Proxy Settings
The two service modes, the ports AI Booster listens on, TUN implementations, and what each setting actually changes — with its default.
Proxy Settings
AI Booster runs in one of two service modes. The choice decides what gets routed, and what permission the app needs to do it.
Defaults below are from the iOS and macOS clients. Other platforms expose the same concepts, but not always the same set of switches — the app in front of you is authoritative.
Proxy mode or VPN mode
| Proxy mode | VPN mode | |
|---|---|---|
| What it routes | Only apps pointed at the local proxy | Everything on the device |
| Permission needed | None | VPN / network extension approval |
| Where it changes state | System-wide proxy settings | A virtual network interface |
| Survives the app dying | Yes — see below | No |
Proxy mode starts a local listener and points the operating system's proxy settings at it. Applications that honour the system proxy — most browsers, many command-line tools — go through it. Applications that ignore it do not.
VPN mode creates a virtual interface and captures traffic at the network layer, so it covers applications that never look at a proxy setting. This is what most people want, and it is what requires the VPN permission prompt.
Proxy mode changes machine-wide settings that outlive the process. If the app is force-quit rather than disconnected, those settings are left pointing at a port with nothing behind it, and every application loses network access — with no obvious cause, because the VPN client is no longer running.
Always disconnect from inside the app. If it has already happened, turn the proxy off in your operating system's network settings.
Ports
| Setting | Default | What it is |
|---|---|---|
| Mixed port | 2334 | The local proxy. Accepts both HTTP and SOCKS on one port — this is the address you point another application at. |
| Clash API port | 36756 | The local control and statistics API the app itself reads. Not something you normally connect to. |
| Direct port | 0 | A second listener that bypasses the proxy entirely. 0 disables it. |
Both ports bind to 127.0.0.1 and are reachable only from the machine itself,
unless you enable LAN access below.
To send a specific application through AI Booster in proxy mode, point it at
127.0.0.1:2334. For example:
curl -x http://127.0.0.1:2334 https://example.comChange the mixed port if something else already holds it. The app writes the new value into the core's configuration on the next connection.
TUN settings
These apply to VPN mode.
| Setting | Default | Notes |
|---|---|---|
| Enable tunnel | On | Turning it off leaves proxy mode as the only path |
| Strict route | On | Forces traffic through the tunnel rather than letting the system pick a route around it. Turn it off only if it breaks something specific. |
| TUN implementation | mixed | mixed, system or gvisor |
| Allow LAN | Off | Lets other devices on your network use this machine's proxy |
| Bypass LAN | On | Keeps local network traffic — printers, NAS, routers — off the tunnel |
Which TUN implementation
mixed— the default, and the right answer unless you have a reason.system— uses the operating system's own stack. Can be faster; less tolerant of unusual network configurations.gvisor— a user-space network stack. The most compatible when the system path misbehaves, at some throughput cost.
If the tunnel connects but traffic behaves strangely, switching implementation is a cheap thing to try before assuming the node is at fault.
Allow LAN
Off by default, and worth leaving off. Turning it on makes the proxy reachable from every device on your network, which is what you want for a deliberate gateway and not what you want on shared Wi-Fi. There is no authentication on the local proxy.
Routing behaviour
| Setting | Default | What it does |
|---|---|---|
| Block ads | Off | Applies a blocklist at the DNS/routing layer |
| Resolve destination | Off | Resolves domains before routing rather than passing them to the node |
| IPv6 mode | Prefer IPv4 | How dual-stack destinations are chosen |
| Balancer strategy | Round robin | How traffic is spread across a group of nodes |
Round-robin spreads traffic evenly, which also means a node that is up but unhealthy keeps receiving its share. If some requests succeed and others fail on the same profile, test the nodes individually rather than assuming the profile is bad.
Connectivity testing
| Setting | Default |
|---|---|
| Connection test URL | http://captive.apple.com/hotspot-detect.html |
| URL test interval | 3 minutes |
The test URL is fetched to decide whether a node is usable. It is deliberately a plain-HTTP captive-portal endpoint: it is small, it is reachable almost everywhere, and a transparent proxy interfering with it is exactly the condition worth detecting.
If every node shows as failing but traffic works, suspect the test URL being blocked on your network rather than the nodes.
See also
- Advanced configuration — DNS, multiplexing, TLS fragmentation, kill switch and WARP
- Subscriptions
- Troubleshooting