v2rayN Split Tunneling: Route Mainland China Traffic Directly and Proxy Overseas Traffic

System Proxy vs. Split Tunneling

The system proxy determines whether a request reaches the client; routing rules determine where it goes next. They are separate settings. Even with “Bypass Mainland China” selected, programs that don’t use the system proxy or have no proxy configured separately may still access the internet directly over your regular connection.

For example, when you visit a website in a browser with the system proxy enabled, the browser passes the connection to a local listening port if it supports system proxy settings. The core then checks the destination domain, IP address, and other criteria against the routing rules. Requests matched to a direct rule leave over your local network; those matched to a proxy rule go through the selected server.

“Set system proxy” doesn’t mean “send every site through the server,” and “clear system proxy” doesn’t disable the client’s routing rules. Before troubleshooting, check whether the request reached the core, then find the rule it matched. This avoids repeatedly changing the wrong setting.

Enable “Bypass Mainland China” and keep the existing configuration

Menu locations and preset names can vary slightly between v2rayN versions. In common desktop builds, manage rules under Settings → Routing Settings, then choose a routing profile from the selector at the bottom of the main window. “Bypass Mainland China” generally sends mainland Chinese domains or addresses directly and routes other requests through a proxy. The outbound connection is selected by domain and IP matching rules.

1. Note your current settings. Record the routing profile, system proxy status, and active server. Before changing a preset, make a copy for your own use if possible. If the interface supports exporting, save a backup as well.
2. Check that the server works. After importing your subscription, select an active server and make sure it connects. A subscription link provides server settings; it doesn’t automatically choose all your routing policies.
3. Check the local entry point. Open Settings → Parameters and find the local listening port settings. Note the address, port, and supported proxy protocols shown in your interface—don’t copy someone else’s port.
4. Set the system proxy. From the main window or tray menu, choose “System Proxy” → “Set system proxy automatically.” Make sure it isn’t still set to “Clear system proxy.”
5. Choose a split-tunneling preset. Select “Bypass Mainland China” or an equivalent profile from the routing selector. Check that its rules include direct connections for mainland China and confirm the default route for requests that don’t match a rule.
6. Start fresh connections. Save the settings and restart the core if prompted. Close existing browser connections before testing again so they don’t reuse connections established before the change.

Don’t leave “Global Proxy” enabled as your final setup for splitting domestic and overseas traffic. It’s useful for temporarily checking whether a server can reach a service, but it changes the exit route for mainland Chinese sites. After testing, switch back to your intended routing profile and reconnect.

These three numbers refer to the local entry point, the web destination service, and domain name resolution, respectively; they aren’t interchangeable. The 10808 value below is for illustration only, not a default port for every installation. If your listening port differs, update the test commands too.

Direct, Proxy, and Block Rules—and Rule Order

Routing rules are usually checked from top to bottom, and the first matching rule determines the outbound route. A broad rule near the top can prevent a more specific exception below it from taking effect. When customizing, add only an exception you actually need, and place it above any broad rule that conflicts with it.

The word “direct” in the interface isn’t the same as an outbound tag in the configuration. A configuration might use direct, proxy, and block as tags, but each tag is just a name and must point to an outbound that actually exists. Changing a word alone doesn’t create the corresponding connection type.

geosite:cn is a domain category, not “all Chinese-language websites.” geoip:cn is an IP category, not a reliable indicator of where a website operator is based. A service may use an overseas CDN, and a mainland Chinese domain may resolve to addresses in different regions. Check the actual request and matching log entries rather than relying on a site’s name.

Understand Custom Routing with a Minimal Rule Set

The snippet below shows part of an Xray routing configuration to illustrate the order of specific exceptions, direct rules for mainland Chinese domains, and direct rules for mainland Chinese IPs. It isn’t a complete client configuration and can’t be pasted into just any v2rayN rule import window. When editing in the interface, enter the same criteria in the corresponding rules.

{
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "domain": ["full:example.com"],
        "outboundTag": "proxy"
      },
      {
        "type": "field",
        "domain": ["geosite:cn"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": ["geoip:cn"],
        "outboundTag": "direct"
      }
    ]
  }
}

• Check the outbound tags first. This example assumes the configuration already defines outbounds named proxy and direct. If your names differ, update the references accordingly.
• Understand when IP resolution happens. IPIfNonMatch means that if a domain doesn’t match a rule, the core tries to resolve its IP address and continues matching IP rules. Requests that already match a domain rule don’t need this extra step for routing.
• Check the category data. The core needs access to the relevant category data to use geosite and geoip criteria. If the resources fail to load, use the client’s built-in update method to repair them first.
• Keep the default route in mind. This snippet doesn’t define what happens when no rule matches. Xray typically uses the first outbound when no rule matches; v2rayN may also express the default policy through a generated final rule. Check the actual generated configuration.

Block rules also follow the first-match principle. Add one only when you know exactly what the target domain is used for, and test with a single exact domain first. Blocking an entire shared domain category could also affect sign-in, verification codes, or static assets, leaving the page open but key features broken.

Verify Direct Connections in Mainland China and Proxy Connections Overseas

Verify both that the connection succeeds and that it uses the correct outbound route. A fast-loading page doesn’t prove it connected directly. An IP-check page showing the server’s address only tells you how that particular request was routed, not whether every other site uses the same route.

1. Check the core log. Find new connection entries in the v2rayN log panel. If your current log level doesn’t show connections, temporarily set it to info in the core settings under Settings → Parameters, apply the change, and test again.
2. Test a mainland Chinese website on its own. Visit a site you use regularly, such as www.baidu.com. Find the entry by domain or resolved destination address and confirm it uses the direct outbound.
3. Test an overseas service on its own. Visit a service you actually need to access through a proxy and confirm the new connection uses the proxy outbound. A single page may request multiple domains, so check the main page, sign-in API, and image assets separately.
4. Record results before and after changes. Note the test time, routing profile, destination domain, outbound tag, and any error messages. Change one thing at a time so you can identify the cause instead of changing the server, DNS, and routing all at once.

You can also specify the local HTTP proxy entry point in a command to rule out the possibility that an application isn’t using the system proxy. These commands are for Windows curl.exe and assume 127.0.0.1:10808 actually provides an HTTP proxy. If that port supports SOCKS only, this syntax won’t work.

curl.exe --proxy http://127.0.0.1:10808 --connect-timeout 10 --max-time 20 -I https://www.baidu.com/
curl.exe --proxy http://127.0.0.1:10808 --connect-timeout 10 --max-time 20 -I https://www.wikipedia.org/

The 10-second value in the command is the connection timeout; 20 seconds is the time limit for the entire request. Neither is a speed measurement. The second domain is just an overseas service test target. Whether it actually uses the proxy depends on your current rules and logs. An HTTP status code means a response was received, though the specific status may also depend on the site’s access policies.

Troubleshoot Incorrect Routing, Failed Pages, and Subscription Updates

DNS is an often-overlooked part of split tunneling. With secure DNS enabled, a browser may resolve domains itself. If a request reaches the core as an IP address, whether a domain rule can match depends on the inbound information and sniffing settings. Don’t enable sniffing globally at the first sign of trouble. First check whether the log shows a domain or only an IP.

After testing, restore the log level to your usual setting and keep a verified copy of the routing profile. When asking for help, share only the necessary destination domains, error messages, and sanitized configuration snippets. Don’t share subscription links, server credentials, or full logs containing browsing records.

• First confirm that traffic reaches the client, then check the routing rules.
• Start with a preset and put specific exceptions above conflicting rules.
• Verify both direct connections in mainland China and proxy connections overseas—not just whether a page loads.
• If something goes wrong, restore the previous profile and troubleshoot one setting at a time.