Happ exclusion lists and split tunneling: managing traffic routing
Split tunneling is a set of routing rules: local services open directly while blocked and restricted sites go through the tunnel to bypass filtering. It keeps access to local resources fast and reliable.
Why it helps
Local services direct
Some local sites can work without VPN — faster and more stable.
Everything else via VPN
Global services go through the secure connection.
No need to toggle VPN
You don't have to turn the connection on and off each time.
What split tunneling and exclusion lists in Happ are
Split tunneling is a mode in which the client divides outbound traffic into two streams: one goes through the proxy server, the other directly through your provider. This split is managed via Happ lists — sets of rules where you explicitly specify domains, IP subnets, or applications that fall into the exclusions. Everything not covered by a rule is handled by the default policy.
Happ offers two fundamentally different approaches to building lists. The first is bypass mode, where all traffic goes through the proxy except what is listed: convenient for taking banking apps, local services, and region-sensitive sites out of the tunnel. The second is proxy-only mode, where everything goes directly and only the specified list of resources is routed through the server. The chosen mode defines the entire logic of Happ bypass on the device.
Technically, the rules are stored in the profile configuration and applied by the routing engine on the fly, without reconnecting the session. This means a change to the list takes effect almost instantly rather than requiring the tunnel to be fully rebuilt. Understanding this model is the foundation for fine-tuning speed and stability.
How to add a site to the Happ exclusion list
To add a domain, open the active profile and go to the routing section (Routing / Rules). Tap add a rule and enter the domain in the format example.com — without the http protocol and without a trailing slash. To cover all subdomains, use a mask like domain:example.com or a suffix entry so that app.example.com and cdn.example.com automatically fall under a single rule.
For the rule, set an action: proxy (route through the server), direct (send directly), or block (block the connection). It is precisely the domain + action pairing that shapes the behavior of Happ bypass. If you need to take a heavy video service out of the tunnel for speed, set direct; if you need stable access to a specific resource through the server, use proxy.
Besides domains, you can add IP addresses and CIDR subnets to Happ lists (for example, 10.0.0.0/8 for the local network) and GEO tags (geoip:ru, geosite:category-ads). Subnets are useful for corporate resources and NAS, while GEO rules describe entire categories at once instead of manually listing hundreds of domains.
After saving, check the order of the rules: the engine applies them top to bottom and stops at the first match. A rule that is too general and placed higher will override a more specific one below it — so keep specific domains above broad masks and GEO categories.
How to remove a site or rule from the list
Removal is done in the same routing section. Find the desired line in the rules list, open the context menu (swipe left on mobile clients or the trash icon in the desktop version), and confirm the deletion. The rule disappears from the active configuration without restarting the application.
If a resource keeps behaving the old way after removal, the cause is almost always the DNS cache or a duplicate rule. Check whether the same domain exists in another list or under a broader mask (for example, a single site might have fallen under a geosite category). Remove the overlapping rule and flush the DNS cache by reconnecting the profile.
For bulk cleanup, it is more convenient to edit the list not line by line but via config import/export: export the current rules, edit the routing block in an external editor, and import it back. This reduces the risk of accidentally leaving an orphaned rule and makes maintaining large Happ lists easier.
Before removing critical rules, make a backup of the profile. Rolling back to a saved version takes seconds, whereas manually rebuilding a list assembled from dozens of domains is a half-hour job.
Routing by applications and list subscriptions
Besides domain-based routing, Happ supports per-app splitting. On mobile platforms you mark which applications go through the tunnel and which go directly, bypassing the proxy. This is a separate layer on top of the domain rules: for example, a messenger can be routed entirely through the server, while a banking client is taken out of the tunnel without touching the domain lists.
For resource-intensive scenarios, use ready-made routing list subscriptions — external URLs with sets of rules that the client periodically fetches and updates. This lets you keep categories current (ads, trackers, regional resources) without manual editing. A subscription is connected by adding a rule source with a link and an update interval.
Combine the levels deliberately: first per-app determines whether an application's traffic enters the tunnel at all, then domain rules and subscriptions decide which server or direct route to apply inside the tunnel. This hierarchy delivers predictable Happ bypass without conflicts between layers.
Keep the number of active subscriptions to a minimum. Each one adds thousands of rules to the routing engine, and overlaps between lists increase connection parsing time and can potentially slow down session setup on low-powered devices.
Optimizing speed and stability through well-built lists
A well-assembled exclusion list directly affects speed. By taking local and high-load traffic out of the tunnel (streaming, OS updates, torrents where policy allows), you offload the proxy channel and reduce latency for the connections that truly matter. This is a key optimization technique, not just a way to bypass something.
Rule order and specificity determine parsing performance. Precise domain rules are cheaper for the engine than broad GEO categories, so move frequently used resources into separate lines at the top. Regularly clean Happ lists of outdated and duplicate entries — a bloated rule set slows down the setup of every new connection.
For diagnostics, use the built-in connection log: it shows which rule fired for a specific domain (proxy, direct, or block). If a resource takes the wrong route, you immediately see which rule intercepted the connection and fix exactly that one instead of blindly sifting through the whole list.
A final check after changes: open a couple of test resources, verify the route in the log, and measure the latency. A stable configuration is one where every rule is justified, the order is predictable, and there are no unnecessary overlaps between lists and subscriptions.
Frequently asked questions
How does bypass mode differ from proxy-only mode in Happ?
In bypass mode, all traffic goes through the proxy except what is on the list — that traffic is sent directly. In proxy-only mode, everything goes directly and only the listed resources are routed through the server. The first is convenient when you need to take a few resources out of the tunnel; the second, when only a narrow set of sites should go through the server.
In what format should I add a domain to the exclusion list?
Enter the domain without the protocol and slash: example.com. To cover all subdomains at once, use the mask domain:example.com or a suffix entry — then app.example.com and cdn.example.com will fall under a single rule. IPs and subnets are entered in CIDR format, for example 10.0.0.0/8, and categories via geosite: and geoip:.
Why is a site still going through the proxy after I added it to the exclusions?
Most often the issue is rule order or list overlap. The engine applies rules top to bottom and stops at the first match, so a more general rule above overrides a specific one below. Check the connection log — it shows which rule fired, move the specific rule higher, and reconnect the profile to flush the DNS cache.
How do I set up routing by applications rather than by domains?
Use per-app mode in the applications section: mark which apps go through the tunnel and which go directly. This is a separate layer on top of the domain rules — first per-app decides whether an application's traffic enters the tunnel, then the domain lists determine the specific route inside it.
Can I connect a ready-made routing list via a link?
Yes. Add a rule source (subscription) with a URL and update interval — the client will periodically fetch the current rule set without manual editing. Keep the number of subscriptions to a minimum: each one adds thousands of rules to the engine and increases connection parsing time.
Does the size of the list affect connection speed?
Yes. Bloated lists with duplicates and many broad GEO categories slow down the parsing of every new connection. Move frequently used resources into separate precise rules at the top, regularly clean out outdated entries, and minimize overlaps between lists and subscriptions — this speeds up session setup, especially on low-powered devices.