# Selective VPN

Route selected destinations through an L3VPN or L4 proxy while keeping other traffic on your normal Wi-Fi or cellular connection.

## Prepare the output

Import a WireGuard configuration from Files/iCloud, scan its QR code, or create an interface for your own server. Other supported VPN/proxy outputs can be used with appropriate settings.

Use **Rules Mode**. Enable custom domain routing in **DNS & Routing** and configure both Direct DNS and VPN DNS.

## Add routing rules

1. Create a domain set containing the actual service/API domains you want to route through the VPN, then point a `DOMAIN-SET` rule to that VPN.
2. Optionally create a CIDR set for services that use known IP ranges and add a `CIDR-SET` rule to the same VPN.
3. For plain-IP VPN DNS upstreams, ensure their IP addresses have routes through the VPN. For encrypted VPN DNS upstreams using domains, also add `VPN-DNS-SERVER-DOMAINS,L3VPN,<name>` (or `L4PROXY`). This keeps their bootstrap resolution on the intended path.
4. Set `DNS-FALLBACK,DIRECT` for domains that do not match a domain set.
5. Set `DEFAULT,DIRECT` for other traffic.

More-specific routes should precede the default. Check the [profile reference](../profile.md) for syntax and target names. Save and restart VPN after editing.

## DNS choices

MintFlow DNS handles app queries when domain routing is active. Set Direct DNS and VPN DNS in **DNS & Routing**, rather than relying on the deprecated system DNS override.

Use your provider's VPN DNS when appropriate. Example public servers are `8.8.8.8,8.8.4.4` for VPN DNS and `1.1.1.1,1.0.0.1` for Direct DNS; choose servers reachable on each path. Direct DNS may instead use a local resolver such as your Pi-hole. Some providers' DNS servers implement their own filtering; consult the original imported configuration.

Direct DNS is covered by the Direct default route unless another rule overrides it.

## Expected result

Only matching destinations use the selected VPN/proxy. The remaining traffic uses Direct. This matches domains/IPs, not app process identity: one app can contact many domains, and multiple apps may share a domain. Use DNS Log and network diagnostics to confirm the actual paths.