FAQs

PandaVPN currently supports Windows, macOS, Android, iOS, Linux, Android TV, Apple TV, and the CLI version.

You can use PandaVPN on Windows PCs, Mac, Android phones, Android tablets, Android TV, iPhone, iPad, Linux devices, and Apple TV.

If you need to use PandaVPN on servers, router environments, or other command-line-supported devices, you can also choose the PandaVPN CLI version. We recommend downloading the latest client for your platform from the official website:
https://pandavpnpro.com/download

PandaVPN currently has only one official website:

https://pandavpnpro.com/

Please download or purchase PandaVPN only through the following official channels:

1. Official website:
   https://pandavpnpro.com/
2. Official Google Play page:
   https://play.google.com/store/apps/details?id=com.pandavpn.androidproxy
3. Official Apple App Store page:
   https://apps.apple.com/app/id1450910298

Please do not download or purchase PandaVPN from other websites. Unofficial channels may provide counterfeit software, which may cause service failure, privacy leakage, or funds loss.

If you find a suspected counterfeit website or app, or are not sure whether a channel is official, please contact us through customer support email for confirmation:

[email protected]

Different PandaVPN clients may support slightly different modes. Please refer to what is shown in your client.

1. Smart Mode
   The client automatically selects a suitable connection method. Recommended for most daily use.
2. Global mode
   All traffic goes through the VPN, providing stronger privacy protection, but local websites, apps, or LAN devices may become slower.
   On mobile, this is usually called: Tunnel All for Privacy
   On PC / Mac, this is usually called: Encrypted Proxy: Global (Exclude LAN)
3. Tunnel All Except Region
   Traffic goes through the VPN by default, but traffic for the selected region connects directly. For example, if United States / US is selected, US-related websites and apps connect directly, while other traffic goes through the VPN.
4. Tunnel Target Region Only
   Traffic connects directly by default. Only traffic to the selected region goes through the VPN. Suitable for accessing websites or streaming services in a specific country or region.
5. Tunnel Social Media Only
   Only social media or streaming traffic such as YouTube, Facebook, and X goes through the VPN. Other traffic connects directly.
6. Per-App VPN
   Mobile clients can use Per-App VPN to choose whether specific apps use the VPN.
7. Custom Split Settings
   Advanced users can use Custom Split Settings to customize IP, domain, or rule-based routing, deciding which traffic goes through the VPN, connects directly, or is blocked.
8. Protocol modes
   PandaVPN, OpenVPN, and WireGuard are different connection protocols. If the connection is unstable or slow, try switching protocols.

Recommendation:
If you are not sure which mode to choose, use Smart Mode first. If local websites or apps become slow, use Tunnel All Except Region or another split-tunneling mode.

Network conditions vary by region and carrier, so actual speed may differ.

In general, servers that are geographically closer to you and have lower latency are usually faster and more stable. You can also choose servers based on your access needs. For example, if you want to access websites, apps, or games in a specific country or region, prioritize servers in that region.

We recommend choosing a server with lower latency in the client. If the speed is not ideal, try switching to another nearby server or changing the protocol.

PandaVPN does not limit usage traffic and does not actively limit connection speed. You can use it as needed.

However, please note that PandaVPN does not replace your internet connection and is not a “free data” tool. When using PandaVPN, your device still needs to be connected to Wi-Fi or mobile data first, and it will still consume the corresponding Wi-Fi or mobile data traffic.

In simple terms:

1. PandaVPN itself does not limit traffic.
2. PandaVPN does not make mobile data or Wi-Fi traffic free.
3. If your device is not connected to the internet, PandaVPN cannot connect or be used.
4. Actual speed may be affected by your local network, carrier, region, and selected server.

If you cannot access the internet after connecting, please first check whether your device’s Wi-Fi or mobile data is working normally, then try changing the PandaVPN server or protocol.

If local websites, apps, or LAN devices become slow after connecting to PandaVPN, it is usually because all traffic is being routed through the VPN tunnel.

You can switch protocols or enter PandaVPN Mode in the client and choose a more suitable split-tunneling mode:

1. If you mainly visit local websites or apps, we recommend choosing “Tunnel All Except Region” and adding your local region to the bypass list. This allows local traffic to connect directly while other traffic can still go through the VPN.
2. If you only want to access websites in a specific country or region, we recommend choosing “Tunnel Target Region Only.” This means only traffic to the selected region will go through the VPN, while other traffic remains direct.
3. If you only need to accelerate or access social media, you can choose “Tunnel Social Media Only.”
4. If you need to protect all network traffic, you can choose “Tunnel All for Privacy,” but local websites or apps may become slower.

If you need to access routers, printers, NAS, or other LAN devices, you can also enable LAN exclusion or local network direct connection settings in the client.

Yes. PandaVPN is safe.

PandaVPN supports OpenVPN, WireGuard, and the self-developed PandaVPN Mode. It protects your network connection through encrypted transmission, reducing the risk of data monitoring or leakage.

For privacy protection, PandaVPN uses random digital accounts, does not require excessive personal information during registration, and supports a no-logs policy to minimize user privacy data retention.

PandaVPN also supports payment methods such as Bitcoin and includes an AdBlocker feature to help reduce some ads, pop-ups, and malicious content.

The abbreviations in server names usually indicate the network service provider, region, or supported service.

For example, HKT, HKBN, APNIC, HKCM, PCCW, HiNet, SoftBank, and similar abbreviations usually refer to the network service provider related to the server.

If a server name contains a platform name, such as Netflix, BBC iPlayer, AbemaTV, Viaplay, or VIU, it usually means the server is more suitable for accessing that platform.

If access is abnormal, we recommend switching to another server in the same region and trying again.

Some users refer to VPNs as “accelerators.” If you only open the PandaVPN client but have not connected to a VPN server, your IP address will not change.

Please choose a server in the PandaVPN client and click Connect. After the connection is successful, your network IP address will change to the IP address of the selected server.

If your IP address still does not change after a successful connection, try the following:

1. Disconnect and reconnect PandaVPN.
2. Change to another server.
3. Switch the connection protocol and try again.
4. Close and reopen your browser, then check your IP address again.

If your IP still cannot be changed, please confirm that the client shows “Connected” and update PandaVPN to the latest version before trying again.

The server list is grouped by server tier, country or region, and some usage scenarios, making it easier to choose a suitable server.

Common groups:

1. Free / Premium / Premium+
   These are different server tier tabs. Free servers can be used for free. Premium and Premium+ servers require the corresponding account access or plan status.
2. Smart-Select Server
   Smart server selection. After tapping it, the system will automatically recommend a suitable server based on your current network conditions.
3. Recommend
   Recommended servers. The system recommends available servers based on your network conditions.
4. Country or region groups
   Groups such as America, Asia, Europe, USA, Oceania, and Middle East indicate the server location. You can choose a server based on the region you want to access.
5. BitTorrent
   Servers in this group allow BT downloads.
6. Streaming servers
   There is currently no separate Streaming group. If you want to watch Netflix, Disney+, HBO, or other streaming services, you can search for the platform name in the server list, or choose a server with the corresponding platform tag in its name.

In addition to the groups above, other servers are usually categorized by country, region, or server tier. You can choose a server based on your access needs.

The PandaVPN Android and iOS clients support the AdBlocker feature.

You can enable AdBlocker in the client settings. After enabling it, connect to any server in a supported mode to filter some ads.

AdBlocker is mainly used to filter some website ads, pop-up ads, banner ads, and some in-app ads.

Please note:

Ad filtering results may vary depending on the website, app, region, and ad loading method. It cannot guarantee that all ads will be blocked.

Currently, we accept Credit card, PayPal, Google Play, Payssion, and Line Pay, etc.

PandaVPN offers a 7-day money-back guarantee. If you are not satisfied with the service, please contact customer support within 7 days of purchase to request a refund.

Before requesting a refund, please cancel your PayPal or credit card subscription first to avoid future automatic renewal.

Refund request methods:

1. Contact customer support through “Online Feedback” in the app.
2. Send an email to [email protected] to request a refund.

Refund processing time:

1. UnionPay and PayPal orders are usually refunded to your account within 1–3 days.
2. Credit card refunds may take 5–10 business days to appear on your statement.

Note:

1. The 7-day plan is not eligible for the 7-day money-back guarantee.
2. Orders purchased through the App Store or Google Play are handled by the corresponding platform. Please request a refund through the App Store or Google Play according to their platform rules.

Premium+ is a higher-tier server category provided by PandaVPN, mainly for users with higher requirements for speed, stability, or access to specific regions.

Premium+ servers usually use higher-quality server resources and are suitable for HD video, streaming, gaming, or scenarios that require better connection quality.

Premium+ servers may still be in testing or available for a limited-time trial. The actual availability is subject to what is shown in the client. After the test or free access period ends, you may need to upgrade your plan to continue using Premium+ servers.

If the connection is not ideal, try switching to another Premium+ server or changing the protocol.

If you need to cancel PandaVPN automatic renewal, please follow the steps based on your purchase channel:

1. PayPal subscription
   Log in to your PayPal account, go to “Settings” > “Payments” > “Manage automatic payments,” find PandaVPN, and cancel the subscription.
2. Credit card subscription
   If you subscribed by credit card, you can select a plan again on the PandaVPN renewal page and try to pay. The system will usually prompt you to cancel your current subscription. Follow the prompt to cancel.
   If there is no cancellation prompt, it may mean the subscription has already been canceled. You can also log in to your Stripe account and find the PandaVPN subscription under Billing / Subscription to cancel it.
3. App Store subscription
   If you purchased through the App Store on iPhone or iPad, go to the Apple ID “Subscriptions” page, find PandaVPN, and cancel the subscription.
4. Google Play subscription
   If you purchased through Google Play on an Android device, go to Google Play “Payments & subscriptions,” find PandaVPN, and cancel the subscription.

After cancellation, the system will no longer charge you automatically. Your purchased Premium time will remain available until the current validity period ends.

If you have any questions, please contact us through in-app online feedback or customer support email:

[email protected]

To protect your account security, non-custom accounts are for personal use only. We do not recommend sharing your account with others.

If your account is used by others, it may cause device slots to be occupied, account abnormalities, connection restrictions, or personal information leakage. Any losses or risks caused by account sharing are the responsibility of the account owner.

If you need multiple people or multiple devices to use PandaVPN together, we recommend purchasing additional device slots or contacting customer support for a custom device quantity plan.

If you need the same account to support more simultaneous devices, you can purchase additional device slots in the account center.

Log in to the “My Account” page and click “Add Devices” or “Add 3 Devices.” Each purchase adds 3 additional available device slots.

If you need a custom plan with more device slots, you can contact us through in-app online feedback or by sending an email to customer support:

[email protected]

In your message, please specify the number of devices you want to purchase. Customer support will provide a quote and purchase method.

If your account is linked to an email address, click “Forgot Password” on the login page and reset your password through the linked email.

If your account is not linked to an email address, please send your PandaVPN digital ID, order screenshot, or payment success screenshot to customer support:

[email protected]

Customer support will verify the information and help you reset your password.

If you have paid successfully but Premium has not taken effect, please follow the steps based on your payment method:

1. PayPal payment
   Some PayPal orders may be delayed due to platform review. It may take up to 3 business days. Please check your account status again later.
2. App Store or Google Play subscription
   Log in to your account in the corresponding client, go to “My Account” or “Manage Subscription,” and tap “Restore Subscription” or “Restore Purchase.”
3. Other payment methods
   Please contact us through in-app online feedback or send an email to customer support:
   [email protected]

Please provide your PandaVPN digital ID, order screenshot, or payment success screenshot. Customer support will help check and resolve the issue.

If you forgot your PandaVPN digital ID, you can find it in the following ways:

1. PayPal payment orders
   Open your PayPal order details and check the item description. The PandaVPN digital ID is usually shown after the plan you purchased.
2. Other payment methods
   If you paid through another method, please send your order screenshot or payment success SMS screenshot to customer support:
   [email protected]
   Customer support will help you find the corresponding digital ID based on the order time and payment information.
3. App Store or Google Play orders
   If you purchased a subscription in the App Store or Google Play client, you can first try tapping “Restore Subscription” or “Restore Purchase” in the client.
   If you still cannot find it, please contact customer support and provide a platform order screenshot for further checking.

Yes. You can renew your Premium subscription before it expires.

After renewal, the new plan duration will be automatically added to the remaining time on your current account. Your existing Premium time will not be affected.

For example, if your account has 10 days of Premium remaining and you purchase a 30-day plan, your total account time will become 40 days.

PandaVPN is currently in a promotion period. When an invited friend makes their first payment, both you and your friend can receive free Premium time rewards.

Reward rules:

1. Friend reward
   If your friend registers through your sharing link, or enters your invitation code and completes payment, your friend will receive 30 days of Premium time.
2. Inviter reward
   Your reward depends on the plan your friend purchases for their first payment:
   If your friend purchases a plan shorter than 1 year, you will receive 30 days of Premium time.
   If your friend purchases a plan equal to or longer than 1 year, you will receive 90 days of Premium time.

Note:
If your friend’s first purchase is shorter than 1 month, neither the inviter nor the friend will receive reward time.

Yes. You can still enter an invitation code within 7 days after registration.

Official website: Log in to your account at https://pandavpnpro.com/my-account, then enter the corresponding invitation code in the “Input invitation code” field.

Please note: The invitation code must be entered within 7 days after account registration. After that, you may no longer be able to enter it.

PandaVPN supports account deletion requests and deletion of related data.

Before deleting your account, please make sure you have canceled any current subscription or automatic renewal.

Steps:

1. Open the PandaVPN client.
2. Go to “Menu” > “My Account” > “Settings” > “Delete Account.”
3. Tap “Request Deletion.”

After the request is submitted, the system will automatically process the account deletion. Once deleted, the account can no longer be used to log in or access services, and related data will also be deleted.

If YouTube videos load slowly or buffer, please try the following:

1. Change to a YouTube or streaming-related server and reconnect.
2. Switch to another connection protocol in the client and try again.
3. If you are using Chrome, you can disable QUIC. Steps:
   Enter the following in the Chrome address bar:
   chrome://flags/#enable-quic
   Find “Experimental QUIC protocol,” set it to Disabled, and restart the browser.

Settings may vary slightly depending on the client. If it is still slow, we recommend updating PandaVPN to the latest version and trying another region or a lower-latency server.

If you cannot watch Netflix after connecting to PandaVPN, the current server or proxy mode may not be suitable for streaming. Please try the following:

1. Prefer servers with Netflix in the name, or switch to another streaming server in the same region.
2. Mobile users: Go to protocol or mode settings and avoid selecting Tunnel All for Privacy. You can switch to a split-tunneling mode under PandaVPN Mode and reconnect.
3. PC users: If the current mode is Encrypted Proxy: Global (Exclude LAN), switch to Smart Mode or another split-tunneling mode and reconnect.
4. Reopen the Netflix app or browser and try again.

If it still cannot play, please switch to another Netflix server or change the protocol and reconnect.

Yes. Search for Disney+ in the server list, choose a server with the Disney+ tag, reconnect, and then open Disney+ to watch.

If it still cannot play, try the following:

1. Enable global proxy mode and reconnect.
2. Switch to another server with the Disney+ tag.
3. Close and reopen the Disney+ app or browser.
4. If there is still an error, check the device, account region, and playback environment according to the official Disney+ message.

Note:

Disney+ has strict requirements for device compatibility, region, and network environment. Playback performance may vary by device.

Mainly supports:

Common settings:

panda mode auto
panda mode pandavpn global
panda mode proxy global
panda mode wireguard

openvpn is currently not recommended as a mainline mode in user documentation.

Recommendation:

Note: mode proxy and Kill-switch are mutually exclusive.

Yes. The main difference is the architecture of the downloaded .pkg package.

The installation steps are the same. After installing with .pkg, LaunchDaemon / helper is usually installed and started automatically.

For global users, we recommend using mode auto by default:

panda login
panda node refresh
panda mode auto
panda connect
panda doctor

If a new installation already defaults to mode auto, you can use a simpler version:

panda login
panda node refresh
panda connect
panda doctor

Corresponding shorthand version:

panda login
panda no re
panda conn
panda do

The official download page and beginner onboarding should prioritize showing the full commands; shorthand should be shown later in advanced documentation or interactive mode explanations.

gfwlist is a specific source for split rules and is not suitable as the default mode for global users.

For global users, the recommended default is:

panda mode auto

Or use PandaVPN global mode consistently:

panda mode pandavpn global

gfwlist can remain in advanced split-routing documentation, but it is not recommended for the official website’s first screen, the download page Hero, or the beginner quick start.

The key difference is: On Windows and macOS, the service is usually installed automatically through the installer, while on Linux users usually need to manually run sudo panda service install.

On Windows, you only need to run the following in an administrator PowerShell if you are not using the installer and are placing the binary manually:

panda service install windows

On macOS, this is only needed for development and debugging, when not using the .pkg installer, or when the daemon does not start automatically:

sudo panda start

On Linux, we recommend:

sudo panda service install
panda service status

Yes. The main difference is the architecture of the installation package you download.

The installation steps, commands, and service management method are the same. The installer will automatically elevate privileges and register the Windows Service.

Panda CLI is operated through the command line and is better suited for:

• Automated testing
• Remote troubleshooting
• Scripted connections
• Viewing detailed diagnostic information
• Validating low-level behaviors such as Kill-switch, DNS, routing, and system proxy

The desktop client is better suited for everyday graphical operations by regular users.

Note: The legacy Qt desktop client and CLI are not recommended to manage VPN / system proxy at the same time, to avoid overwriting each other’s configuration.

Some capabilities require system-level permissions, such as:

• Creating TUN / WireGuard network interfaces
• Modifying DNS
• Setting the system proxy
• Applying the Kill-switch
• Repairing routes
• Managing the packet VPN runtime

Therefore, the CLI performs these operations through the platform-specific daemon / service.

Daemon forms on different platforms:

Panda CLI is Panda’s command-line client and supports the following through the terminal:

• Login and account management
• Node refresh and node connection
• Switching between PandaVPN / Proxy / WireGuard / Auto modes
• System proxy configuration
• Split rules
• Split DNS configuration
• Kill-switch protection
• Auto-connect
• Logs and diagnostics

It is suitable for internal beta users, developers, advanced users, and testing scenarios that require scripted operations.

It is recommended to disconnect first and turn off Kill-switch:

panda disconnect
panda kill-switch off

For a manual upgrade or Linux service upgrade, it is recommended to also stop the daemon:

sudo panda stop

When upgrading macOS and Windows with an installer, the installer usually handles service installation and restart automatically. After the upgrade is complete, run:

panda version
panda doctor
panda connect

After a manual Linux upgrade, run:

sudo panda service install
sudo panda service restart
panda version
panda doctor

panda log
panda log --lines 200
panda log --all

Clear logs:

panda log clear

Temporarily enable debug:

panda log level debug dns,tcp --ttl 10m

Restore default:

panda log level reset

Supported versions can configure this:

panda config tcp-fast-open auto
panda config tcp-fast-open on
panda config tcp-fast-open off

Notes:

• The recommended default is auto;
• Changing it will not trigger a hot reconnect;
• A reconnect is required for it to take effect on new TCP sockets;
• Nodes that do not support TFO should not show a noticeable connection latency regression.

If the current version does not have this config option, follow panda config --help or the actual CLI help.

In newer versions, Windows Kill-switch has been upgraded from a daemon-held dynamic session to persistent WFP filters.
This means the guard can remain in place after the daemon exits abnormally.

However, persistent WFP is not the same as a boot-time filter. The very early startup window is still part of future hardening scope.

Yes.

mode auto + kill-switch on is allowed, but the final path must resolve to PandaVPN / WireGuard and must not fall back to standalone proxy. During connection, if it falls back from WireGuard to PandaVPN, it must also keep guard active, and there must not be any fail-open window.

Recommended:

panda mode auto
panda kill-switch on
panda connect
panda doctor

Not recommended.

Kill-switch is an enhanced privacy protection option, and it is not suitable for the shortest usable path. Reasons:

• disconnect does not turn off Kill-switch;
• After it is enabled, normal networking may be blocked;
• It also involves LAN access, DNS lockdown, firewall, and platform permission differences;
• New users may mistakenly think the network is broken.

New users are recommended to complete this first:

panda login
panda node refresh
panda mode auto
panda connect
panda doctor

After confirming the connection works normally, enable it as needed:

panda kill-switch on
panda doctor

No.

This is expected behavior. Kill-switch is a persistent safety switch, and disconnect only disconnects the current runtime; it does not automatically turn off Kill-switch.

To restore normal network access, run:

panda kill-switch off

In strict mode, Kill-switch blocks normal LAN / WAN traffic.
Versions that support allow-lan can enable limited LAN access:

panda kill-switch allow-lan on

Turn off LAN allowlisting:

panda kill-switch allow-lan off

Note: allow-lan allows private network / link-local / ULA unicast and v1 discovery, but LAN DNS should still be blocked to avoid bypassing Panda DNS lockdown.

Privacy mode can be understood as a stricter security mode, and is recommended to be equivalent to:

panda mode pandavpn global
panda kill-switch on

Or, under the default automatic protocol selection:

panda mode auto
panda kill-switch on

In Privacy mode, the following restrictions are recommended:

• Does not support proxy mode;
• Does not support split mode;
• Only allows VPN global semantics;
• Kill-switch must be enabled;
• Normal egress is blocked.

View all nodes:

panda node list

Refresh and then view again:

panda node refresh
panda node list

Short form:

panda no re
panda no list

View a specific region or group:

panda node list us
panda node list jp
panda node list de

View node groups:

panda node group

View details for a specific group:

panda node group show us

mode auto is the new default mode.

Its behavior is:

• API node / smart connect prioritizes the runtime based on meta.protocol;
• If WireGuard is recommended, it will try WireGuard first;
• If WireGuard metadata, address allocation, runtime startup, handshake, or connectivity probing fails, it falls back to PandaVPN global compiled from the SS payload;
• SS, OPENVPN, unknown, or missing protocols use PandaVPN global as the fallback;
• mode auto does not accept a policy parameter, and the resolved runtime is always global.

Recommended for new users:

panda mode auto
panda connect

direct-region is the recommended syntax; bypass-region / bypass are compatibility aliases.

For example:

panda mode pandavpn direct-region in

Equivalent to the compatibility alias:

panda mode pandavpn bypass-region in

Search for the node first:

panda node list us

Then connect:

panda connect --node 1822

You can also connect by name:

panda connect --node "US Node"

Shorthand:

panda no list us
panda conn --node 1822

panda connect uses the last target.
If there is no previous target, it attempts global smart connect.

Smart connect requires:

• you are logged in;
• the node directory is cached;
• when needed, run panda node refresh first.

Short form:

panda conn

panda connect us

This means a bare group selector. It does not pin the VIP / SVIP / FREE tab; the API selects the appropriate tab.

panda connect svip us

This means always using us under the SVIP tab.

The colon form is equivalent and suitable for scripts:

panda connect svip:us

The favorite tab is currently a flat favorite channel list and does not support favorite group smart connect such as connect fav us; for favorites, use:

panda connect fav

or:

panda connect --node <NODE_ID>

The new version supports a more complete split profile syntax:

panda mode pandavpn split default direct proxy-region <cc>
panda mode pandavpn split default proxy direct-region <cc>

Common tokens:

Examples:

panda mode pandavpn split default direct proxy-region us custom-rules
panda mode pandavpn split default proxy direct-region in direct-lan custom-rules

Long commands are not recommended for beginner documentation. They are better suited for advanced split routing documentation.

The meaning of Kill-switch is to allow traffic only through TUN, while other normal traffic is blocked.

proxy mode is a standalone local proxy mode. It does not have packet VPN / TUN, nor does it provide equivalent DNS and routing protection. Therefore, Kill-switch does not support standalone proxy mode.

When you need Kill-switch, use:

panda mode auto
panda kill-switch on

Or:

panda mode pandavpn global
panda kill-switch on

Or:

panda mode wireguard
panda kill-switch on

trace is used to see which rule, DNS action, and route a target will use.

panda trace example.com:443
panda trace 8.8.8.8:53 --json

Note: full trace capability requires an active PandaVPN packet runtime. Without a compatible runtime, only limited validation is available, or it falls back to legacy trace.

Usually no. Split DNS configuration changes are hot-loaded.

Common commands:

panda split dns status
panda split dns local set 223.5.5.5 114.114.114.114
panda split dns policy tunnel-only
panda split dns fake-ip on

If the platform does not support certain local DNS sources, doctor will show a warning.

On a Fresh install, the default is proxy system-proxy on.
If the user explicitly saved off, that configuration is preserved.

View or set:

panda proxy system-proxy on
panda proxy system-proxy off
panda proxy system-proxy lock-on

Note: under mode auto, pandavpn, and wireguard, the VPN runtime ignores the persisted system proxy preference; the VPN companion proxy remains available and uses scoped egress.

Windows system proxy is the current user's HKCU WinINET setting and requires a per-user user-agent.
If you are in an SSH or non-interactive session, proxy repair may not always be able to start the user-agent automatically.

Recommended:

panda proxy status
panda proxy repair
panda doctor

If it still does not take effect, try again in a desktop login session.

No.

Auto-connect mainly covers best-effort connect when the daemon / service starts, plus pending retry when the network is temporarily unavailable at startup.

Enable:

panda config auto-connect on

Disable:

panda config auto-connect off

It is not a general runtime automatic reconnection mechanism.

Split rules are used to specify that certain domains, keywords, regex, or IPs go through proxy, direct, or block.

Rule files:

split/rules/proxy.txt
split/rules/direct.txt
split/rules/block.txt

Common commands:

panda split rules list
panda split rules add proxy suffix:github.com
panda split rules add direct ip-cidr:10.0.0.0/8
panda split rules add block keyword:adservice

Current known limitation: after login, pending auto-connect waiting for retry will not be woken automatically.

After login, manually run:

panda connect

| Pattern | Example | Meaning | |---|---|---| | Bare domain | example.com | Suffix match | | domain: | domain:api.example.com | Exact host | | suffix: | suffix:google.com | Suffix match | | || | ||google.com | Suffix match | | keyword: | keyword:netflix | Substring match | | regexp: | regexp:.*\.cdn\.example\.com | Go regex | | ip-cidr: | ip-cidr:10.0.0.0/8 | IP rule |

Common reasons:

• you are not logged in yet;
• the node directory has not been refreshed;
• the current account has no available nodes;
• the network is unavailable;
• the daemon is not running;
• the current mode is incompatible with the target node;
• under mode auto, the recommended protocol failed to start and fallback also failed.

Recommended checks:

panda account
panda node refresh
panda node list
panda mode
panda doctor
panda log --lines 200

panda status

Structured output:

panda status --json

Shorthand:

panda stat

doctor is a read-only diagnostic command used to view the current key status of Panda CLI.

panda doctor
panda doctor --json

Short form:

panda do

Focus on:

runtime
kill_switch
selected_node
vpn_dns
dns_lockdown
split_policy
system_proxy_state
vpn_routes
last_error

panda repair is more comprehensive and may repair:

• VPN route
• DNS snapshot
• Kill-switch guard
• system proxy-related state

panda proxy repair mainly repairs system proxy drift for the current user.

panda repair
panda proxy repair

Linux Phase 1 mainly supports GNOME gsettings.
Environments such as KDE / XFCE may show as unsupported.

This does not necessarily affect the PandaVPN packet runtime, but it may affect the system proxy mode experience.

In a no-tunnel IPv6 scenario, awdl0 / llw0 may be blocked, causing AirDrop / Continuity to become temporarily unavailable.
It usually recovers after disconnect.

If it is still abnormal, recommended:

panda disconnect
panda kill-switch off
panda repair
panda doctor

This usually happens because the official service / LaunchDaemon is installed, and you also manually ran:

sudo panda start

sudo panda start starts an unmanaged daemon, which may manage the following at the same time as the official daemon:

• VPN routes
• DNS
• TUN
• system proxy
• Kill-switch

The rule is: keep only one daemon.

Common handling on macOS / Linux:

panda disconnect
panda kill-switch off
sudo panda stop
panda repair
panda doctor

On Linux, if you use systemd service, restart the official service afterwards:

sudo panda service restart
panda doctor

On macOS, if installed with .pkg, usually let LaunchDaemon / helper manage the daemon, and do not use sudo panda start long-term as your daily startup method.

If you only want to disconnect the VPN, you do not need to exit the daemon:

panda disconnect
panda kill-switch off

If you really want to stop the daemon:

sudo panda stop

Confirm:

panda status

If it shows panda daemon unavailable, it means the main daemon has stopped.

Note: The LaunchDaemon / helper installed by the macOS .pkg may be managed by the system. Regular users are not advised to manually stop the service frequently.