# VPN Tunnel Exceptions not working on X3000 **URL:** \ **Category:** Router\ **Created:** [September 27, 2026, 12:29am UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606 "2026-09-27T00:29:15Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![mturley](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/90ced4/32.png) [@mturley](https://forum.gl-inet.com/u/mturley)\ **Post date:** [September 27, 2026, 12:29am UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/1 "2026-09-27T00:29:15Z")
I am using FW 4.10, but it worked the same for 4.8 and 4.9. I do like the new VPN exception interface in the latest FW, it is much nicer. I have a website where Cloudflare apparently does not like the VPN IP address. So I put a domain exception in the VPN setup, but it does not route by the VPN for that domain. You can see here that the IP that `healthequity.com` received was the VPN IP, not my public IP. My VPN IP is 198.44... and my Public IP is 172.56... ![Screenshot 2026-09-26 123718](https://forum-static.gl-inet.com/original/3X/a/a/aa6eb10c2f7f2f8d7b174e78b9cdb61f425983f2.png) ---
**Author:** ![AI\_bot](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/a/ecccb3/32.png) [@AI\_bot](https://forum.gl-inet.com/u/AI_bot)\ **Post date:** [September 27, 2026, 12:30am UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/2 "2026-09-27T00:30:00Z")
An excluded domain only bypasses that particular tunnel. If another lower-priority VPN tunnel matches **All Targets** , the connection will still use that VPN. As a first isolation test: 1. Leave only the tunnel containing **Exclude specified Domain / IP List** enabled. 2. Set **All Other Traffic** to **Allow Non-VPN Traffic** , not Enhanced Kill Switch. 3. Ensure the client/browser uses the router for DNS; temporarily disable browser Secure DNS/DoH, clear its DNS cache, and retry in a new private window. If it still shows `198.44…`, check the browser’s Developer Tools → Network view to identify the hostname of the request that reports the IP. HealthEquity may use a login, API, or Cloudflare hostname different from `healthequity.com`; that actual hostname must also be excluded. Please report whether other VPN tunnels are enabled and the hostname of that IP-checking request—those details distinguish rule-priority behavior from a domain-resolution mismatch. > **This reply was generated by AI. Please verify its accuracy.** > > GL.iNet Technical Support reviews and responds to relevant threads on business days. Please allow time for a staff response. ---
**Author:** ![mturley](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/90ced4/32.png) [@mturley](https://forum.gl-inet.com/u/mturley)\ **Post date:** [September 27, 2026, 12:31am UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/3 "2026-09-27T00:31:04Z")
Here are my exceptions: ![Screenshot 2026-09-26 172946](https://forum-static.gl-inet.com/original/3X/3/2/3201e8168ef4fc0ba13137dc48bd16e76336d16e.png) ---
**Author:** ![AI\_bot](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/a/ecccb3/32.png) [@AI\_bot](https://forum.gl-inet.com/u/AI_bot)\ **Post date:** [September 27, 2026, 12:31am UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/4 "2026-09-27T00:31:41Z")
The exception list alone does not show whether the traffic subsequently matches another VPN tunnel. Please share a screenshot of the full **VPN Dashboard** , including tunnel priorities and the **All Other Traffic** setting, with VPN endpoints/public IPs redacted. This will determine whether the domain is being caught by a lower-priority **All Targets** tunnel. Also confirm whether the result changes when every other VPN tunnel is temporarily disabled. If it still uses `198.44…`, the next step is to identify the exact hostname making the IP-detection request rather than adding more domains speculatively. > **This reply was generated by AI. Please verify its accuracy.** > > GL.iNet Technical Support reviews and responds to relevant threads on business days. Please allow time for a staff response. ---
**Author:** ![mturley](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/90ced4/32.png) [@mturley](https://forum.gl-inet.com/u/mturley)\ **Post date:** [September 27, 2026, 12:37am UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/5 "2026-09-27T00:37:10Z")
I only have the single tunnel, with 4 device exceptions and the 3 domain exceptions, all exceptions specified on the single active tunnel. ![Screenshot 2026-09-26 173457](https://forum-static.gl-inet.com/original/3X/8/9/8972672211f4bcad30496281309971256d522257.png) ---
**Author:** ![AI\_bot](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/a/ecccb3/32.png) [@AI\_bot](https://forum.gl-inet.com/u/AI_bot)\ **Post date:** [September 27, 2026, 12:37am UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/6 "2026-09-27T00:37:35Z")
That rules out a lower-priority tunnel. Please open the same HealthEquity page from one of the four device-excluded clients and check the reported IP: - If it shows `172.56…`, WAN bypass is working and the remaining issue is domain matching—HealthEquity is likely checking the IP through another hostname. Please provide that request hostname from the browser’s Developer Tools → Network panel. - If it still shows `198.44…`, the device exception is also not taking effect, which points to the tunnel policy itself rather than an incomplete domain list. Use a private window after closing existing HealthEquity tabs so an already-established connection is not reused. > **This reply was generated by AI. Please verify its accuracy.** > > GL.iNet Technical Support reviews and responds to relevant threads on business days. Please allow time for a staff response. ---
**Author:** ![mturley](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/90ced4/32.png) [@mturley](https://forum.gl-inet.com/u/mturley)\ **Post date:** [September 28, 2026, 10:17pm UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/8 "2026-09-28T22:17:10Z")
Well, I tried with my phone and tablet, that are not excluded from the VPN, and they both worked fine. Then back at the PC, it was still broken. I have been playing around trying different thing, but came up empty. My wife had an app that wasn’t working through the VPN, so I sniffed the network on that one and ended up excluding [googleapis.com](http://googleapis.com) from the VPN. That allowed that app to work. Then back to my [healthequity.com](http://healthequity.com) issue and wouldn’t you know, it always works now. If I take out the [googleapis.com](http://googleapis.com) exclusion it breaks again. So, by chance I stumbled on the fix for the issue. But, I believe there is still a bug in there somewhere since it worked fine on the phone/tablet (wifi), but not on the PC (wired). ---
**Author:** ![AI\_bot](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/a/ecccb3/32.png) [@AI\_bot](https://forum.gl-inet.com/u/AI_bot)\ **Post date:** [September 28, 2026, 10:17pm UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/9 "2026-09-28T22:17:31Z")
This points more strongly to a hostname dependency than to a wired-interface bug: the PC and mobile devices may load different HealthEquity resources or have different DNS/connection caches. Excluding `googleapis.com` allows a related request to bypass the VPN, but it also bypasses the VPN for potentially many unrelated Google API services. To distinguish the two possibilities, connect the **same PC and browser** over Wi‑Fi, close existing HealthEquity tabs, clear the DNS cache, and retry in a private window. If only Ethernet fails under otherwise identical conditions, that is useful evidence of an interface-specific policy issue. Otherwise, use Developer Tools → Network to identify the exact `googleapis.com` subdomain involved and exclude only that hostname if possible. > **This reply was generated by AI. Please verify its accuracy.** > > GL.iNet Technical Support reviews and responds to relevant threads on business days. Please allow time for a staff response. ---
**Author:** ![charles2](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/c/9dc877/32.png) [@charles2](https://forum.gl-inet.com/u/charles2)\ **Post date:** [September 30, 2026, 1:15am UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/10 "2026-09-30T01:15:14Z")
Hi, Thank you for the additional testing. To further check the VPN domain exception behavior, could you please provide the following information? 1. A screenshot of the current VPN Tunnel policy, including the configured Domain Exceptions. 2. On the affected PC, please open Command Prompt or PowerShell and run: ```auto ipconfig /all nslookup healthequity.com nslookup googleapis.com ``` 1. Please clear the DNS cache: ```auto ipconfig /flushdns ``` Then test HealthEquity again using a Private/Incognito window. Please provide the results. You may redact the Physical Address (MAC address), Host Name, and any other information you consider private if preferred. Thank you for your understanding and support. ---
**Author:** ![mturley](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/90ced4/32.png) [@mturley](https://forum.gl-inet.com/u/mturley)\ **Post date:** [October 1, 2026, 5:38pm UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/11 "2026-10-01T17:38:44Z")
Here are my VPN exception setup: ![Screenshot 2026-10-01 081617](https://forum-static.gl-inet.com/original/3X/2/9/29f71887fb228c6fc522b34307b6cd734023ea1f.png) Now this next pic must be a bug on the router, because I never entered url’s under the “Specified Domain / IP List (“Only route traffic destined for the listed domains or IP addresses through this VPN tunnel. Traffic to other destinations will bypass this tunnel.”) but this contains the exact same list as the VPN exceptions. ![Screenshot 2026-10-01 081634](https://forum-static.gl-inet.com/original/3X/a/d/ad13205cfed6c95de0fb66f5487744f0e965ad82.png) Here is my IP Config: ![Screenshot 2026-10-01 100900](https://forum-static.gl-inet.com/original/3X/2/c/2c27ef7b6b829ae87f1e7664dd8ea152324731dd.png) And nslookups: ![Screenshot 2026-10-01 100950](https://forum-static.gl-inet.com/original/3X/4/5/45560ada541d60cd2b31ed378092c312fa0b0b1e.png) I flushed the DNS and used incognito to go the `healthequity.com` and am still blocked (it is seeing the VPN IP) if I only have `healthequity.com` as an exception. Once I add [googleapis.com](http://googleapis.com), then I can get to the site: ![Screenshot 2026-10-01 102105](https://forum-static.gl-inet.com/original/3X/2/d/2debefb0cebec9305627ca29e0814e4901e72ed0.png) My public IP is 172.56… and my VPN IP is 198.44… I still have access on Android phone and tablet when the PC is blocked. On Win laptop and wifi, I am blocked as well. ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [October 1, 2026, 6:33pm UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/12 "2026-10-01T18:33:48Z")
Your PC must be configured to use your router as the DNS server. Not Cloudflare DNS. ---
**Author:** ![mturley](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/90ced4/32.png) [@mturley](https://forum.gl-inet.com/u/mturley)\ **Post date:** [October 1, 2026, 10:02pm UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/13 "2026-10-01T22:02:02Z")
Removed manual DNS settings on PC and Router. Same result, blocked from [healthequity.com](http://healthequity.com) when running VPN. ![Screenshot 2026-10-01 143938](https://forum-static.gl-inet.com/original/3X/9/3/933e587b26792200824b1dbdf4372296d4bcdfc4.png) ![Screenshot 2026-10-01 144006](https://forum-static.gl-inet.com/original/3X/6/5/65782b5f7fbdd518c06aa9354c16c2410f38c4e1.png) ![Screenshot 2026-10-01 144353](https://forum-static.gl-inet.com/original/3X/9/7/97951fa25691f153cc32d7c7fc007f5164239014.png) ---
**Author:** ![AI\_bot](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/a/ecccb3/32.png) [@AI\_bot](https://forum.gl-inet.com/u/AI_bot)\ **Post date:** [October 1, 2026, 10:02pm UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/14 "2026-10-01T22:02:33Z")
The latest test rules out the PC’s manual Cloudflare DNS setting, and the Windows laptop also failing over Wi‑Fi rules out an Ethernet-specific issue. Because adding `googleapis.com` consistently fixes access, HealthEquity’s Windows web flow appears to use a separate Google API hostname that is not covered by the `healthequity.com` exception. In Chrome or Edge, open **Developer Tools → Network** , enable **Preserve log** , reproduce the failure, and filter for `googleapis`. Please share only the hostname from the relevant **Request URL** —remove any path, query string, or token. Then test that exact hostname as the exception instead of the broad `googleapis.com` domain. If the exact hostname is still sent through the VPN while DNS is using the router, that would provide focused evidence of a policy-matching problem for staff to investigate. > **This reply was generated by AI. Please verify its accuracy.** > > GL.iNet Technical Support reviews and responds to relevant threads on business days. Please allow time for a staff response. ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [October 2, 2026, 9:50am UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/15 "2026-10-02T09:50:25Z")
Make sure to disable all DNS manipulation inside your browser. No DoT, no DoH. No encrypted DNS inside the browser itself. See an example here [Disabling Google Chrome's internal DNS client - WikiTwist](https://wikitwist.com/disabling-google-chromes-internal-dns-client/) ---
**Author:** ![mturley](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/90ced4/32.png) [@mturley](https://forum.gl-inet.com/u/mturley)\ **Post date:** [October 3, 2026, 6:28pm UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/16 "2026-10-03T18:28:39Z")
Well, well, some obscure setting hidden in the weeds of chrome! And wouldn’t you know it, it worked. I can now access Healthequity with just the `healthequity.com` exception on the VPN. Thanks Admon. ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [October 3, 2026, 6:41pm UTC](https://forum.gl-inet.com/t/vpn-tunnel-exceptions-not-working-on-x3000/71606/17 "2026-10-03T18:41:58Z")
Glad that it helped, even when my response was less helpful and a bit cryptic 🙂