Keep local mode separate from downstream policy
The Devices page Rule / Global / Direct switch affects only new Mac connections that enter OpenSurge through TUN or the local mixed-port. It does not change mihomo's top-level rule mode, DHCP/DNS, a downstream device selector, or an already established connection.
Loopback, LAN/private, link-local, CGNAT, and multicast destinations stay DIRECT before the mode overlay so selecting a remote exit does not remove the local management path.
- Rule continues through the imported or managed gateway rules.
- Global sends Mac-local TCP through its dedicated hidden selector.
- Direct sends matching Mac-local traffic to DIRECT.
- If Global cannot confirm UDP support, Mac-local UDP fails closed with REJECT instead of silently falling through.
Enable system-proxy coordination only for its compatibility case
The local mode switch does not modify System Settings → Network → Proxies. If SafeDNS, DNS Proxy, a content filter, or another Network Extension breaks local-Mac DNS or connectivity under TUN alone, the separate Mac local system-proxy coordination option can temporarily point HTTP and HTTPS at 127.0.0.1:<mixed-port>.
The option requires TUN and remains off by default. It affects only Mac apps that honor HTTP/HTTPS system proxy settings; it does not own SOCKS, PAC, auto-discovery, bypass domains, downstream traffic, or traffic that never enters OpenSurge.
Understand the fail-closed ownership contract
Before changing the host, OpenSurge resolves the current upstream network service, rejects active HTTP/HTTPS proxy, PAC, auto-discovery, or authenticated-proxy conflicts, and saves the original HTTP/HTTPS state. It writes the temporary proxy only after mihomo/TUN and the gateway services are ready.
Stop restores the snapshot before stopping mihomo. Startup rollback, a failed mihomo replacement, and interrupted-runtime reconciliation follow the same ordering. Manual HTTP/HTTPS changes made during the takeover are replaced by the saved snapshot on recovery, so do not use this switch as a general proxy-settings editor.
# Replace Wi-Fi if the upstream network service uses another name.
networksetup -getwebproxy "Wi-Fi"
networksetup -getsecurewebproxy "Wi-Fi"
networksetup -getautoproxyurl "Wi-Fi"
networksetup -getproxyautodiscovery "Wi-Fi"Verify with fresh connections and a stop check
After changing Rule, Global, or Direct, start a new request and use Connectivity or Connections to inspect the matched rule and actual outbound. The Control Service connectivity probe is Mac-local mixed-port evidence, not proof of a downstream-device path.
When testing system-proxy coordination, record the pre-start HTTP/HTTPS state, reproduce the TUN-only application failure, enable the option, verify the target application, then stop OpenSurge and confirm the original proxy state was restored. A normal TUN test with the switch off does not prove the compatibility case.
FAQ
Questions people ask before changing the network
Does Global mode send every device through one node?
No. It is global only for qualifying Mac-local traffic. Downstream devices continue through their own device policy or gateway rules.
Should system-proxy coordination always be enabled with TUN?
No. Leave it off unless a Mac application that honors HTTP/HTTPS proxy settings is affected by a known TUN-only or Network Extension conflict.
Why can startup be rejected before anything changes?
OpenSurge refuses to overwrite active HTTP/HTTPS proxy, PAC, auto-discovery, or authenticated-proxy state because it cannot safely claim ownership of those settings.