For everyday use, start with “Bypass mainland China” and add exceptions for specific sites as needed. This guide follows the common v2rayN 7.x interface on Windows with the Xray core. It explains the difference between the system proxy and core routing, and covers preset rules, domain matching, DNS, and verification. Preset names can vary between minor releases; rely on rule order and actual outbound behavior, not the label alone.
1. System proxy vs. routing
Split tunneling starts with one requirement: traffic must reach the proxy core managed by v2rayN. The system proxy determines whether apps that honor it send requests to the local port. Routing rules then decide whether those requests connect directly, go through a proxy node, or get blocked. These are separate layers and neither replaces the other.
In the Windows v2rayN main window or tray menu, set “System proxy” to “Set system proxy automatically” to handle requests from browsers that follow the system proxy settings. Simply opening the client, selecting a node, or changing the routing mode does not guarantee that your browser is using the proxy.
- System proxy: Affects apps that respect the system proxy settings; it does not capture every connection on the device.
- Core routing: Handles traffic that reaches the core and selects an outbound based on the rules.
- TUN mode: Captures more traffic, but still requires appropriate routing and DNS settings. For initial troubleshooting, use the system proxy to reduce variables.
- Node protocol: VMess, VLESS, and other protocols determine how a node connects; they do not directly determine whether sites in mainland China connect directly.
2. Choose a routing mode: Bypass mainland China, Global proxy, or Blacklist
First, check the “Routing” dropdown at the bottom of the main window. Then open “Settings” → “Routing settings” to inspect the rules behind the selected mode. Common presets include Bypass mainland China, Blacklist, and Global. If your version does not have an identically named preset, do not assume a similarly named option uses the same rules.
Bypass mainland China
RecommendedTypically, this mode sends local network traffic and domains or IPs classified as belonging to mainland China by the rule sets directly, while routing other requests through the proxy. Classification relies on domain and IP data, not webpage text or the location of a site's operator.
Best for: Using domestic services, downloads, and overseas websites side by side.
Global proxy
Prioritizes routing ordinary traffic that reaches the core through the selected node. A preset may still keep exceptions such as direct connections to local networks, so check its rules rather than relying on the word “Global.”
Best for: Short comparison tests to see whether a problem is related to split tunneling.
Blacklist routing
Typically, only domains on a specified list use the proxy; other requests connect directly. Newly added domains may not be on the list, so add exceptions based on actual traffic when needed.
Best for: A small, well-defined set of proxy destinations when you are willing to maintain the domain list.
Takeaway: Start with one baseline
Use Bypass mainland China for everyday traffic. If a particular site has problems, switch temporarily to Global proxy as a comparison. If that fixes it, switch back and add a rule for that site. Avoid changing the node, DNS, and core all at once.
3. Set up routing from a preset
Before you begin, confirm that at least one node can load an actual webpage. A latency result only means that a particular probe succeeded; it does not guarantee that the sites you need will work. Follow this order: route traffic into the core, choose a routing mode, then verify the results.
-
Select a node
In the main window's node list, select the node you want to use, right-click it, and choose “Set as active server.” Keep this node fixed for the test; do not enable automatic selection or switch nodes repeatedly.
-
Enable the system proxy
Open the “System proxy” menu and choose “Set system proxy automatically.” If your browser has its own manual proxy settings, switch it back to using the system proxy to prevent the two configurations from conflicting.
-
Inspect the preset rules
Open “Settings” → “Routing settings” and review the Bypass mainland China rules. Make sure private addresses and mainland China direct-connection rules appear before broad fallback rules. Back up the current configuration or duplicate the profile before editing.
-
Select the routing mode
Return to the main window and select the profile you just checked from the “Routing” dropdown at the bottom. After saving changes, watch for a core reload notification and make sure there are no configuration parsing errors before continuing.
-
Reset connections
Close old tabs for the test sites. If needed, fully quit and reopen the browser. Visit a site in mainland China, the overseas site you want to test, and a local network device; record whether each behaves as expected.
If other proxy tools are running on the computer, quit them first. The Windows system proxy is shared, and another program may change it in the background, making a setting that worked moments ago stop working.
4. Add direct-connection and proxy exceptions by site
Presets cannot account for every service dependency. A site in mainland China may call an overseas API, while an overseas service may use a local content delivery network. Add rules for the specific domains that fail. Do not route an entire public cloud IP range the same way based on a single issue.
Open “Settings” → “Routing settings” and edit the current profile's rule list. To add a rule, enter one of the matching expressions below in the domain field, then choose an outbound. The proxy outbound is often labeled proxy, and direct connections are often labeled direct. If your interface uses different labels, use the outbound tags in the generated configuration.
| Expression | What it matches | When to use it |
|---|---|---|
full:api.example.com | Matches this exact domain only | Use when only a specific endpoint needs the proxy |
domain:example.com | Matches the root domain and its subdomains | Use when routing the entire site through the same outbound |
geosite:cn | Matches the cn category in the domain data file | A common baseline for direct connections to mainland China domains |
geoip:cn | Matches addresses in the cn category in IP conditions | Use as an address-level condition, not in the domain field |
example.com is a reserved example domain used to illustrate the syntax, not a real service that needs a proxy. Enter only the domain expression—not https://, a path, query parameters, or a port. Domain rules cannot see a URL path such as /account, so they cannot route traffic by page path.
- Order matters: Xray routing rules are generally evaluated from top to bottom, and the first matching rule takes effect. Put specific exceptions before broad categories.
- Not longest-match: An exact-domain rule later in the list does not automatically override a domain category rule that matched earlier.
- Different fields, different logic: Multiple domains in the same rule usually use “match any.” When you fill in different conditions such as domain, port, and network type, they usually all must match.
- Handle private networks separately: Route local network devices directly using private IP ranges. Domain rules depend on the core receiving the domain name and cannot replace every IP rule.
5. Why DNS affects direct connections to mainland China
Domain-based routing requires the core to know the domain name. When a browser makes an HTTPS connection through an HTTP proxy, it usually passes the target hostname to the proxy. Some apps send only an already-resolved IP to the core, in which case a domain rule may not match. TUN, sniffing, and DNS interception can all affect this process; they are not interchangeable switches.
IP-based routing also depends on DNS results. A domain's category and the region associated with its resolved IP address are separate conditions. With a content delivery network, domain and IP rules may point in different directions; the first matching rule still determines the result.
- Check what the request contains first: If the destination in the log is only an IP, check whether the app resolved the domain before sending the request. Repeatedly adding the same domain rule will not help.
- Then check the resolution strategy: Xray's
AsIsdoes not resolve domains specifically for routing.IPIfNonMatchcan resolve the domain after it fails to match at the domain stage, then try matching the IP. - Check the fallback rules: If an earlier broad rule has already matched, a later IP check cannot override the result.
- Check the browser separately: The browser's Secure DNS setting can change local DNS behavior, but enabling it alone does not prove that all DNS resolution bypasses the proxy.
In v2rayN, open “Settings” → “DNS settings” to check the configuration used by the current core. Keep the preset configuration unless logs indicate a resolution problem. Re-establish connections after changing DNS. On Windows, ipconfig /flushdns clears the system DNS cache only; it does not also clear every cache in your browser, apps, or core.
6. Verify results with ports, requests, and logs
Verification should answer three questions: Did the request reach the local proxy? Which outbound matched? Could that outbound connect to the destination? The ports below illustrate what to test; they are not fixed values for every installation. Find the actual values under “Settings” → “Parameter settings” in the local listener configuration.
If your SOCKS listener is actually 127.0.0.1:10808, run the following command in a Windows terminal. socks5h sends the destination hostname to the proxy, making it useful for testing routing after a domain reaches the core. It does not fully reproduce the browser's own DNS behavior.
curl.exe --proxy socks5h://127.0.0.1:10808 --connect-timeout 10 --max-time 20 -I https://www.baidu.com/
curl.exe --proxy socks5h://127.0.0.1:10808 --connect-timeout 10 --max-time 20 -I https://www.wikipedia.org/An HTTP response from the command only means the request reached an HTTP service; success alone does not prove that the proxy outbound was used. Check the Xray access log for the matching domain and outbound tag, such as direct or proxy. If the current log shows only errors, open “Settings” → “Parameter settings” and check the log level and access-log options. Restore your usual settings after testing to avoid recording destinations longer than necessary.
- Keep the node, routing mode, and DNS fixed. Record the test time and destination domain.
- With Bypass mainland China selected, send requests to two sites and check the destination and outbound in the logs.
- Change only the routing mode to Global proxy, retry the request, and see whether the failing site starts working.
- Switch back to the original mode, add one exception, and test again. Remove the temporary test rule once you confirm it works.
Takeaway: A webpage loading does not prove routing is correct
Verification is complete only when the request reaches the core, the log shows the expected outbound, and the destination responds normally. A public IP lookup only confirms the route to the lookup site; it says nothing about every image, API, or video request on the same page.
7. Common split-tunneling questions
Why are sites in mainland China still slow with Bypass mainland China selected?
Check the outbound logs for the site's main domain and its static asset domains. If any are incorrectly going through the proxy, put an exact direct-connection rule for that domain before the broad proxy rule. If they already connect directly, check your local network and DNS results instead of adding duplicate rules.
Global proxy works, but split tunneling doesn't. What should I change first?
Keep the node unchanged and note the domain for the failed request. Open “Settings” → “Routing settings,” add a proxy exception for it, and place the rule before category rules. If the page uses multiple domains, check the failing endpoints instead of adding a rule for only the main domain in the address bar.
Why didn't anything change after saving a new rule?
First check that the profile you edited is selected in the “Routing” dropdown at the bottom of the main window. Then check whether an earlier rule takes precedence. Quit and restart the test app to rule out a reused connection. If there are still no logs, first resolve the issue preventing traffic from reaching the core.
What should I do if my printer or company intranet won't open?
Make sure private-address direct-connection rules come before broad proxy rules. Internal company domains may depend on company DNS; a public domain category rule is not enough. Temporarily turn off the system proxy to compare access, then check the intranet address, DNS, and existing corporate network policies. Avoid routing the entire intranet through a remote node.
Will updating my subscription also update split-tunneling rules?
A standard node subscription mainly updates server settings; it does not necessarily update local routing rules or domain data. After updating nodes, check the active server, routing profile, and custom rules. If domain classification data needs updating, check the client's data update feature separately.
Keep one set of rules that is easy to understand: direct connections for private networks, a few service-specific exceptions, direct connections for the mainland China category, and an explicit route for remaining traffic. Change one thing at a time and keep a record of the previous configuration. This is easier to reproduce and maintain than accumulating rules whose purpose is unclear.