Vylos File Format

Use the .vylos format to carry a standard WireGuard configuration together with Vylos Split DNS, On-Demand, and kill-switch settings.

Archive Structure

A .vylos file is a ZIP archive containing one required file and one optional file:

Vylos rejects an archive without wireguard.conf or with either entry encoded as non-UTF-8 text. An archive with no settings.conf behaves like its contained WireGuard configuration.

The extension does not change WireGuard's configuration syntax. You can extract wireguard.conf and use it with another WireGuard-compatible client, while Vylos-specific settings remain isolated in settings.conf.

wireguard.conf

The required entry uses the same wg-quick fields accepted by Vylos for a normal .conf import. Zero [Peer] sections are valid, and a tunnel may contain multiple peers.

[Interface]
PrivateKey = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
Address = 10.0.0.2/32
DNS = 10.0.0.1

[Peer]
PublicKey = BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=
AllowedIPs = 0.0.0.0/0
Endpoint = vpn.example.com:51820
PersistentKeepalive = 25

Replace the illustrative keys and endpoint with values issued by your WireGuard server. See the WireGuard project's wg-quick documentation for the underlying configuration format.

settings.conf

Section and key names are matched without case sensitivity. Blank lines and text after # are ignored, while unknown sections, unknown keys, malformed lines, unsupported actions, and unsupported interface types cause import to fail.

Split DNS

Use one [SplitDNS] section with either or both supported keys:

Domain labels may contain letters, digits, and interior hyphens. Vylos also accepts an optional leading wildcard such as *.example.com and a trailing dot for fully qualified names.

Vylos normalizes Split DNS match domains before applying them to Apple networking. Invalid domain entries are ignored rather than added to the tunnel's domain list.

On-Demand Rules

Add one [OnDemandRule] section for each network condition. Multiple sections use OR behavior, so any matching rule can activate the tunnel.

Do not mix included and !-prefixed SSIDs in one rule. Cellular rules apply on iOS, Ethernet rules apply on macOS, and Wi-Fi rules apply on every supported Vylos platform.

Vylos retains unsupported platform-specific rule values when it imports and re-exports the tunnel. This lets one portable file preserve its intended behavior across iOS, macOS, and visionOS.

Kill Switch

Add a [Routing] section to block most network traffic when an armed On-Demand tunnel is unavailable:

[Routing]
KillSwitch = true

KillSwitch accepts true or false. A value of true requires at least one [OnDemandRule]; Vylos rejects a file that enables the kill switch without an automatic activation rule.

This setting maps to Apple's system-level all-network routing, but it does not rewrite the WireGuard configuration. The combined peer AllowedIPs still determines which destinations have a route through the VPN. A dual-stack full tunnel normally uses 0.0.0.0/0, ::/0; a narrower route set intentionally becomes a strict allowlist while the kill switch is on. A DNS server outside every peer's AllowedIPs is also unreachable.

The app shows Full-Tunnel Protection, Restricted Network Access, or No Outgoing Routes based on the effective union of all peer routes. See Set Up On-Demand for the route table, DNS warning behavior, and platform exceptions.

A plain .conf file contains the WireGuard route set but has nowhere to store Vylos's kill-switch choice. Use .vylos when the On-Demand and kill-switch settings need to travel with the tunnel.

Complete Example

The archive's settings.conf can combine both feature families:

[SplitDNS]
Domains = corp.example.com, *.internal.example.com
SearchDomains = example.com

[OnDemandRule]
InterfaceType = cellular
Action = connect

[OnDemandRule]
InterfaceType = wifi
Action = connect
SSIDs = !HomeWifi, !HomeWifi-5G

[Routing]
KillSwitch = true

This configuration connects on cellular and on every Wi-Fi network except the two named home networks. It routes matching corporate and internal DNS names through the tunnel and blocks most other traffic if the armed tunnel becomes unavailable.

See Set Up Split DNS and Set Up On-Demand for how these settings behave in the app.

Import, Export, and QR Codes

Vylos imports .vylos files directly and can include them inside a batch .zip archive. A Vylos export produces one .vylos archive per tunnel when you choose Full Configuration or Both.

On iOS, a QR code can carry a Base64-encoded .vylos archive up to 16 KB. Base64 is only an encoding and does not encrypt the private key contained in wireguard.conf.

The general file-import limit is 2 MB. Exported files contain private keys, so store and share them as sensitive credentials.