Bypass/Redirect Policy

The Bypass/Redirect Policy allows you to fine-tune how traffic is handled by Xray on a per-port or per-device (MAC address) basis.

• Bypass means traffic does not go through Xray by default, unless you explicitly specify certain ports to be redirected.
• Redirect means traffic does go through Xray by default, unless you explicitly exclude certain ports.

Why Use It?

You might have devices or applications that you do not want to proxy—perhaps internal services or local game servers.

Conversely, you might want to proxy only specific ports (e.g., 443) while leaving all other traffic untouched.

Or, you may need a particular device (e.g., your PC) to be fully redirected to Xray, while excluding certain ports for that device.

This flexible policy system lets you achieve all these scenarios and more.

Policy Schema

To manage B/R Policies, click the Manage button in the Routing section.

Decision Logic

The chart below shows how XRAYUI decides whether to intercept a given packet. The check runs at the iptables level before traffic ever reaches Xray.

Examples

Below is a table arranged from the simplest configuration (only setting a mode) to more detailed ones (specifying ports and devices). This helps illustrate how different combinations change the final behavior.

Parental Control and Network Services Filter

The firmware's Parental Control (time scheduling and blocking) and Network Services Filter only add rules to the iptables FORWARD chain. Traffic that XRAYUI redirects to Xray never passes FORWARD: it is delivered to Xray on the router, and Xray then opens its own connection from the router. As a result, those firmware rules do not apply to any device whose traffic goes through Xray. XRAYUI writes a warning to the system log when either feature is enabled.

There are two ways to keep a schedule working:

• Leave the device out of Xray. Add a bypass policy with the device's MAC address and no ports (row 5 in the table above). Its traffic goes through FORWARD again and the firmware schedule applies, but the device is no longer proxied.
• Keep the device proxied and block it yourself from the After firewall start hook (General Options → Hooks). The rule has to be in PREROUTING, because that is where XRAYUI takes the traffic. For example, to cut internet access for one device from 22:00 to 07:00 (router time) while keeping access to the router and the local network:

MAC="AA:BB:CC:DD:EE:FF"
LAN="192.168.50.0/24"
TIME="-m time --timestart 22:00 --timestop 07:00 --kerneltz"

# IPv4
iptables -t mangle -N SCHEDULE_BLOCK 2>/dev/null || iptables -t mangle -F SCHEDULE_BLOCK
iptables -t mangle -A SCHEDULE_BLOCK -i br0 -m mac --mac-source $MAC ! -d $LAN -m addrtype ! --dst-type BROADCAST,MULTICAST $TIME -j DROP
while iptables -t mangle -D PREROUTING -j SCHEDULE_BLOCK 2>/dev/null; do :; done
iptables -t mangle -I PREROUTING 1 -j SCHEDULE_BLOCK

# IPv6
if ip6tables -t mangle -L PREROUTING -n >/dev/null 2>&1; then
    ip6tables -t mangle -N SCHEDULE_BLOCK 2>/dev/null || ip6tables -t mangle -F SCHEDULE_BLOCK
    ip6tables -t mangle -A SCHEDULE_BLOCK -i br0 -m mac --mac-source $MAC ! -d fe80::/10 -m addrtype ! --dst-type LOCAL,MULTICAST $TIME -j DROP
    while ip6tables -t mangle -D PREROUTING -j SCHEDULE_BLOCK 2>/dev/null; do :; done
    ip6tables -t mangle -I PREROUTING 1 -j SCHEDULE_BLOCK
fi