To route a website around an explicit proxy, add a matching rule to the proxy’s PAC file or bypass list. To keep an app off a VPN, use the VPN client’s split-tunneling or per-app exclusion setting. These controls work at different network layers, so first identify whether you mean a web proxy, a VPN, or both.
First identify what is routing your traffic
An explicit web proxy is selected through browser or operating-system settings, often with a PAC (Proxy Auto-Configuration) file or a manual bypass list. A VPN split-tunneling rule instead decides whether traffic enters the VPN tunnel. A browser proxy exception does not necessarily bypass a VPN, and excluding an app from a VPN does not necessarily change that app’s explicit proxy settings. In some managed setups both controls apply in sequence.
As an Amazon Associate I earn from qualifying purchases.
Find the active setting in the operating system’s network or proxy configuration, the browser, a managed device profile, or the VPN app. A PAC URL usually indicates that proxy selection is controlled by a script or organization policy; check with the administrator before changing a managed configuration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsExclude a website from an explicit proxy
Use a PAC rule when proxy selection is script-controlled
A PAC file can return DIRECT for requests matching a host or domain, so those requests go directly rather than through the configured proxy. Add the condition using the matching logic and deployment process required by your environment. A rule for one host should not be assumed to include every related subdomain; define only the names that need direct access. Cloudflare describes PAC setup at system level or in individual browsers, and Palo Alto Networks provides an illustrative internal-host rule in its GlobalProtect documentation: Cloudflare PAC files and Palo Alto Networks domain and application exclusions.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Use a manual proxy bypass list when available
If the proxy is configured manually, add the intended host or domain to the browser’s or operating system’s bypass list. Matching syntax and defaults vary. For example, Microsoft Edge documents implicit direct bypasses for loopback and link-local destinations, as well as a special manual-proxy rule for overriding certain implicit bypasses; it says those implicit bypasses cannot be disabled when using a PAC script. Do not assume another browser implements Edge’s matching rules: Microsoft Edge proxy bypass list.
Check which browser settings apply
In Cloudflare’s device configuration guidance dated August 4, 2026, Chromium-based browsers use operating-system proxy settings, while Firefox uses its own proxy settings by default in the documented setup. Therefore, a system bypass may affect Chromium-based browsers but not a Firefox configuration that is independently set. The same Cloudflare guidance says Safari and iOS/iPadOS do not support the HTTPS proxy type required by its documented endpoints; that limitation is specific to those endpoints, not every proxy technology: Cloudflare PAC files and device configuration.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Exclude an app or website from a VPN
Use the VPN client’s split-tunneling control
Open the VPN app’s split-tunneling, bypass, or per-app settings and choose the app or domain to exclude, if that client and platform offer the control. For example, Mozilla VPN documents app exclusions on Windows, macOS, Android, and Linux, but not iOS. Its support documentation says: “Mozilla VPN allows you to choose which apps to connect directly to the internet and which ones to protect with the VPN.” Check the current steps for your installed version at Mozilla VPN split tunneling.
Confirm whether the client supports website-level exclusions
App-level and website-level exclusions are not interchangeable. Private Internet Access (PIA) says its Android per-app setting applies to apps, not websites, and warns that excluded traffic is no longer protected by its VPN. Proton’s support guidance directs users seeking exclusions for specific websites to its browser extension in the setup it describes. Check the platform-specific instructions rather than assuming a domain exception exists in the VPN app: PIA Android split tunneling and Proton VPN split tunneling.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Choose the rule that matches the scope
| What you want to bypass | Control to look for | Scope and key limitation |
|---|---|---|
| A website or domain from an explicit proxy | PAC rule returning DIRECT, or a proxy bypass list |
May be system-wide or browser-specific. Host and subdomain matching depend on the PAC rule or client. |
| An app from a VPN | VPN app split-tunneling or per-app exclusion | Available apps and platforms depend on the client. Excluded traffic does not receive that VPN’s protection. |
| A website or domain from a VPN | VPN domain-exclusion feature, if supported; otherwise check for a documented browser-specific option | Support differs by provider and platform. An app-only setting will not target just one site. |
| Traffic that should bypass both a proxy and a VPN | Coordinate the proxy rule and VPN routing rule | One exception does not automatically cancel the other control; managed policies may determine precedence. |
Verify the change and check its security effect
- Apply the rule in the right place. Use the PAC file or proxy bypass list for an explicit proxy; use the VPN client’s supported split-tunneling setting for VPN routing.
- Test in the actual app and network. Open the target URL in the browser where the rule should apply, or use the excluded app while connected to the VPN. A result in one browser does not prove another browser follows the same proxy configuration.
- Check the intended route. Confirm with your organization’s approved diagnostics or service that the traffic is going direct or through the expected route. If it still uses the proxy or VPN, check for a separate browser setting, managed policy, unmatched hostname, or a second routing control.
- Review the privacy tradeoff. Traffic excluded from a VPN no longer travels through that VPN, as PIA explicitly warns. It may instead use the ordinary network path, so exclude only traffic that is meant to take that route.
For enterprise deployments, ask the administrator to review domain and application exclusions together with PAC behavior. GlobalProtect documentation describes both kinds of exclusions and their coordination; the effective result depends on the deployment’s rules and client policy: GlobalProtect domain and application exclusions. Apple’s deployment guidance also covers manual proxy settings, PAC, and WPAD, and notes that VPN proxy behavior depends on the configured resolver and route: Apple platform deployment: proxy settings.
Quick Recap
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
