Split routing¶
Decide what actually goes through the tunnel and what goes straight out — by address, and on Android by app. Both lists work the same way: the list itself is just a list, and a mode decides what it means.
By address¶
All platforms · default “bypass list”
Add domains, IP addresses and subnets (one field takes both a single address like 1.2.3.4 and a subnet like 10.0.0.0/8), then pick a mode:
| Mode | What it does |
|---|---|
| Off | The list is not applied — everything goes through the tunnel. The provider's own routing rules still apply. |
| Bypass list | Everything goes through the tunnel except the entries you list — those connect directly. |
| Only list | Only the entries you list go through the tunnel. Everything else connects directly. |
The default matches how the old exclusion list behaved, so nothing changes for existing users after an update.
⚠
Asterisks don't work. *.example.com is treated as literal text and simply never matches. To cover a domain together with its subdomains, write domain:example.com.
How domain entries match¶
| You write | What it matches |
|---|---|
example.com |
A substring match — covers example.com and its subdomains, but can also catch unrelated hosts that contain the same text. |
domain:example.com |
The domain and all its subdomains — this is what people mean by an asterisk. |
full:example.com |
That exact name only, no subdomains. |
regexp:… |
A regular expression, for cases the forms above don't cover. |
“Bank and government sites direct, everything else over VPN”
Mode: bypass list — add domain:yourbank.com to the list.
“Only one service over VPN, the rest as usual”
Mode: only list — add just that service's domains, as domain:service.com.
By app¶
Android · default “off”
Choose which apps use the tunnel and which go around it, with the same three modes:
| Mode | What it does |
|---|---|
| Off | Per-app routing is not applied; the tunnel covers every app. |
| Bypass list | Every app goes through the tunnel except the ones you pick — those connect directly. |
| Only list | Only the apps you pick go through the tunnel. Everything else connects directly. |
The picker shows each app's icon, name and package name, with search and a “show system apps” toggle — user apps only by default, system apps marked with an asterisk. On iOS, Mac and Windows, routing by address covers the same need using addresses instead of apps.
Worth knowing
-
Changing the mode or the list takes effect after reconnecting — the app tells you instead of restarting the tunnel behind your back.
-
In “only list” mode with an empty list, nothing goes through the tunnel at all and the VPN is effectively off. The app warns about this in the interface.
-
Whatever the mode, the app's own service addresses and the hosts of your subscriptions always stay in the tunnel — otherwise a subscription refresh would leave over the direct connection. You don't need to add them by hand.