Forwarding

Use one ordered list of network rules to send traffic from selected devices through an exit device, with application and network conditions.

Rule list

Configuration → Forwarding shows every forwarding rule in the network. Rules match from top to bottom and the first match wins. Traffic that matches no rule connects directly.

The page keeps How it works above the rules table. Each row shows the drag handle, name, devices, matched traffic (applications and networks), action and status. The status comes from checking the saved rules; hover over a status with warnings to see them. Edit at the end of a row opens the rule editor. Delete a rule from the editor footer and confirm the deletion.

Drag the handle, or focus it and move it with the keyboard, to reorder rules; the new order saves immediately. Put specific rules before broader rules so that a rule above does not match first.

In the page header, New rule adds a rule.

Editing a rule

Create and edit rules with the same steps: Name, Devices, Traffic source, Traffic match, Action and Preview. Editing prefills the saved configuration and retains changes when you revisit a step. Review the highlighted changes and checks, then choose Save and apply; intermediate steps do not save. Traffic source is skipped when none of the selected devices runs Linux.

The Choose applications dialog lists the network's custom applications and the platform application catalog. Search by name or vendor, and filter by all, catalog, custom or selected. The table shows each application's name, vendor, source and domain count; click a row to select or clear it. The platform catalog shows only names, vendors and domain counts, not domain lists. The bottom shows the selected applications, their total domains and the share of the selected devices' rule set capacity. To add a system the catalog does not have, create a custom application under the Custom filter; it is selected when saved. Changes reach the rule only after Done.

Before continuing or saving, select at least one destination application or network condition, including exclusions. Leaving No application conditions and No network conditions selected together is not allowed; source networks do not count as a destination condition. Selecting an include or exclude mode without adding any entries also blocks continuing or saving.

Destination applications and included destination CIDRs are OR: matching either matches the destination. Excluded destination CIDRs take precedence: a destination inside the exclusion does not match the rule. With no application or included network, an exclusion-only rule matches any destination outside its excluded networks, for example all destinations outside mainland China. Source CIDR and destination are AND, so both must match. Values within one field are OR.

Rules do not take domains or IP ranges typed in directly. Domain conditions are added through applications: for a system that is not in the catalog, create a custom application and enter its domains. Networks are chosen from the network catalog or custom networks. HTTP Host, TLS / QUIC SNI or a DNS address mapping can each satisfy an application domain.

Under Exit device DNS resolution, Use the exit device’s default DNS resolver uses the exit device's system DNS for the rule's application domains. Choose Use another DNS resolver through the exit device to enter an IP or IP:port, which the exit device queries over UDP. The address cannot be a loopback address or sit inside a site advertised by another device. If the exit is unavailable or the resolver does not answer, resolution fails rather than falling back to the local device or system DNS. Rules that use the device itself as the exit without a specified resolver use the local system DNS. Destination CIDRs do not involve DNS, so rules that match only CIDRs do not show this option.

The rules determine which traffic each device captures, so there is no separate capture range to configure.

Delete rule at the bottom left of the editor deletes the rule.

Applications and custom applications

The platform maintains the application catalog. Each application has a name and a domain list that covers those domains and their subdomains. Clients read DNS query names, TLS SNI and HTTP Host on the device and match connections by these domains and ranges; they do not collect traffic content.

When a rule's only destination is applications and none of them currently has a domain or range, the rule does not take effect on the device and the check shows a warning. It never falls back to matching every destination.

In the Choose applications dialog, switch to the Custom filter and select New custom application to add an application for this network:

Each application needs at least one domain or CIDR, and a network can have up to 1024 custom applications. Choose Edit at the end of a custom application's row to change or delete it; the editor lists the rules that reference it; after an edit, those rules use the new domains and ranges. An application referenced by a rule cannot be deleted; remove it from those rules first.

Custom networks are a named set of IP ranges that belongs to this network and can be used on the Include or Exclude side of several rules. In the Add networks dialog, switch to Custom and select New custom networks, then enter a name (unique within the network, up to 64 characters) and the IP ranges, in Host, Network or Regex rows as for custom applications: at least one entry, up to 4096 ranges and 256 regexes. A network can have up to 1024 custom networks. Choose Edit at the end of its row to change or delete it; the editor lists the rules that reference it; after an edit, those rules use the new ranges. Custom networks referenced by a rule cannot be deleted; remove them from those rules first.

Actions and exits

A rule has one action: matched traffic uses the selected exit device, optionally with an upstream SOCKS5 server. Traffic that matches no rule connects directly.

The exit must be a Linux or Windows device in the same network; macOS and mobile devices cannot act as exits. Offline or pending devices can be selected but must be approved and available to forward traffic. Exit failures do not fall back to direct access.

The exit can also be one of the rule's own devices. On that device itself, the rule connects directly without an upstream SOCKS5 server; with one, the device connects through the upstream proxy from the host. The other listed devices still go through that device.

SOCKS5 addresses use host:port or [IPv6]:port. Credentials are optional. Saved passwords are write-only: they are not shown, leaving the field blank keeps them, and they can be cleared explicitly; clearing the upstream address removes credentials. Changing the upstream address, username or exit device requires re-entering the password. Upstream failures do not fall back to direct access.

Site networks normally go to the announcing device; an explicit rule match applies the rule's action instead.

Save and checks

Saving rules runs a check first. Problems that block saving are highlighted on the affected fields, for example:

• The exit device does not exist or its platform cannot act as an exit.
• The proxy password must be re-entered after changing the upstream address, username or exit device.
• A device's application domain lists or forwarding configuration exceed its capacity.

These warnings can be confirmed and saved. When the Preview step has already shown them for the current draft, the save button reads "Accept n warning(s) and save" and clicking it confirms them:

• A rule is unreachable, for example because a rule above covers it completely.
• A destination overlaps a site network.
• A selected application has no domain or range.
• A rule references a deleted exit device, so traffic matching that rule is blocked.

When several people edit at the same time, saving reports that the rules were changed by someone else. Reload the page, reapply the change to the latest content and save again.

Verify the policy

For a first rule, start with a limited destination and a known reachable exit:

1. Add a rule for a single source device, choose one destination application or network, and select the exit device.
2. Move the rule before any broader rule that would match first, and check that the rule's excluded networks do not cover the destination.
3. Review the check results, fix blocking problems, confirm warnings and save.
4. Start a new connection from that source device and verify that the intended service is reachable through the chosen exit. Compare Insights → Transmission when checking the participating devices.

To reverse the change, delete the rule just added or remove the device from it. Other matching rules and effective site routes still apply.

Quick troubleshooting