- Providers: enforce all (IPv4 + IPv6) - Hosts: re-read .ovpn on app update, fall back to all (safer) Reload hosts in order to re-interpret "redirect-gateway".