> For the complete documentation index, see [llms.txt](https://pango.gitbook.io/paas/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pango.gitbook.io/paas/console-details/project-settings/vpn/domain-bypass-list.md).

# Domain Bypass List

## Overview

The **domain bypass list** is the set of domains whose traffic is routed outside the encrypted VPN tunnel, directly through the device's regular internet connection. Every outgoing request is checked against this list: if the target domain matches an entry, the request bypasses the VPN; otherwise it is sent through the tunnel as normal.

This page describes how the list is populated and managed. For a conceptual explanation of what domain bypass is and how it works under the hood, see [Domain Bypass](/paas/sdk/unified-vpn-sdk/features/domain-bypass.md).

You can define the bypass list in two places:

* **Project level (remote)**: domains added on the dashboard apply to every user of the project.
* **Per session (local)**: your application supplies the domains in the SDK's session configuration, for each session it starts.

{% hint style="info" %}
**Want to exclude an application rather than a domain?** That is a separate feature called process bypass, which routes a specific process's traffic outside the tunnel. Unlike the domain bypass list, it has no dashboard equivalent, it is configured entirely in the SDK. See [Process Bypass](/paas/sdk/unified-vpn-sdk/features/process-bypass.md).
{% endhint %}

{% hint style="info" %}
Domain bypass relies on resolving each domain's DNS. It will not work when the device uses an encrypted DNS method such as DNS-over-TLS. See [How it works](/paas/sdk/unified-vpn-sdk/features/domain-bypass.md#how-it-works) for details.
{% endhint %}

## Setting up the bypass list on the dashboard

Domains configured on the dashboard apply to all users of your project. Sign in at [pango-cloud.com](https://www.pango-cloud.com/) and go to **Settings** -> **VPN** -> **Bypass list**. From there you can add domains individually or in bulk, delete them, and search or download the list. Every change takes effect only after you [save and apply](#save-and-apply-your-changes) it.

### Add a single domain

1. Click **Add**. A new, empty line is created in the list.

![Add a domain to the domain bypass list](/files/h60RXsrnx5cg2lXrShE0)

2. Enter the domain and click **Add**. The domain moves to the bottom of the list. For the full syntax, see [Domain matching rules](#domain-matching-rules). A malformed entry is rejected with a **Domain is not valid** error.
3. Repeat for any other domains you want to add.
4. [Save and apply your changes](#save-and-apply-your-changes).

### Add multiple domains

To add many domains at once, prepare a plain-text file with one domain per line:

```
testurl2.com
example2.mm
example4.mn
!a.co
```

1. Click **Upload** and select your file. Every domain in the file is added to the list. ![Bypass list after uploading multiple domains](/files/GzI1F4w90Q8XuKKG1G3S)

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Any malformed entry is flagged with a <strong>Domain is not valid</strong> error and left out of the saved list; the remaining domains are still saved. The change log identifies which entries were skipped.</p></div>
2. [Save and apply your changes](#save-and-apply-your-changes).

### Delete a domain

1. Click the delete button on the row of the domain you want to remove.
2. [Save and apply your changes](#save-and-apply-your-changes).

### Search the list

When the list is long, use **Search domains** to locate a specific entry.

### Download the list

Click **Download** to save a copy of the current list to your device.

### Save and apply your changes

Edits to the bypass list are not applied until you save and approve them:

1. Click **Save**. An approval form opens, summarizing the pending change.

   ![Save bypass list approval dialog](/files/B5jH8Ia1wsqBuBQMwazT)
2. A log of the applied changes is shown.

   ![Bypass list change log](/files/XsYg7m0dy3HFgMxRKNXw)

## Configuring the bypass list in the SDK

Applications that embed the VPN SDK can also define the bypass list locally on the device, as part of the session configuration. Unlike the dashboard list, which the SDK downloads and applies on its own, the local list is the application's responsibility: your app builds the bypass configuration and supplies it to the SDK for every session it starts.

See the [Platform](/paas/sdk/unified-vpn-sdk/features/domain-bypass.md#platform) section of the Domain Bypass page for full, code-level details on each platform.

{% hint style="info" %}
The application provides the local bypass list at connection time, as part of the session configuration. It cannot be changed while a session is running — to apply a different list, supply the new configuration and start a new session.
{% endhint %}

## Example bypass list configurations

The following examples show common entries and the goal each one serves. They use the matching syntax described in [Domain matching rules](#domain-matching-rules).

### Access local or intranet resources directly

Keep traffic to internal sites and services off the VPN so it routes efficiently on the local network:

* `intranet.example.com` — matches the host exactly
* `*.corp.example.com` — matches every host under `corp.example.com`

### Stream geo-restricted media as your real location

Let a streaming service see your actual location instead of the VPN exit:

* `netflix.com`
* `*.netflix.com`

Adding both the base domain and the `*.` subdomain pattern ensures the service and all of its subdomains bypass the tunnel.

### Allow captive-portal sign-in

Public Wi-Fi captive portals must be reachable before the VPN can carry traffic. Bypass the portal's domain so users can authenticate:

* `*.captiveportal.example`

### Reduce VPN load for non-sensitive services

Send high-volume, non-sensitive traffic straight to the internet to lighten the load on VPN servers:

* `*.example-cdn.com`

## Domain matching rules

The same matching rules apply whether you configure the bypass list on the dashboard or in the SDK. In short: entries use **exact matching** by default, the asterisk (`*`) acts as a **suffix wildcard**, and to match a domain together with all of its subdomains you add both `example.com` and `*.example.com`.

For the complete matching rules, the wildcard and subdomain tables, worked examples, and edge cases, see [Domain Matching Behavior](/paas/sdk/unified-vpn-sdk/features/domain-bypass.md#domain-matching-behavior).

## Best practices

* **Match subdomains with two rules.** To cover a domain and everything under it, add both `example.com` and `*.example.com` rather than a bare `*example.com`, which can over-match. See [Best Practice: Matching a Domain and All Subdomains](/paas/sdk/unified-vpn-sdk/features/domain-bypass.md#best-practice-matching-a-domain-and-all-subdomains).
* **Keep the list as small as possible.** Bypassed traffic is not protected by the VPN, so only add domains that genuinely need to skip the tunnel.
* **Remember bypass depends on DNS.** Domain bypass resolves each domain's addresses, so it will not work alongside encrypted DNS methods such as DNS-over-TLS.
* **Choose the right scope.** Use the dashboard (project-level) list for policies that should apply to all users, and the per-session (local) list for device- or app-specific needs. Keep in mind that the per-session list is set up by your application, on every session it starts.
* **Test on real devices and networks.** Verify that the intended domains bypass the tunnel and that everything else still routes through the VPN.

## References

See [Domain Bypass](/paas/sdk/unified-vpn-sdk/features/domain-bypass.md)