Proxy modes: Rules, Direct and Global
Reach only touches traffic while it's switched on, and the proxy mode decides which traffic that is. On Android and iOS you pick Rules, Direct or Global; on desktop you pick which browsers to route, and Pro or team accounts can switch on System Mode to route every app.
The three modes on mobile
| Mode | What goes through the gateway | Use it when |
|---|---|---|
| Rules | Only what your domain rules and app routing say to route; everything else goes out on your normal connection | Day-to-day use — a few sites or apps need the gateway, the rest shouldn't pay the latency |
| Direct | Nothing — the app stays signed in and connected but routes no traffic | A quick way to pause routing without disconnecting (e.g. a video call, a local-only service) |
| Global | Everything from every app | Restricted networks, or when you want the whole phone to exit from the gateway region |
On Android, the mode switch is on the Rules tab under App routing. On iOS, rules are reached from Home → Mode; iOS routes by domain rather than by app because Apple's VPN framework doesn't let a profile tunnel individual apps (see the installation guide for the mobile tour).
Desktop: per browser, or the whole system
The desktop tray app doesn't have a Rules/Direct/Global switch. Instead:
- Per browser — each supported browser (Chrome, Chromium, Edge, Brave, Opera, Firefox, Safari) has its own toggle, plus Enable All / Disable All. A routed browser gets a small proxy-auto-config file that sends public sites through Reach and leaves LAN and private addresses direct. See Per-app routing.
- System Mode — all apps via Reach (Pro, Business and team accounts) — sets the operating-system proxy so every app that honours it goes through Reach, not just browsers. Available on Windows and macOS.
- Any other app — point it at the local proxy Reach runs on
127.0.0.1:8082(HTTP) or127.0.0.1:1080(SOCKS5). See Use Reach with any app.
On desktop, domain rules come from your organisation's policy (team plans) rather than being edited in the tray; personal desktop users choose which browsers to route rather than which domains.
What never goes through the gateway
Regardless of mode, the desktop client keeps these direct so local things keep working:
- Anything on your LAN or a private range —
localhost,*.local,10.x,192.168.x,172.16–31.x,169.254.x— the remote gateway can't reach your network anyway. - Microsoft sign-in endpoints, so Windows device sign-in (PRT) keeps working behind the proxy. In restricted regions this bypass is turned off because those endpoints need the gateway to be reachable at all — see Troubleshooting.
Related
- Domain rules — what a rule matches and the order rules apply in
- Per-app routing — route one browser or one app
- Gateway regions — where routed traffic exits
Common questions
Does Global mode make Reach a VPN?
Functionally it routes all of the device's traffic, but it does so through Reach's local proxy and tunnel rather than a system VPN driver, and Reach never decrypts HTTPS — see Security. Local-network traffic is still left alone.
Why is System Mode greyed out?
System Mode and Agent Mode are available on Pro, Business and team accounts. On the Free plan you route individual browsers.
If I'm in Rules mode and a site isn't in my rules, where does it go?
Direct — out on your own connection, from your own IP. Only matched rules use the gateway.