Choose which traffic uses the proxy

Add one rule, then reconnect

1. Open Settings → Network Settings → Blacklist. Copy your current list somewhere safe before editing it.
2. Add one entry from the table below, replacing the example with your own hostname, IP address or process name. Put each entry on a separate line, with an ASCII comma , between entries.
3. Save, then reopen Blacklist to check the saved text. Disconnect and reconnect Oblivion Desktop, then restart the affected app or open a new connection to the site.
4. Check the route. To undo the change, remove the entry you added, save and reconnect. Restore your copied list if you changed several entries; a full settings reset is unnecessary.

The examples below describe Desktop v3.11.0. Its repository is archived. We checked the saved-rule and configuration code; live routing on Windows, macOS and Linux still needs verification. Release v3.11.0 · Original setup guide

Which rule should I use?

Direct means bypassing Oblivion’s proxy. A site that needs the proxy may stop opening when you send it directly. Proxy means using the selected connection method; it does not promise a particular country or IP address.

On a narrow screen, scroll the table sideways to compare modes.

The table describes v3.11.0’s generated rules. Verify the actual route after reconnecting. Rule parser · System Proxy paths · PAC rules

Why did my rule change or do nothing?

• Use lowercase prefixes: domain:, not Domain:. The editor does not accept the capitalized form.
• Enter a hostname, such as example.com, without https://, wss://, a path or a port. There is no wss: rule type; use the WebSocket server’s hostname in a domain rule.
• Do not paste CIDR such as ip:192.168.1.0/24 into this version’s editor: it removes the slash and saves a different value. IPv6 entries beginning with ip: are removed; IPv6 range: entries are not supported by the TUN parser either.
• A saved geoip: line does not become a TUN rule. Use the separate IP Routing control.
• The TUN parser removes www. from exact domain values. Do not rely on domain:www.example.com to isolate only the www host. Use a suffix rule only if you intend to include the whole domain family.

Reopen the editor after saving. If the value changed unexpectedly, remove that entry and reconnect. Editor validation

Keep one domain on the proxy

For example, to bypass .ir domains except test.ir, enter:

domain:!test.ir,
domain:*.ir,

In TUN, test.ir gets an explicit proxy rule and other matching domains get a direct rule. The exception is exact: add separate exceptions for other hosts you need, such as login.test.ir. The editor moves domain:! entries to the top automatically.

This is not a general “first line wins” list. TUN groups rule types in a fixed order. Private IP routes, some service rules, enabled blocking rules and explicit IP bypasses can come before domain exceptions. An exception does not override everything. The Windows PAC function handles the exact exception before the broader suffix; other System Proxy paths use OS bypass lists without equivalent exception logic. TUN configuration

Exclude an app, or proxy only one app?

To exclude an app in TUN, use its process name. On Windows, find it in Task Manager → Details: Figma.exe can be entered as app:Figma.exe,. On macOS or Linux, use the actual running process name, which may differ from the app’s display name. Helper processes may need their own entries. Domain rules run before process rules, so a matching proxy exception can take priority over an app exclusion. Save, reconnect and restart the app before checking it.

A direct app rule does not mean “only this app uses the proxy.” TUN still sends unmatched traffic to the proxy. There is no app-only allowlist in this release’s Blacklist parser. For one app that offers its own proxy settings, select None in Network Settings → Configuration, then configure that app with the address and port shown in Oblivion. That is a separate setup; it will not capture apps that cannot use that proxy. Process rules and default route

Router, Chromecast and company websites

IP access and device discovery are different checks

Try the router’s known local IP first, using the same address with Oblivion disconnected and connected. Do not assume every router uses 192.168.1.1. TUN v3.11.0 already generates direct rules for private IPs and for the mDNS/SSDP discovery ports. Adding a broad range: entry will not improve these TUN rules.

A router page opening does not prove that Chromecast discovery or casting works. Check discovery and playback separately, on the same LAN. If only TUN breaks discovery, return to your previous working mode and record the OS, device and failing action. The generated rules do not establish that multicast works on every network. Local rules in v3.11.0 · Historical LAN report

My company site works by IP but not by name

Check name resolution as well as routing. A direct IP rule cannot tell DNS how to resolve a private hostname. In v3.11.0, a direct domain rule such as domain:jira.company.co, also selects direct DNS; domain exceptions select remote DNS. A DNS change was merged after the earlier reports of this problem. That does not prove it works with your company’s resolver. DNS change

Ask your network administrator for the full internal hostname and DNS server. Check Plain DNS Server in Oblivion’s DNS settings: with custom DNS selected, the direct resolver uses this address. The separate local-DNS mode uses the system resolver; an empty custom Plain DNS value falls back to the default DNS server. Save your existing DNS settings before changing them, keep the DoH field valid, reconnect and test the full hostname. Restore the previous values if it fails. The editor’s Save button requires both fields; do not assume deleting only Plain DNS will save a local-resolver setup.

Use the site’s hostname for the final browser test: an HTTPS service may not work correctly when opened by bare IP. DNS editor · Direct and remote DNS configuration

IP Routing, Web Routing and Content Filter

These TUN controls do different jobs:

• IP Routing (GeoIP): sends matches from the selected IP list directly. It does not choose your exit country.
• Web Routing (GeoSite): sends matches from the selected domain list directly.
• Blocking: rejects matches from the configured advertising, malware, phishing and cryptomining lists.
• Content Filter: rejects matches from the NSFW domain list. It does not select a route or guarantee that every unwanted page is filtered.

Desktop loads binary .srs rule sets sourced from Chocolate4U/Iran-sing-box-rules. The lists are not an exact map of every local service. Choose a list for the destinations you need, not the language of the app. Old .db files and raw sing-box JSON are not entries for the Blacklist box. List source · Desktop list URL · Control behavior

If a trusted site stops working immediately after enabling a filter, note the previous setting, temporarily turn off only that filter and reconnect to compare. Restore it afterwards. Adding a domain exception may not help: these blocking rules precede custom domain rules.

Check the actual route and undo a rule

1. Establish a baseline. Use a public IP-check page in the browser you are testing, first disconnected and then connected. If both show the same address, that page cannot distinguish the routes for this test.
2. Test the matching destination. Add a direct rule for that IP-check page’s exact hostname, save and reconnect. Open a new connection to it. The expected direct result is your normal connection’s address. Remove the rule and reconnect: the proxied result should return. This checks that hostname in that browser only.
3. Test the real task. Open the target site, sign in or make the app connection you actually need. For an app without an IP-check feature, use destination-side connection logs or a packet capture to establish the route. A successful page load or ping alone is not proof.
4. If it does not change, check the saved entry, current mode, actual hostname/process and any app-specific proxy or browser extension. Check whether an earlier filter or IP rule matches. In System Proxy, the app must use system proxy settings. Revert the new entry and reconnect before changing anything else.

To test the exception example, check both the exact exception and another matching suffix domain. One successful connection is not evidence that both routes are correct. Record the version, OS, connection method, mode, saved rules and expected/observed result if you need to investigate further.

Back to help · Find a desktop package