OUTBOUND

Egress & Split-Tunnel Consistency

Direct exit, proxy exit, and each site's latency and exit are measured by your browser through your own routing rules — use it to verify that VPN / proxy split tunneling works as intended.

Reading the results

What this page checks and how to read it

Split tunneling means sending "China traffic" and "global traffic" through two different exits. This page reads the direct exit and the proxy exit with two probes, then checks each site's actual exit, address family and reachability — every probe is sent by your browser through your own routing rules.

What is being checked

Three things: whether the direct and proxy exits are two different IPs (does a split exist, and in the right direction); the exit and address family actually used for each site; and each site's reachability and latency.

This page does not grade IP quality. For the exit IP's cleanliness, blocklists and risk, click the IP to open the full report.

How to read the split verdict

The verdict in the top card looks only at two probes: the direct exit read from the China echo endpoint, and the proxy exit read from v4.cleanip.io.

Split tunnel OKDirect exit in China, proxy exit abroad — rules work as intended.
Split tunnel active (two exits)Both exits are outside mainland China, typical for users abroad: the "China direct" rule does not apply to you; the rest is fine.
No split detected (single exit)Both probes landed on the same IP outside China. A datacenter IP usually means a global proxy (China traffic goes through it too); a residential / carrier IP usually means you are abroad without a proxy.
No proxy in use (all direct)Both probes landed on the same China IP — no traffic goes through a proxy right now.
Direct path to China unreachableThe China echo endpoint cannot be reached: a global proxy took over all traffic, or this machine is abroad with no direct route to China.
Proxy exit is still in ChinaTwo different exits, but the proxy exit is also a China IP: the node is inside China, or the rules send global sites to a domestic node.
Cannot compare the proxy exitThe global probe is unreachable; only the direct exit is available, so nothing can be judged this run.

Groups and the three columns

Sites are grouped by their measured exit: sites that echo the client IP are grouped by that connection's exit; the rest fall under the direct probe (China sites) or the proxy probe (global sites).

LatencyBrowser HTTP probing, not ICMP ping. Cloudflare-fronted sites are read from the edge echo, close to pure network RTT; other sites fetch a small asset such as the favicon, which includes DNS / TCP / TLS overhead and reads higher. Median of 3 samples.
Site IP & locationThe A / AAAA record from a local DoH lookup, sent with the /24 of the exit the site belongs to as EDNS Client Subnet so geo-DNS answers for your location; with several records the first is shown with a +N badge, and hovering reveals the resolver and the full list. Locations use the same data as the lookup page.
Address family"Measured" comes from the site's own echo; "inferred" uses the AAAA record and whether this machine has an IPv6 exit when there is no echo; "undetermined" means the probe for that site failed.
Groups"Direct exit" and "proxy exit" groups are formed by actual IP; "detecting" is still in progress; "unassigned" means the site has no echo and its probe is unavailable too.

Common results and what to do

The most common patterns and where to look.

China sites time out broadlyRules are not letting China traffic go direct. Add DIRECT for GEOIP,CN and geosite:cn, or check whether a global proxy is on.
Global sites time out broadlyThe proxy is off, the node is down, or the international route is throttled; first check whether the "proxy exit" at the top read an IP.
Cloudflare sites go direct while other global sites use the proxyUsually geosite:cloudflare is set to DIRECT on purpose; change it back if that is not what you want.
Address family is IPv6 but the proxy has no IPv6IPv6 traffic may bypass the proxy and go direct, making exits inconsistent. Disable system IPv6 or use a node that supports IPv6.
A single site times outNot necessarily unreachable: a missing favicon, refused cross-origin requests or local blocking all look like a timeout. Use "copy unreachable domains" and check them against your rule-set one by one.

Why the resolved IP differs from other tools

Sites like Taobao, QQ and Google use geo-DNS: the authoritative server returns a nearby node based on where the query comes from, so there is no single correct IP.

This page resolves with your exit subnet attached and lists the resolver and every record on hover; when comparing with another tool, mind where and through which resolver it queries.

Data sources and privacy

Egress, latency and DNS resolution are all issued by your browser under your local split rules; nothing is looked up on your behalf by a server. Location and network type use the same data as the lookup page.

Results are not stored; your site-list selection lives only in this browser.