Selective VPN

Route selected destinations through an L3VPN or L4 proxy while keeping other traffic on your normal Wi-Fi or cellular connection.

Prepare the output

Import a WireGuard configuration from Files/iCloud, scan its QR code, or create an interface for your own server. Other supported VPN/proxy outputs can be used with appropriate settings.

Use Rules Mode. Enable custom domain routing in DNS & Routing and configure both Direct DNS and VPN DNS.

Add routing rules

  1. Create a domain set containing the actual service/API domains you want to route through the VPN, then point a DOMAIN-SET rule to that VPN.
  2. Optionally create a CIDR set for services that use known IP ranges and add a CIDR-SET rule to the same VPN.
  3. For plain-IP VPN DNS upstreams, ensure their IP addresses have routes through the VPN. For encrypted VPN DNS upstreams using domains, also add VPN-DNS-SERVER-DOMAINS,L3VPN,<name> (or L4PROXY). This keeps their bootstrap resolution on the intended path.
  4. Set DNS-FALLBACK,DIRECT for domains that do not match a domain set.
  5. Set DEFAULT,DIRECT for other traffic.

More-specific routes should precede the default. Check the profile reference for syntax and target names. Save and restart VPN after editing.

DNS choices

MintFlow DNS handles app queries when domain routing is active. Set Direct DNS and VPN DNS in DNS & Routing, rather than relying on the deprecated system DNS override.

Use your provider's VPN DNS when appropriate. Example public servers are 8.8.8.8,8.8.4.4 for VPN DNS and 1.1.1.1,1.0.0.1 for Direct DNS; choose servers reachable on each path. Direct DNS may instead use a local resolver such as your Pi-hole. Some providers' DNS servers implement their own filtering; consult the original imported configuration.

Direct DNS is covered by the Direct default route unless another rule overrides it.

Expected result

Only matching destinations use the selected VPN/proxy. The remaining traffic uses Direct. This matches domains/IPs, not app process identity: one app can contact many domains, and multiple apps may share a domain. Use DNS Log and network diagnostics to confirm the actual paths.

Read this page as Markdown