Sending traffic around the VPN: traffic rules

Why you'd want this

Some traffic is better off going direct:

• a bank or government portal that drops connections from foreign addresses;
• devices on your own network — a NAS, a printer, the router itself;
• a service that is simply faster over your own ISP.

Where to find it

Not in Settings. Open the Routes screen and switch to the Policies tab — those are the traffic rules.

The mode selector sits on top:

• "Everything through VPN" — the default. Everything is tunnelled except what you list as an exception.
• "Everything direct" — the inverse: only what you list goes through the VPN. The app warns you before switching, and the warning is worth reading: the rest of your traffic leaves with your real IP, and a rule that failed to match says nothing. The kill switch cannot protect this mode.

Your own rules

"+ rule" — enter a domain (example.com; subdomains are covered automatically) or an IP or range (10.0.0.0/8), then pick the verdict: through VPN, direct, or block.

Ready-made categories

Below your own rules are categories delivered by the server and selected automatically for the country you're detected in. Each can be toggled:

• Ads & trackers and Malware & phishing — blocked, on by default everywhere;
• Russian services, Chinese services, Iranian services — domestic banks, state portals and marketplaces that refuse foreign addresses; enabled in the matching country and routed direct;
• Streaming direct — streaming outside the tunnel where the local ISP performs better;
• P2P / BitTorrent — the opposite: forced through the tunnel even when another rule would send it direct.

Per-app rules are Android-only

On Android, Routes → Policies has a separate Apps entry with two modes: "Exclude" (the selected apps bypass the VPN) and "Selected only" (only they use it).

There is no per-app selection on Windows, macOS, Linux or iOS — there you work with domains and IP ranges. That is a limit of the platform APIs, not an unfinished screen.

When a rule takes effect

• iOS and desktop in TUN mode — immediately, with no reconnect.
• Desktop in SOCKS5 mode, and per-app rules on Android — after reconnecting. The app says so on screen: "Per-app rules apply after reconnecting."

Kill switch and exceptions

The kill switch guards traffic that was meant to go through the tunnel. Traffic you deliberately sent around it keeps flowing directly when the tunnel drops — by design, since otherwise the exception would be pointless.