diff --git a/Passepartout.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved b/Passepartout.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
index e9f76def..9e712538 100644
--- a/Passepartout.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
+++ b/Passepartout.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
@@ -51,7 +51,7 @@
         "repositoryURL": "https://github.com/passepartoutvpn/tunnelkit",
         "state": {
           "branch": null,
-          "revision": "3a54295ed9d2b71057fdeef752144beea66e31f2",
+          "revision": "8df7e90c95dc1af66b27990b5f00ba21120e9f9d",
           "version": null
         }
       },
diff --git a/Passepartout/App/Views/EndpointAdvancedView+OpenVPN.swift b/Passepartout/App/Views/EndpointAdvancedView+OpenVPN.swift
index 743aa736..d7ac99e8 100644
--- a/Passepartout/App/Views/EndpointAdvancedView+OpenVPN.swift
+++ b/Passepartout/App/Views/EndpointAdvancedView+OpenVPN.swift
@@ -43,6 +43,8 @@ extension EndpointAdvancedView {
                 if isServerPushed {
                     ipv4Section
                     ipv6Section
+                } else {
+                    pullSection(configuration: cfg)
                 }
                 dnsSection(configuration: cfg)
                 proxySection(configuration: cfg)
@@ -111,6 +113,18 @@ extension EndpointAdvancedView.OpenVPNView {
         }
     }
 
+    private func pullSection(configuration: OpenVPN.Configuration) -> some View {
+        configuration.pullMask.map { mask in
+            Section {
+                ForEach(mask, id: \.self) {
+                    Text($0.localizedDescription)
+                }
+            } header: {
+                Text(L10n.Global.Strings.pull)
+            }
+        }
+    }
+
     private func communicationSection(configuration: OpenVPN.Configuration) -> some View {
         configuration.communicationSettings.map { settings in
             Section {
diff --git a/Passepartout/AppShared/Constants/SwiftGen+Strings.swift b/Passepartout/AppShared/Constants/SwiftGen+Strings.swift
index 88bc1171..6cbecf96 100644
--- a/Passepartout/AppShared/Constants/SwiftGen+Strings.swift
+++ b/Passepartout/AppShared/Constants/SwiftGen+Strings.swift
@@ -502,6 +502,8 @@ internal enum L10n {
       internal static let proxy = L10n.tr("Localizable", "global.strings.proxy", fallback: "Proxy")
       /// Public key
       internal static let publicKey = L10n.tr("Localizable", "global.strings.public_key", fallback: "Public key")
+      /// Pull
+      internal static let pull = L10n.tr("Localizable", "global.strings.pull", fallback: "Pull")
       /// Reconnect
       internal static let reconnect = L10n.tr("Localizable", "global.strings.reconnect", fallback: "Reconnect")
       /// Rename
diff --git a/Passepartout/AppShared/L10n/OpenVPN+L10n.swift b/Passepartout/AppShared/L10n/OpenVPN+L10n.swift
index 067e1ebe..c9ea4755 100644
--- a/Passepartout/AppShared/L10n/OpenVPN+L10n.swift
+++ b/Passepartout/AppShared/L10n/OpenVPN+L10n.swift
@@ -120,3 +120,18 @@ extension Bool {
         return self ? V.enabled : V.disabled
     }
 }
+
+extension OpenVPN.PullMask {
+    var localizedDescription: String {
+        switch self {
+        case .routes:
+            return L10n.Endpoint.Advanced.Openvpn.Items.Route.caption
+            
+        case .dns:
+            return Unlocalized.Network.dns
+            
+        case .proxy:
+            return L10n.Global.Strings.proxy
+        }
+    }
+}
diff --git a/Passepartout/AppShared/en.lproj/Localizable.strings b/Passepartout/AppShared/en.lproj/Localizable.strings
index 6a0e7c37..752f90f9 100644
--- a/Passepartout/AppShared/en.lproj/Localizable.strings
+++ b/Passepartout/AppShared/en.lproj/Localizable.strings
@@ -50,6 +50,7 @@
 "global.strings.connect" = "Connect";
 "global.strings.disconnect" = "Disconnect";
 "global.strings.download" = "Download";
+"global.strings.pull" = "Pull";
 
 "global.messages.email_not_configured" = "No e-mail account is configured.";
 "global.messages.share" = "Passepartout is a user-friendly, open source OpenVPN / WireGuard client for iOS and macOS";
diff --git a/PassepartoutLibrary/Package.swift b/PassepartoutLibrary/Package.swift
index 7aea8bab..a9d60fff 100644
--- a/PassepartoutLibrary/Package.swift
+++ b/PassepartoutLibrary/Package.swift
@@ -24,7 +24,7 @@ let package = Package(
         // Dependencies declare other packages that this package depends on.
         // .package(url: /* package url */, from: "1.0.0"),
 //        .package(name: "TunnelKit", url: "https://github.com/passepartoutvpn/tunnelkit", from: "5.0.0"),
-        .package(name: "TunnelKit", url: "https://github.com/passepartoutvpn/tunnelkit", .revision("3a54295ed9d2b71057fdeef752144beea66e31f2")),
+        .package(name: "TunnelKit", url: "https://github.com/passepartoutvpn/tunnelkit", .revision("8df7e90c95dc1af66b27990b5f00ba21120e9f9d")),
 //        .package(name: "TunnelKit", path: "../../tunnelkit"),
         .package(url: "https://github.com/zoul/generic-json-swift", from: "2.0.0"),
         .package(url: "https://github.com/SwiftyBeaver/SwiftyBeaver", from: "1.9.0")
diff --git a/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/OpenVPNSettings+VPNConfiguration.swift b/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/OpenVPNSettings+VPNConfiguration.swift
index 2030a3e7..2ade683f 100644
--- a/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/OpenVPNSettings+VPNConfiguration.swift
+++ b/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/OpenVPNSettings+VPNConfiguration.swift
@@ -82,6 +82,7 @@ extension OpenVPN.ConfigurationBuilder {
             break
         
         case .manual:
+            appendNoPullMask(.routes)
             var policies: [OpenVPN.RoutingPolicy] = []
             if settings.isDefaultIPv4 {
                 policies.append(.IPv4)
@@ -99,6 +100,7 @@ extension OpenVPN.ConfigurationBuilder {
             break
 
         case .manual:
+            appendNoPullMask(.dns)
             let isDNSEnabled = settings.configurationType != .disabled
             self.isDNSEnabled = isDNSEnabled
 
@@ -131,6 +133,7 @@ extension OpenVPN.ConfigurationBuilder {
             break
 
         case .manual:
+            appendNoPullMask(.proxy)
             isProxyEnabled = settings.configurationType != .disabled
 
             switch settings.configurationType {
@@ -161,4 +164,11 @@ extension OpenVPN.ConfigurationBuilder {
             mtu = settings.mtuBytes
         }
     }
+    
+    private mutating func appendNoPullMask(_ mask: OpenVPN.PullMask) {
+        if noPullMask == nil {
+            noPullMask = []
+        }
+        noPullMask?.append(mask)
+    }
 }