# UI Fix: Allow standalone TLD entries in VPN Policy

**URL:** <https://forum.gl-inet.com/t/ui-fix-allow-standalone-tld-entries-in-vpn-policy/72643>\
**Category:** Router\
**Created:** [November 5, 2026, 3:39pm UTC](https://forum.gl-inet.com/t/ui-fix-allow-standalone-tld-entries-in-vpn-policy/72643 "2026-11-05T15:39:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nankey](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/n/2bfe46/32.png) [@nankey](https://forum.gl-inet.com/u/nankey)\
**Post date:** [November 5, 2026, 3:39pm UTC](https://forum.gl-inet.com/t/ui-fix-allow-standalone-tld-entries-in-vpn-policy/72643/1 "2026-11-05T15:39:15Z")

</div>

On Flint 4, the GL.iNet Admin Panel frontend blocks standalone Top-Level Domains (TLDs) such as `ai`, `io`, or `gle` in the VPN Policy setting page - specifically the `Select Target Destination` page.

 ![tld-rejected](https://forum-static.gl-inet.com/original/3X/9/9/99b868adac075f4e6e03896693978c8197f661d8.png)

Please consider relaxing the domain validation in the frontend so that TLDs like `io`, and `ai` etc. are allowed.

> **temporary workaround**
>
> To route entire TLDs, a temporary workaround is to manually edit the policy file via SSH:
> 
> - SSH into the router
> - Run `uci show route_policy` to locate the policy file, such as `route_policy.@rule[1].to_list_external='/etc/domain_mac_list/dst_net6766'`
> - Edit that file `/etc/domain_mac_list/dst_net6766` to include the standalone TLDs, each TLD as a new line;
> - Then restart the vpn client, `/etc/init.d/vpn-client restart`
> 
> I have tested with standalone TLDs like `ai` and `gle`, and above temporary solution works -  
> `ai` and `gle` are shown in /tmp/dnsmasq.d/via\_domains and in the dns\_mark dump.
> 
> ```auto
> root@GL-BE14000:~# grep -E "/gle/" /tmp/dnsmasq.d/via_domain 
> nftset=/gle/4#inet#vpn_table#dst_net6766,6#inet#vpn_table#dst_net6766_6
> root@GL-BE14000:~# grep -E "/ai/" /tmp/dnsmasq.d/via_domain 
> nftset=/ai/4#inet#vpn_table#dst_net6766,6#inet#vpn_table#dst_net6766_6
> 
> root@GL-BE14000:~# cat /proc/dns_mark/dump | grep -E "^gle"
> gle
> root@GL-BE14000:~# cat /proc/dns_mark/dump | grep -E "^ai"
> ai
> 
> ```
> 
> `muse.ai` and `c.gle` resolved IPs are also added to the IP sets in nftables `vpn_table` successfully.

Many thanks in advance for the GL.iNet dev team's consideration!

---

<div class="post-metadata">

**Author:** ![will.qiu](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/w/b38774/32.png) [@will.qiu](https://forum.gl-inet.com/u/will.qiu)\
**Post date:** [November 6, 2026, 7:28am UTC](https://forum.gl-inet.com/t/ui-fix-allow-standalone-tld-entries-in-vpn-policy/72643/4 "2026-11-06T07:28:08Z")

</div>

Hi,

Thanks for the suggestion! We’ll discuss it with our product team.

---

<div class="post-metadata">

**Author:** ![xize11](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/xize11/32/5340_2.png) [@xize11](https://forum.gl-inet.com/u/xize11)\
**Post date:** [November 6, 2026, 8:10am UTC](https://forum.gl-inet.com/t/ui-fix-allow-standalone-tld-entries-in-vpn-policy/72643/5 "2026-11-06T08:10:45Z")

</div>

I did not know this was possible with dnsmasq + ipsets to resolve ipset with TLD's.

Thanks for sharing 👍