DNS resolves names; it does not select an exit country
The DNS control chooses resolver addresses written into your configuration. It does not select a WARP exit country or change the VPN endpoint. Cloudflare DNS is the default. When comparing providers, inspect the generated DNS field as well as the selection in the interface.
Community DNS entries are operated by third parties. Supported community providers force All sites mode and clear the specific-services selection in this generator. That is a product rule, not a property of every DNS server. Changing DNS alone does not guarantee access to a region-restricted service.
MTU and IPv6: use a reproducible starting point
MTU defaults to 1280. The generator accepts 1280–9000 with IPv6 enabled and 576–9000 with IPv6 disabled. Those are input limits, not a recommendation to choose the largest number. The client and network path must carry the resulting packets.
If some transfers stall while smaller requests work, compare one MTU change against the baseline. Turning IPv6 off removes IPv6 interface and DNS entries in supported exports; it is a diagnostic choice, not a promise to disable every IPv6 path on the device.
| Setting | Starting point | Check |
|---|---|---|
| MTU | 1280 | Reliable transfers on the intended network |
| IPv6 | Enabled by default | Client and network support for the intended routes |
| DNS | Cloudflare default | Name resolution and the exported DNS field |
All sites, Specific sites and Exclude LAN
All sites uses default routes. Specific sites builds AllowedIPs from bundled service IP ranges. These ranges can include shared infrastructure and become incomplete as services change addresses; they are not precise domain-name filters.
Exclude LAN is available in All sites mode. It substitutes a public-address range list for the default routes so local/private networks can stay outside the tunnel. The final effect also depends on the client’s routing implementation. In Clash, selected ranges go to the Cloudflare group and remaining traffic goes to DIRECT.
If one service fails, compare All sites with the specific-sites profile. If the broader mode works, inspect routes before changing keys or protocol versions. Restore your intended mode after testing.
PersistentKeepalive and custom I1/SNI
PersistentKeepalive periodically sends packets to keep a NAT/firewall mapping available. In the generator it is off by default; an enabled empty input uses 25 seconds. Accepted values are whole numbers from 1 to 65535. It is not a general speed control.
Custom I1/SNI configures protocol masking in applicable formats. Enter a domain without a scheme or path. It does not move the VPN endpoint to that website or grant access to its server. An ordinary WireGuard client does not understand AWG extension fields: choose a compatible client before enabling them.
Keep the working profile and write down each change. A successful configuration export checks the generation path, not connectivity from every network. If the result is unclear, use the troubleshooting guide to separate name resolution, routing and transport problems.
Official references
Client interfaces can change. Check menu actions and protocol support against the documentation for your installed app.