Domain rules: route, bypass or block by domain
A domain rule says what to do with connections to one domain — send them through the gateway, send them direct, or block them — and it covers every subdomain of that domain. Rules are checked top to bottom and the first match wins.
What a rule matches
- Domain —
example.commatchesexample.comand anything under it (app.example.com,cdn.app.example.com). You can also write*.example.com; it means the same thing. - IP range (CIDR) —
203.0.113.0/24matches connections made to a bare IP address in that range. It doesn't apply when the browser connects by name. - Process (organisation policy, desktop only) — the name of the program making the connection, e.g.
outlook.exe. Process rules are enforced by the Reach client itself, not by the browser's proxy settings.
Matching is case-insensitive and ignores the port.
Actions
| Action | Effect |
|---|---|
| Gateway (route / proxy) | The connection exits from your selected gateway region |
| Direct | The connection goes out on your own connection, bypassing Reach entirely |
| Block | The connection is refused (on desktop the browser sees "Blocked by policy") |
On iOS you choose Gateway, Direct or Block per domain from Home → Mode. On Android domain rules live on the Rules tab. On desktop the rules come from your organisation's routing policy and are applied automatically when you sign in.
Order matters
Rules are evaluated in order and the first one that matches decides. That lets you make exceptions:
1. direct mail.example.com ← exception first
2. gateway example.com ← everything else under example.com
If you swap those two, mail.example.com matches rule 1 and goes through the gateway too.
Anything no rule matches follows your proxy mode: direct in Rules mode, everything routed in Global.
Examples
Route only your bank
gateway mybank.com.au
Everything else stays on your local connection at full speed. Because the rule is a suffix match, ib.mybank.com.au and login.mybank.com.au are covered.
Keep a local or region-specific service fast
direct mycloudnas.example.net
direct taobao.com
In mainland China, Route mainland China direct does this for the common Chinese services in one switch.
Stop a distracting site on a work profile (organisation policy)
block example-social.com
Organisation policy and your own rules
On team plans, admins define routing rules in the dashboard (Custom rules, plus presets such as Microsoft 365 that expand to the right set of domains server-side). They're pushed to every member's device when they sign in and whenever the policy changes.
Group rules take precedence over an individual member's own settings, so a restriction holds unless the admin explicitly allows an override for that member. See Group policy & TCP forwards.
Related
- Proxy modes — what happens to traffic no rule matches
- Per-app routing — route by app or browser instead of by domain
- Group policy & TCP forwards — the admin side
Common questions
Do I need a rule for www. as well?
No. A rule for example.com already covers www.example.com and every other subdomain.
Can I match an IP address?
Yes, with a CIDR rule — but only when the app connects to that IP directly. If it connects by hostname, write a domain rule instead.
A site loads partly through the gateway and partly direct — why?
Modern sites pull assets from several domains (CDNs, APIs, sign-in providers). Add rules for the extra domains, or use Global mode if you want everything from that session routed.