How to set up PAC and routing in v2rayN

For the scheme "only selected sites via the proxy" you need domain rules and a final direct rule.

Splitting methods are described in the split tunneling basics. This guide covers v2rayN 7.25.6; it assumes the server has already been added and the connection works.

Choose how traffic is captured

The System proxy menu has four modes; TUN is enabled separately.

v2rayN runs on Windows, Linux and macOS. Set system proxy does not guarantee capturing all programs: some use their own settings.

PAC is a local script: PROXY sends a request to the core's HTTP port, DIRECT sends it directly. For the selected-domains scheme, assign them PROXY in the script and everything else DIRECT.

To use your own file, specify a path:

Custom PAC file path

Check an address from the list and one outside it. After PROXY, the core's rules also apply.

Enable TUN for the remaining programs

If a program does not use the system proxy, I recommend TUN:

Enable Tun → Auto Route

In sing-box, Auto Route points the default route to the virtual interface. Check the connection from the program in question. In the rules, the tun inbound means TUN, socks means the local proxy port.

According to the sing-box documentation, Strict Route on Windows prevents DNS leaks caused by multi-interface name resolution. It may interfere with some programs, such as VirtualBox: test them after changing it.

Check the built-in rule set

Capture is chosen. On first launch, V4-绕过大陆(Whitelist) is active, designed for China. In the menu, the built-in sets have Chinese names with an English label in brackets; below I use the abbreviations V4-Whitelist, V4-Blacklist and V4-Global. The default set does not automatically treat British sites as local.

All three sets block UDP 443 and only apply to captured traffic.

On Windows, the "do not proxy local addresses" option adds <local> to the system proxy exceptions. Its effect is limited to the system proxy; for TUN and the core's rules, configure LAN exceptions separately as shown below. Public British websites are not part of the LAN.

Create your own set with an explicit final rule

Open the editor for the chosen set:

Routing Setting → your set → Rule Settings

Set a condition and the outboundTag outbound: proxy, direct or block. After saving, check that your set is active.

Four fields are needed:

• Domain: domain:example.com — a domain with subdomains; full:example.com — an exact name; geosite: — a ready-made list.
• IP: an address, a CIDR subnet such as 192.168.1.0/24, or the geoip:private list.
• Process (Linux/Windows): a condition by process.
• outboundTag: the outbound for a matched connection.

Multiple values are entered comma-separated; a # at the start disables a line. Rules are checked from top to bottom, and the first match fires. All filled-in conditions of a single rule are combined with a logical AND: a domain plus a process means that process accessing that domain.

Here you can choose domains; routing by addresses and subnets is covered in the guide on WireGuard AllowedIPs.

Send only the selected sites through the proxy

Put the domain rule first and the general direct rule last. Here are two rules in Xray format:

[
  {"type":"field","domain":["domain:example.com"],"outboundTag":"proxy"},
  {"type":"field","port":"0-65535","outboundTag":"direct"}
]

Replace example.com with the domain you need. Temporarily add an IP-checking domain: you should see the proxy address. Remove it and reconnect: you should see your direct address.

Exclude the LAN and chosen sites from general proxying

The reverse scheme contains four rules in this order:

• IP: geoip:private → direct.
• Domain: geosite:private → direct.
• Domain: domain:example.com → direct.
• Port: 0-65535 → proxy.

The LAN conditions are separated deliberately: in a single rule, the domain and the IP would have to match simultaneously. Check the printer, the excluded site and the external IP on a site outside the exceptions.

For example, the printer and the chosen site remain accessible directly. A general rule placed above would make the exceptions unreachable.

Choose an IP-checking strategy

For a query by name, the outcome of the IP rules depends on a parameter:

domainStrategy: AsIs / IPIfNonMatch / IPOnDemand

AsIs does not perform DNS resolution specifically for routing. IPIfNonMatch resolves the name and checks the IP if the rules produced no domain match. IPOnDemand resolves the name upon encountering an IP condition.

The general "any port" rule already produces a match and can prevent the second pass of IPIfNonMatch. Check a domain with a known IP in the relevant subnet.

Check both directions

Reconnect the program after saving. Compare the external IP in the browser and in a program outside the rules, if it can display it. The selected connection should show the proxy address, and the excluded one your direct address.

If both IPv4 and IPv6 are available, check both. A direct connection does not receive the protection of the proxy tunnel.

Set up apps on Android

On a phone, a separate client, v2rayNG, is used. In Per-app proxy, the ticked apps go through the proxy and the rest go directly. Bypass Mode reverses the selection: the ticked apps are excluded. For the local network there is Bypass LAN in VPN mode.

To set up this scheme on Android, I recommend CitadelVPN: the service provides a subscription link for v2rayNG. Add it to the client, refresh the list, choose the connection and configure Per-app proxy. Check the external IP in the chosen app; the support team can help with the setup.

The process condition by package name requires Xray TUN with routeOnly enabled and Android 10 or newer. For ordinary app selection, this step can be skipped.

Frequently asked questions

Lock in your chosen setup

For selected sites, set domain: → proxy, then a general direct. For the reverse scheme, put the LAN and site exceptions above the general proxy. In the UK, use your own exceptions instead of the Chinese lists. Check the capture and the exit address for both routes.