Smart Routing
Open Connect > traffic method > Smart Routing > Edit.
Direct traffic
| Option | What it does | Default |
|---|---|---|
| Direct region | Use the installed GeoSite/GeoIP categories for one country or region | Mainland China on a new installation |
| Local networks | Keep matching private domains and IP ranges direct | On |
| Apple services | Keep the Apple domain category direct | On |
| Microsoft services | Keep Microsoft/Bing direct, including Windows/Office domains, with a higher-priority GitHub proxy rule | On |
| Direct DNS | Query DNS for direct-domain rules through the direct path | On |
| FakeDNS | Return virtual IPs and restore domains before routing | Off |
| Block ads | Block the configured advertising-domain category | Off |
The region picker supports search, one selection, and clearing. Available regions depend on the installed official routing data; geographic labels are not a promise that every website or IP is classified correctly.
Microsoft bypass is available on every platform. It uses the actual microsoft and bing GeoSite categories, not nonexistent windows or office categories.
Entry servers and final exit
Choose 1, 2, or 3 entry servers for automatic/group selection. OneXray chooses the fastest eligible measured nodes. Explicit proxy-balancer rules use the pool; unmatched traffic follows Xray’s first-outbound default and is not automatically balanced. A fixed single-server selection remains one entry.
An optional VPN final exit creates chains:
Device → selected entry server → final exit → destinationThe final-exit node is excluded from entry selection. Each entry uses its own chain to that exit. Custom Routing does not include a final-exit setting.
Rules and DNS
The preview shows the rules generated by the switches. Direct domain conditions are combined into one domain rule, and direct IP conditions into one IP rule. With Microsoft bypass enabled, a GitHub proxy rule precedes both direct rules; ad blocking still comes first.
Smart Routing always uses IPIfNonMatch: when a domain does not match on the first pass, Xray resolves it and tries the IP rules. There is no switch for this behavior.
With Direct DNS enabled, edit Local DNS address, which defaults to 8.8.8.8. For internal domains, use a reachable router or company DNS resolver as needed. The address is saved with Smart Routing. Turning the switch off preserves it but stops applying the custom address and direct-domain matching.
Proxy DNS remains 8.8.8.8. Domain conditions from direct rules select the local resolver; with FakeDNS off, other DNS uses the proxy path. DNS selection does not evaluate IP, port, or network conditions. An IP-only direct rule does not automatically send the corresponding domain to local DNS.
This is separate from tunnel DNS. For internal-name resolution problems, check the route’s local DNS first; changing tunnel DNS does not replace it. All via VPN ignores this address and creates no direct DNS server.
Save applies the draft; saving changes to an active Smart connection requests a reconnect.
FakeDNS
Enable FakeDNS to return virtual IPs for eligible DNS queries and restore the domain before routing. Domains selected by Local DNS still use real IPs. FakeDNS is off by default and does not affect All traffic through VPN. Read the DNS cache and system-route limitations before enabling it.