Russian websites direct, everything else through the VPN: routing in Xray clients

What routing in a VPN client is

Without routing, a VPN client sends all traffic through the tunnel. Routing adds rules: for each new connection, the client checks the destination address and decides where to send it.

There are usually three options: directly over your regular connection, through the VPN server, or blocked. That way you can send Russian websites directly and foreign ones through the VPN, and cut off ads before they even load.

What geosite and geoip are

Listing thousands of domains by hand is impractical, so clients based on Xray and sing-box use geo files. These are prebuilt lists that are updated along with the app or downloaded separately.

• geosite — lists of domains by category. For example, geosite:category-ru includes domains in the .ru zone and the websites of Russian companies on other domains.
• geoip — IP address ranges by country. For example, geoip:ru contains addresses registered in Russia, and geoip:private contains local network addresses.
• What each category contains depends on which geo files the client uses. Category names may differ from one set to another.

Rule order and DNS

Rules are checked from top to bottom, and the first match determines the route. If the “direct” rule for Russian websites sits below an “everything through the VPN” rule, it will never fire.

Domain rules match right away, but for IP rules the client first has to find out the website’s address. That’s what the domainStrategy setting controls: the IPIfNonMatch value means the domain is first checked against the domain lists, and if nothing matches, the client resolves the IP address and checks the IP rules.

Many clients split DNS: Russian domains are resolved directly through a “home” DNS server, and everything else through the VPN. That way your internet provider sees DNS queries only for the sites that go direct anyway.

Example rules for Xray

If your client lets you edit the Xray configuration, rules for Russian websites look roughly like this. Here, direct is the outbound that connects directly, and anything that doesn’t match the rules goes to the main outbound through the VPN.

"routing": {
  "domainStrategy": "IPIfNonMatch",
  "rules": [
    { "type": "field", "domain": ["geosite:category-ru"], "outboundTag": "direct" },
    { "type": "field", "ip": ["geoip:private", "geoip:ru"], "outboundTag": "direct" }
  ]
}

How to set it up in Happ and Hiddify

You don’t have to edit JSON by hand. Popular clients let you set the same rules through their interface.

• Happ (Android, iPhone, macOS): build a routing profile at routing.happ.su, add geosite:category-ru to direct sites and geoip:ru to direct IP addresses, import the profile, and reconnect.
• Hiddify (Windows, Android): go to “Settings” → “Routing” → “Region” and pick “Russia (ru)” from the list. The client will send .ru domains and the Russian geosite and geoip lists directly on its own.
• Other Xray clients: look for a routing or custom rules section and add rules with the direct outbound.

Common mistakes

Domain and IP address lists are never complete. A Russian service may use a foreign CDN, and a website in the .com zone may run on Russian servers. If something only partly works, find the domain the rule missed and add it separately.

• The rules didn’t take effect — reconnect the VPN: many clients read them only when connecting.
• The geo files didn’t download — the client can’t activate the profile. Check your internet connection and wait for the download.
• The IP check website shows your regular address — the site itself may be in the Russian zone. Check on a website based outside Russia.
• Everything goes direct — the “direct” rule is too broad or sits above the rules that should take priority.