Hacker News Reader

Comment by tecleandor | Hacker News Reader

That'd be "split tunnel/VPN" by domain name, and usually it's limited to HTTP/S requests (because the hostname comes with the petition header), but some vendors (like ZScaler) do tricks to apply it to different protocols.

For example, the equivalent in Tailscale would be an "App Connector":

https://tailscale.com/kb/1342/app-connectors-setup#add-a-cus...

View on HN

This is all new to me, but seems odd (startup idea?) why there isn't a SaaS letting me accomplish this on iPhone in a few minutes. (a few youtube searches for 'how to split VPN' are hopelessly theoretical as opposed to practical)

E.g. I'd definitely pay $10/month for an app that lets me input domains and which country to re-route traffic through.

E.g. a handful of social media apps via US (my country has age verification), a handful of news sites via UK (some countries I travel to block them entirely), spotify via a single country (I don't care which one, so long as it's constant).

I currently use ProtonVPN iPhone and macOS apps but AFAIK it routes all traffic through a single country which requires opening the app and manually changing it each time you want traffic routed via a different country.

Extremely keen to hear any solutions people have used on their own devices.

This also seems like an easy way for VPN providers to differentiate themselves with their apps. The fact that it hasn’t happened makes me think that it’s impossible with unrooted iOS

It's tricky to do for large public websites, because routing happens at the IP level while users want to input a domain name.

That domain could constantly resolve to different IPs, requiring updates to the routing rules, and those IPs could be shared with many other domain names that the user didn't list (for example Cloudflare IPs). So the mapping isn't clean and you're likely to miss some IPs some of the time or incorrectly intercept some traffic that the user didn't want to route through the VPN.

A proxy would not have this problem, it gets to inspect the request and hostname and then decide how to reach that host.

VPN app can still solve it by locally resolving configured domain into special local IP, which get VPNed into real IP on their side. You'll need to encode original DNS name into protocol somehow, so that remote side knows which real IP to access, but it is certainly doable.

Reply on news.ycombinator.com