Direct Routing

What is Direct Routing?

Direct Routing (also known as Split Tunneling) is a feature that allows you to choose which traffic goes through the encrypted tunnel and which traffic uses your regular internet connection directly.

Why Use Direct Routing?

Access Location-Restricted Services

Some services only work from specific countries or IP ranges:

• Government portals — Tax services and public services may require local IP
• Banking apps — Some banks flag foreign IP addresses as suspicious
• Other websites and services — Anything that requires a local IP to work correctly

Improve Performance

Some traffic doesn't need protection and runs faster without the tunnel (unless these services aren't available over your default connection):

• Video calls — Zoom, FaceTime, Google Meet benefit from Direct Routing for lower latency
• Gaming — Online games where every millisecond matters
• Large downloads — Updates, backups, or file syncing that don't contain sensitive data

Compatibility

Some applications don't work well through the tunnel:

• Local network devices — Printers, smart home devices, network shares
• Captive portals — Hotel/airport Wi-Fi login pages
• Corporate apps — Some work applications that detect proxies and block access

How Direct Routing Works

RAGE maintains two routing tables simultaneously:

1. Tunnel route — Default path for all traffic, encrypted through RAGE server
2. Direct route — Alternative path for specified domains, using your regular ISP connection

When you access a website:

1. RAGE checks if the domain is in your Direct Routing list
2. If matched, traffic goes directly to the destination
3. If not matched, traffic is encrypted and sent through the RAGE tunnel

Websites vs. apps

Direct Routing works best with websites and web services — anything you open in a browser. RAGE reads the hostname straight from the connection (TLS SNI / HTTP Host) and matches it precisely against your Direct Routing list.

Apps are trickier: their traffic often carries no recognizable domain — they hit a hard-coded IP, encrypt the server name (ECH), or use protocols with no hostname at all. Then the sniffer only sees an IP, not a domain.

You could add every IP to the list, but it would become a huge, unreadable feed. And iOS architecture doesn't let anyone tell which app reached a given address.

Configuring Direct Routing

Adding Domains

1. Open RAGE and go to Settings
2. Tap Direct Routing
3. Tap Add Domain
4. Enter the domain (e.g., bank.com) and tap Add

Subdomains are matched automatically

Direct Routing uses suffix matching, so you don't need to list every subdomain by hand. Adding a root domain covers itself and every subdomain underneath:

• google.com — matches google.com, www.google.com, mail.google.com, maps.google.com, …
• example.com — matches the root and every subdomain of example.com

Wildcards like *.google.com are not needed and the input field won't accept them.

Domain Recorder: capture the right domains automatically

Modern websites and apps often pull resources from a dozen third-party domains (CDNs, auth providers, analytics). Guessing which one a broken site needs is painful, so RAGE includes a built-in Domain Recorder that captures every domain accessed through the tunnel during a short recording session — pick the relevant ones with a tap and they go straight into Direct Routing.

1. Open RAGE → Settings → Domain Recorder
2. Tap Start. The tunnel reconnects automatically to enable capture.
3. Open the site or app that isn't working through the tunnel.
4. Return to Domain Recorder and tap Stop.
5. Captured domains are grouped by root domain. Tick the ones related to your issue.
6. Tap Add Selected to Bypass — they're added to Direct Routing instantly.

Direct Routing vs. Turning Off RAGE

Why use Direct Routing instead of just disconnecting from RAGE?

Security Considerations

Best practices:

• Only add domains you trust and that require local IP
• Avoid adding domains where you'll enter sensitive data (unless required)
• Periodically review your Direct Routing list and remove unused entries
• Use specific domains rather than broad wildcards when possible