What it is
A VPN mode where only part of the traffic goes through the secure channel and the rest goes direct. Games and local sites stay fast, blocked services open.
How we use it
In the OshaVPN client local sites, games and anti-cheat go direct, everything else through the VPN. For gaming cafés we set up a private VPN with the same rules on every machine.
Where it helps a business
- Staff work through a VPN, but government services, the bank and marketplaces must open without it.
- Customers of your VPN service do not want to switch the VPN on and off for every local app.
- Games and anti-cheat systems break when their traffic leaves the country.
- Torrents through a VPN server lead to hosting-provider complaints.
Types
- On the device. The client decides what goes into the tunnel and what goes direct: by domain, address or app. That is how OshaVPN works.
- On the server. All traffic reaches the VPN node, and there part of it leaves through one exit and part through another. That is how our Netherlands node works.
How we use it
- In the OshaVPN client. The local network, Russian domains, Yandex, MAX and games go direct, and everything else goes through the tunnel. Torrents bypass the tunnel in every mode. The
geoip-ru, geosite-category-ru and geosite-yandex rule sets are built into the app and updated through the tunnel. On Windows, games and torrent clients are also recognised by process name. The client checked direct access from a real phone on Gosuslugi, Sber, Ozon and Wildberries. - The Services catalogue. Users choose what goes through the VPN and what goes direct, including a "launcher and anti-cheat follow the game" bundle. For edge cases there is an "everything through VPN" switch.
- On the server. On the Netherlands node, torrents and 44 AI-service domains exit through Cloudflare WARP, while ordinary web traffic goes direct, with no captchas.
We build clients with such rules under Apps, and server routes under Infrastructure.
Common problems
- A local site is blocked on a local address. A "local goes direct" rule will not open it. Such sites are sent into the tunnel by a separate rule.
- Lists go stale. Domains and addresses change, so the lists are updated rather than baked in once.
- Sending the game direct is not enough. Its launcher and anti-cheat have to take the same path as the game itself. That is what the "follow the game" bundle in the catalogue is for.
- Torrents are slower over WARP. WARP does not accept inbound connections, so speed is lower than direct.
When you do not need it
If the VPN is only for reaching the company's internal servers, sending just their addresses into the tunnel is enough, and complex lists are unnecessary. And if a user wants all traffic in the tunnel, split tunneling is simply switched off.