v2rayN Split Tunneling: Route Mainland China Sites Directly and International Traffic Through a Proxy

1. System Proxy vs. Split Tunneling

The system proxy determines whether an app sends its connections to v2rayN. Routing determines which outbound handles a connection after it reaches the core. Enabling “Auto configure system proxy” does not send every connection through a remote node: if a rule matches direct, the connection goes straight out from your device. Conversely, apps that ignore the system proxy will not enter the core just because you change the routing mode.

First, go to Settings → Parameter Settings and check the local listening ports. Then check the system proxy and routing selections at the bottom of the main window. The ports below are for this test only; they are not necessarily the defaults in every version. If your device shows different ports, update the numbers in the commands too. Turn TUN off during testing to avoid confusion from having two connection paths active at once.

2. Create a Reusable Baseline with Bypass Mainland China

In the main window’s routing selector, enable a preset with “Bypass mainland China” in its name. Names may vary between versions and imported rule sets, so check the actual rules under Settings → Routing Settings instead of relying on the name. Back up your current routing configuration, then make a separate test copy and keep the original preset for rollback.

1. Select a node you have confirmed can connect, and keep it unchanged throughout testing.
2. Open Settings → Routing Settings and check that the current configuration includes direct rules for mainland China domains, mainland China IPs, and local network traffic.
3. Confirm that there is a proxy fallback: TCP and UDP connections not matched by earlier rules should go to the proxy outbound.
4. Save and switch to the test configuration to reload the core. Check the logs for configuration errors before testing.

direct, proxy, and block are the tag names used in this article, not reserved keywords recognized automatically by the core. In common configurations, they correspond to direct, node, and blocking outbounds. If your generated configuration uses different tags, update the routing rules to match. A blocking rule in particular requires a corresponding blackhole outbound; adding a rule named block is not enough.

3. Rule Order for direct, proxy, and block

Xray checks rules from top to bottom and selects the corresponding outbound as soon as a rule matches. It does not keep searching for a “more specific” match. If you put a rule that forces a site through the proxy after a mainland China IP direct rule, the connection may match the IP rule first and bypass the proxy. For reliable results, place specific domain exceptions before broader sets, and keep the fallback rule last.

This is an example routing section from a native Xray configuration, not a complete, standalone configuration. It assumes all three outbound tags already exist and the data files include the referenced sets. In the v2rayN interface, convert these objects into the corresponding rule entries. Merge this into the top-level configuration only if you are using a complete custom configuration.

{
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "domain": ["full:example.com"],
        "outboundTag": "proxy"
      },
      {
        "type": "field",
        "domain": ["geosite:category-ads-all"],
        "outboundTag": "block"
      },
      {
        "type": "field",
        "domain": ["geosite:cn"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": ["geoip:private", "geoip:cn"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "network": "tcp,udp",
        "outboundTag": "proxy"
      }
    ]
  }
}

4. Add Direct-Site Exceptions and Block Ads

Before adding a rule, decide whether you need an exact hostname match or a domain-suffix match. Use full: to route only the main hostname directly; use domain: to include the domain and its subdomains. A page may load content from separate login, image, and API hosts, so if the homepage loads but login fails, check which host the request uses instead of routing all traffic directly.

• full:www.qq.com: Matches this exact hostname only, not its subdomains.
• domain:qq.com: Matches qq.com and its subdomains, such as www.qq.com.
• geosite:cn: References the mainland China domain set in the data file. It does not include every domain ending in .cn.
• geoip:cn: Checks whether the destination IP belongs to the specified address set, not the page content or domain suffix.

For example, to explicitly route Tencent-related domains directly, add the following rule before the general sets. This illustrates the match scope; not everyone needs to add it. If an existing set already covers these domains, duplicating the rule only adds maintenance overhead.

{
  "type": "field",
  "domain": ["domain:qq.com"],
  "outboundTag": "direct"
}

To block ads, you can use geosite:category-ads-all. It only affects connections that pass through the core and match the set; it does not remove empty spaces on a page like a cosmetic filter. If the data file does not contain this set, the core may fail to load. Check the logs and the source of the data files before deciding whether to update the data or remove the rule.

5. Verify Outbound Selection with Requests and Logs

A page loading only proves that a working connection path exists; it does not prove that the rules are correct. During testing, record the request destination, the actual inbound port, and the outbound tag in the logs. The client’s speed test usually checks the node; it does not confirm that the browser’s current request was routed as expected.

1. Save the routing configuration and reload the core. Confirm there are no configuration errors. If needed, temporarily increase the log verbosity under Settings → Parameter Settings.
2. Test the destination with a command that explicitly specifies the proxy to avoid interference from browser caches, background connections, or proxy extensions.
3. Test a mainland China domain, a domain that should use the proxy fallback, and a test domain confirmed to be in the current ad set.
4. Check the core access logs at the time of each request for the outbound tag. If the current log level does not record access requests, adjust the logging configuration before testing.

curl --proxy http://127.0.0.1:10809 --connect-timeout 10 -I https://www.qq.com/
curl --proxy http://127.0.0.1:10809 --connect-timeout 10 -I https://example.com/
curl --proxy socks5h://127.0.0.1:10808 --connect-timeout 10 -I https://example.com/

In Windows Terminal, if curl runs a different command, use curl.exe instead. HTTPS requests through an HTTP proxy usually send the target hostname using CONNECT. socks5h also passes the domain to the proxy for resolution. This makes domain-rule testing more reliable by avoiding a local lookup that could turn the test into an IP-based match. A 403 or 405 response does not necessarily mean the connection failed; check the target’s response and the outbound logs.

The table shows expected routing, not network performance measured by this site. Browsers may reuse existing connections and temporarily show no change after a rule update. Close old connections or send a new request with a command. After testing, restore the usual log level to avoid accumulating detailed records of visited destinations.

6. DNS, IP Rules, and Common Routing Issues

Routing and DNS resolution are related, but they are not the same setting. domainStrategy controls when routing needs to resolve a domain for matching. It does not specify which DNS server to use or guarantee that DNS requests go through the proxy. In particular, after enabling on-demand IP matching, an incorrect resolution result could send a domain that should use the proxy to a mainland China IP direct rule.

7. Save and Maintain Your Rules

Subscription nodes and routing configurations do different jobs: nodes provide remote connection settings, while routing determines which connections use them. Updating a subscription does not update geosite or geoip data, and it is not a fix for incorrect rule order. After changing the core, recheck the rule syntax, data files, and outbound tags instead of assuming the old configuration will work unchanged.

• Keep a working Bypass Mainland China baseline, and change only one target domain or rule at a time.
• Record the change date, match scope, outbound tag, and verification command so you can reproduce or roll back the change.
• After updating domain or IP data, retest direct, proxy, and block scenarios to catch changes to sets that may affect existing exceptions.
• For more background, see the Troubleshooting Guide. If you are setting up a local proxy for the first time, start with the Getting Started Guide.

The result should be a clear chain of checks: the app reaches the client, the rules are ordered as expected, the destination matches a specific tag, and that outbound has a working connection. Only when all four can be verified against the configuration and logs can you distinguish a routing error from a DNS issue or an unavailable node.