN turns off; traffic uses Wi‑Fi or cellular until you connect again. After an unexpected drop, auto-reconnect may block traffic briefly during reconnect.
berrynook.cc, office.berrynook.cc, signal.berrynook.cc — traffic uses the VPN tunnelBerrynook uses includeAllNetworks while connected. No third-party VPN can guarantee 100% of all device traffic uses the tunnel; a small amount of system-owned traffic may use the normal network (captive portal checks, push channels, time sync, brief reconnect windows). That is OS policy, not a Berrynook bug.
| Traffic type | May bypass? | Notes |
|---|---|---|
| Captive portal / network quality checks | Sometimes | Join Wi‑Fi and detect login pages |
| Push notifications / background system channels | In part | Some Apple channels may not use the third-party VPN tunnel |
| System updates, time sync, Apple daemons | Sometimes | Small, system-critical traffic |
| Brief windows during VPN bring-up or reconnect | Sometimes | Usually seconds; Berrynook blocks user/app traffic while connecting |
Berrynook uses a strict leak lock (strict_route) while connected: traffic is not allowed outside the tunnel except intentional direct routes (Auth server, Berryporch, split-tunnel rules you enabled, and LAN when you chose Local devices first).
Always secure is the Berrynook VPN service. Strongly recommended: in Settings → VPN, turn on Always-on VPN and Block connections without VPN for Berrynook when the tunnel is down. Android does not use Windows-style strict_route.
Installing a new build while VPN is on can block all internet. You can download an update from the Berrynook website while VPN is on. Turn VPN off before you install (replace the app).
Use the in-app update flow when offered (Turn off VPN for this update) or Disconnect first. If you are stuck after an update: Force stop tunnel, confirm a browser loads a normal site, finish the update, then tap Connect — or Diagnostics → Repair steps.
Start with Diagnostics → Repair steps in the app before rebooting or reinstalling. Repair steps assume you are signed in with an active Pass.
Connected but the IP check looks wrong — Quit other VPN apps → Disconnect, then Connect → if needed Diagnostics → Repair steps (Restart tunnel or Refresh profile as shown).
VPN won’t connect, or nothing loads — Diagnostics → Repair steps → Force stop tunnel → confirm a normal site loads in the browser → Connect again. Continue down Repair steps (Restart tunnel, Refresh profile, Reset VPN profile…, Open VPN settings as shown).
Platform notes: Apple — Reset VPN profile (Advanced) only if Repair steps did not help. Android — turn off Always-on VPN / Block connections without VPN for Berrynook only if Repair steps did not help. Mac or Windows — quit other VPN apps.
Reboot if Repair steps stall.
If problems continue after Repair steps and a reboot, use the last steps shown in Diagnostics → Repair steps (they may include removing the VPN profile, restarting your device, or reinstalling Berrynook). Turn VPN off before replacing the app (see §6).
Email help@berrynook.cc with a report from Diagnostics (Copy report / contact support) if you are still stuck.
Under Account → Device options, Help fix bad entry paths sends only entry failure counts and times so Berrynook can retire paths that do not work on your network — not your browsing or location. You can turn it off in Device options. The Auth server associates reports with your signed-in account for aggregation; the report body does not include websites or DNS. See Privacy.
Example values only, not your browsing:
2.4 (35) — your app versionpilot...default — internal name for which VPN configuration Berrynook fetched from the Auth server (example only; not a website)2026-09-12T18:00:00Z — catalog revision time from the Auth server550...000 — internal entry-path id (Example only; full id is a longer internal code; not shown in the app)delay_fail — repeated slow or failed tries on that entry path3 — failures rolled into one report2026-09-26T10:05:00Z and 2026-09-26T10:12:00Z — when those failures started and ended (UTC)Not included: websites visited, DNS queries, leak-test results, entry IP addresses, mimic names, location, email, or message content.
Technical routing explanation — not legal advice.