This article covers geosite and geoip tag meanings, rule priority, a copy-ready rule set for direct domestic and proxied international traffic, and a three-step troubleshooting order when rules don't work.
Why split tunneling is needed
By default, once v2rayN enables the system proxy, all traffic is sent to the proxy node. For accessing domestic websites, this causes three practical problems: First, domestic CDN resources (video, live streaming, cloud storage) are routed overseas, adding 50-100ms latency and noticeably reducing speed. Second, some domestic apps (online banking, government services, video memberships) detect proxy IPs and refuse access. Third, all traffic goes through the proxy node, which quickly consumes data allowance on metered plans.
The idea behind split tunneling is simple: let traffic first go through routing rule matching, with domestic domains and IPs going direct, international domains and IPs going through the proxy, and LAN addresses bypassing the proxy.
In v2rayN 7.24.1, this logic is implemented by the routing rule list and the default outbound.
Understanding v2rayN's routing rules interface
Open v2rayN 7.24.1, click the top menu 'Settings' → 'Preferences', and select the 'Routing' tab on the left. Here you'll see three configuration sections: routing rule list, domain strategy, and default outbound. The routing rule list is the core; by default v2rayN includes a few basic rules, and you can add, delete, or reorder them.
Each rule includes domain, IP, port, protocol, and outbound method. The outbound method has three options: direct, proxy, and block.
| Field | Purpose | Example |
|---|---|---|
| Domain | Matches target domain | geosite:cn |
| IP | Matches target IP | geoip:cn |
| Port | Matches target port | 80,443 |
| Protocol | Matches transport protocol | tcp,udp |
| Outbound | Channel after match | direct / proxy / block |
Rules are matched from top to bottom, and the first matching rule takes effect. Therefore, the 'domestic direct' rule must be placed before the 'default proxy' rule.
geosite vs geoip: How to choose between the two rule databases
v2rayN includes two rule databases, geosite and geoip, which classify traffic by domain and IP address respectively. geosite is a domain classification database maintained by the Project V community. Common tags include geosite:cn (Chinese domains), geosite:geolocation-!cn (non-Chinese domains), geosite:ads (advertising domains), and geosite:private (private domains). geoip is an IP classification database. Common tags include geoip:cn (Chinese IP ranges), geoip:private (private addresses), and geoip:lan (LAN).
For 'domestic direct', you need to match both geosite:cn and geoip:cn. For 'everything else goes through the proxy', you can let the default outbound handle it without writing extra rules.
geosite:cn
- Type
- Domain classification database
- Coverage
- Chinese domains and CDNs
- Typical tags
- geosite:cn
Used to match domestic website domains; direct connection when matched.
geoip:cn
- Type
- IP classification database
- Coverage
- Chinese IP ranges
- Typical tags
- geoip:cn
Used to match domestic server IPs; direct connection when matched.
Both rule databases update with the client, so no manual maintenance is needed. In v2rayN 7.x, they are stored as .dat files in the bin folder under the installation directory.
Complete rule set configuration: domestic direct, international proxy
On the v2rayN routing settings page, click the 'Add' button and create rules in the following order. Note that the order cannot be reversed, or split tunneling will fail.
Rule 1: Domain geosite:cn → Outbound direct
Rule 2: IP geoip:cn → Outbound direct
Rule 3: IP geoip:private → Outbound direct
Rule 4: Default outbound → Outbound proxyAfter creating the rules, click 'OK' to save, then restart the v2rayN core. Now domestic websites will connect directly, international websites will go through the proxy, and LAN addresses will bypass the proxy.
Conclusion: Rule order determines split tunneling effectiveness
In v2rayN, rules are matched from top to bottom in the list and stop at the first match. The domestic direct rule must be placed first, otherwise domestic traffic will be matched by the 'default proxy' rule first.
Troubleshooting order when rules don't work
After configuration, if split tunneling doesn't work, check in the following order:
- Check that the rules are saved and the core is restarted. After modifying routing rules, click the v2rayN icon in the bottom-right corner and select 'Restart Core' for the new rules to load.
- Check that the default outbound is set to 'Proxy'. If the default outbound is 'Direct', international traffic will connect directly, causing access failures.
- Check that the domain strategy is set to 'AsIs'. In routing settings, when the domain strategy is 'AsIs', domains are matched as-is; when set to 'IPIfNonMatch', IPs are additionally resolved and then matched against IP rules.
- Check DNS settings. If DNS resolves a domestic domain to an overseas IP, even if the domain matches geosite:cn, the actual connected IP won't belong to geoip:cn, and traffic will go through the proxy.
DNS settings are the most commonly overlooked. In 'Settings' → 'Preferences' → 'DNS', set the DNS server to 223.5.5.5 or 119.29.29.29 to avoid domestic domains being resolved to overseas IPs.
Why do domestic sites still go through the proxy?
First check the rule order: are the direct rules for geosite:cn and geoip:cn placed before the 'default proxy' rule? Then confirm the default outbound is 'Proxy' and not 'Direct'.
Why can't I open international sites? Did they connect directly?
Check whether the default outbound has been changed to 'Direct'. v2rayN's default outbound only takes effect when no rules match. If the default outbound is Direct, international traffic will be sent directly to the target server.
Do I need to restart the client after changing rules?
Yes. After modifying routing rules, click the v2rayN icon in the bottom-right corner and select 'Restart Core', or restart the v2rayN program directly, for the new rules to load.
Advanced: Split tunneling by application
In addition to routing by domain and IP, v2rayN 7.x also supports routing by process name. Add a rule in the rule list and enter the program name in the 'Process' field to make a specific app go through the proxy or direct.
- To make a game connect directly: enter game.exe in the process field and select 'Direct' for outbound.
- To make a browser go through the proxy: enter chrome.exe in the process field and select 'Proxy' for outbound.
- To make a domestic chat app connect directly: enter qq.exe in the process field and select 'Direct' for outbound.
Note that the process name must be complete and case-sensitive. If the process name doesn't match, the rule won't take effect.