v2rayN Split Tunneling for Mainland China and Overseas Traffic: How to Configure Presets, Whitelists, and Blacklists

How domestic and overseas traffic is routed

v2rayN does not simply identify a website and switch nodes. An application request first reaches a local proxy port. The Xray core then identifies the target domain or IP address and checks routing rules from top to bottom. The first matching rule sends the connection through a proxy, direct, or blocked outbound; if nothing matches, the route’s default outbound is used.

In common desktop setups, the local SOCKS port is 10808 and the local HTTP port is 10809. After the system proxy is enabled, browsers and applications that support system proxy settings usually send requests through these entry points. TUN mode covers more traffic, but the routing logic remains the same: identify usable target information, apply the rules, then select an outbound.

Domain and IP rules apply under different conditions. When a browser sends a request by domain, domain, geosite, and domain-suffix rules can be evaluated directly; connections that provide only an IP mainly rely on ip, geoip, or the resolved address. With IPIfNonMatch, the core resolves the IP when no domain rule matches, then tries IP-based rules.

The practical difference between “Bypass Mainland China,” whitelist, and blacklist modes

v2rayN 7.x routing settings generally offer preset profiles that can be copied and edited. Names may vary slightly between minor releases, so do not judge a profile by its label alone—check its rules and default outbound. “Bypass Mainland China” typically sends private networks, mainland-China domains, and mainland-China IPs directly, while handing unmatched traffic to the proxy outbound.

In this type of profile, mainland-China targets form an explicit direct-connection list. The interface or tutorials may describe this as a whitelist approach: known mainland-China and private addresses connect directly, while unknown targets use the proxy by default. The benefit is reliable coverage—new overseas domains can still use the proxy even before they appear in a category database. The trade-off is that mainland services missing from the categories may also be sent through the proxy.

Blacklist routing works the other way around: explicitly listed overseas targets, specific domains, or specific IPs use the proxy, while everything else connects directly by default. This reduces the chance of unknown targets entering the proxy and suits environments that access only a small set of fixed services, but it depends on list coverage. When a domain changes, a new endpoint is added, or a third-party resource is called, the main page may load while login, images, or API requests still go direct.

Global proxying is not a fine-grained routing strategy. It sends most connections through the proxy and is useful for temporarily checking whether a node works. If global mode works but split routing does not, the issue is usually rule matching, DNS resolution, or rule data—not the VMess or VLESS node itself. Switch back to split routing after troubleshooting to avoid unnecessary detours for mainland downloads, video, and local-network connections.

Building a maintainable split-routing profile in v2rayN

Before making changes, confirm that the node connects normally and note the currently working profile. These steps use v2rayN 7.x as the reference: open “Settings” → “Routing settings,” select the preset closest to your needs, and copy it as a new custom profile. Keeping the original preset makes rollback quick if a rule is wrong and gives you a reference for rule order and outbound labels.

1. Choose the default outbound. For everyday browsing across mainland-China and overseas services, send unmatched targets through the proxy; for fixed workplace targets, send unmatched targets directly.
2. Keep private networks direct. Put geoip:private, local-network domains, and local addresses near the top of the direct rules so router admin pages, printers, and intranet services remain reachable.
3. Add mainland-China categories. Send geosite:cn and geoip:cn to the direct outbound, and use your domain-resolution strategy to decide whether both match types are needed.
4. Add precise exceptions. Put business domains that must use the proxy or direct connection before category rules, so broad sets cannot match them first.
5. Save and reload the configuration. Select the new profile, restart the core, and then run connection tests. Saving rules without switching to the active profile does not change existing traffic.

The structure below illustrates Xray routing order. Avoid overwriting the running configuration outside the v2rayN interface, because the client may replace manual edits when it regenerates the configuration. The key points are private addresses direct first, precise exceptions before category rules, mainland-China categories direct, and the default rule handling everything left over.

{
  "domainStrategy": "IPIfNonMatch",
  "rules": [
    {
      "type": "field",
      "ip": ["geoip:private"],
      "outboundTag": "direct"
    },
    {
      "type": "field",
      "domain": ["domain:service.example"],
      "outboundTag": "proxy"
    },
    {
      "type": "field",
      "domain": ["geosite:cn"],
      "outboundTag": "direct"
    },
    {
      "type": "field",
      "ip": ["geoip:cn"],
      "outboundTag": "direct"
    }
  ]
}

Rule combinations for common scenarios

A home desktop typically includes mainland-China websites, overseas services, local-network devices, and background system connections. Start with “private networks direct, mainland-China targets direct, everything else proxied,” then add precise exceptions for a few misclassified targets. This keeps mainland video and software downloads on local exits while reducing the chance that new domains fail because category data has not covered them yet.

For remote work, put corporate intranet domains, DNS suffixes, and dedicated addresses at the highest priority. If a corporate service uses an intranet domain that resolves to a private address, relying only on geoip:private may require waiting for domain resolution before it matches. Adding an explicit direct rule for domain:corp.example makes the behavior clearer. Corporate network policies take precedence over general presets.

Scenario 1: mainland services direct, everything else proxied

• Group 1: direct connections for local addresses, the LAN, and geoip:private.
• Group 2: exact domains that must use the proxy, placed before mainland-China categories.
• Group 3: direct connections for geosite:cn and geoip:cn.
• Final rule: unmatched targets go to the proxy outbound.

Scenario 2: proxy only fixed business services

• Create proxy rules for the business’s primary domain, login domain, API domains, and static asset domains.
• Use logs to add third-party authentication, object storage, and content-delivery domains.
• Keep other targets direct and review business-domain changes regularly.
• Test more than the homepage: also test login, downloads, uploads, and long-lived connections.

Scenario 3: correct a misclassification for one domain

Verifying logs and troubleshooting split routing

Do not validate split routing only from the outbound-address page. A webpage usually requests the main document, images, scripts, authentication APIs, and content-delivery domains at the same time, and different requests may match different rules. During verification, open v2rayN connection details or core logs and record the target domain, target port, matched outbound, and failure reason, then compare them with the custom rules one by one.

Create a fixed test set: five mainland-China websites, five websites that require the proxy, two local-network addresses, and two applications that depend on login APIs. After saving the rules, restart the core, clear each application’s connections, and visit them again one by one. In a browser, close existing tabs and reopen them to prevent connection reuse from keeping the old outbound active.

1. First use global proxy mode to test the active node and confirm that the VMess or VLESS connection itself works.
2. Switch back to the custom route and check whether the same target reaches the expected outbound.
3. Check whether an earlier rule matched the target first.
4. Check whether the domain request was resolved to an IP too early, leaving the domain rule no opportunity to match.
5. Restart the core after updating routing data, then run the same test set again.

DNS is also part of split-routing verification. Resolution results can change with the network, time, and service scheduling, so the same service may return mainland-China or overseas addresses. Long-term rules based on a single IP are fragile. Prefer domain rules for service identification, and use IP rules for private networks, stable ranges, and supplementary checks when domain rules do not match.

Rule data needs regular updates, but rerun the fixed test set after each update. Changes to category sets may fix old misclassifications or move a domain that previously relied on the default outbound into a new category. A maintainable profile keeps a small number of explicit exceptions, a clear rule order, and repeatable test records instead of continually stacking broad rules.