I use VPN a lot. The thing is, most of the time I don't want everything to be tunneled through the VPN connection. It's just a certain app, domain or service that I want to access that is blocked by ISP/Gov.

Like the youtube app on android, or the twitter site on my laptop. I have to constantly keep my VPN open and connected to access these services. Which slows down the connection speed for already-accessible sites, or messes up online payments, etc...

I want to know if there is a way to use a vpn/proxy connection, that can be set per app/domain?

I know this can't be done on normal modems and wifi stations. But maybe a pc/server that can act as a middleware or custom router. Something that can look into the requests, see which ones matches a rule set by admin that should be directed to the vpn server.

I was thinking about maybe a raspberry pi, or a tiny pc, with a nodejs app that can do that...?

Btw It was hard to come up with the title's name, but please proceed with an edit if you have a good title for this question.


You would have extreme difficulty doing this from a device other then the PC you are making the request from, although you may be able to push things through a cache and have it do some magic - but very hard, messy and protocol dependent.

There is, however, a fairly easy middle ground - instead of doing it by domain, you can do it by IP address.IP range, and this is relatively straightforward.

A VPN appears as a virtual connection. Typically either everything is routed across it or only a specific range (for businesses). That said, it looks to the OS like a standard connection, so (provided the remote end does NAT or you have a "proper" IP associated with it) you can simply route some IP addresses/ranges down the VPN with the default going out your regular connection. Exactly how you do this depends on your OS and VPN type and provider, but worst case a script with routes should do you.

Substantially harder would be to configure a powerful router ( dd-wrt for example ) to do policy based routing based on port.

  • I know it's easier to do on one's own device that the request is being made but that is not possible or convenient on phones and tablets. It's hard to manage and setup vpn/proxies for each member of your family members. I thought maybe I could setup a device or something that can sit between the users and the modem and do the job. Also I'm not sure if IP based routing is better than domain based. Let's say you want to apply the vpn to the request when the user is trying to reach google clouds. You can't possibly go out there and figure out the entire google cloud's infrastructure ip range. – xperator Sep 1 '19 at 9:45
  • The other day I came across a dns service that would get around location based restrictions. Like for example if I want to access oracle site to download java, I can't do that because u.s gov has blocked it for Iranians. But if I apply that dns which i mentioned earlier, I can access their site. I don't know how it works, but it somehow acts like a vpn. It tricks u.s sites to think the request is being made from outside Iran. I did some googling on setting up a DNS server, I thought maybe I could do the same thing. I followed some tutorials and setup bind9 as dns forwarding. But didn't work. – xperator Sep 1 '19 at 9:56
  • "A device that sits between the users and modem" is a router. DNS changes ate not related to VPNs. Likely the source IP of your forwarder was still being seen as in Iran. I posit if you ran the DNS forwarder from a system with a VPN, and then got your DHCP server to hand out your DNS forwarder that would work for whatever idiots think DNS blocking is technologically sound. – davidgo Sep 1 '19 at 19:36

The functionality you are looking for is called "split tunneling," basically routing some traffic through a VPN and not others. You can do this to a certain degree on Windows/Mac. But it's more easily accessed through the use of a VPN provider's software, if they support it. Although the degree of control you are given varies a lot between different VPNs and many VPNs do not include it as a service.

For home networks, there are wifi routers customized by VPN vendors that come with their software and have this functionality built-in, and some VPN vendors also provide firmware for popular routers. These can make setting up the routing/split tunneling for a home network a lot easier. Although you can probably achieve the same results by manually configuring a router that has DD-WRT or Tomato installed, as @davidgo mentioned.

You can of course use a middleware such as a raspberry Pi. Although it might be easier just to get a DD-WRT compatible router for the same cost.

For reference, Comparitech's article on How to split Tunnel VPN traffic

  • Make sure to check your VPN service's policy on split tunneling. Sometimes, even if they don't provide it in their software, they will provide guidelines on how to set it up so that at least it won't interfere with their VPN software. – Gen Test Sep 1 '19 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.