Setup
Routing rules: who goes through the exit pool
Control, per country and ASN, who is proxied through a clean exit pool, who goes direct, and who is blocked.
← All docsRules are evaluated top to bottom; the first match wins. Each visitor is classified at the TLS handshake by IP, ASN and country before any rule runs.
Actions
- Proxy — route through a clean exit pool. Use for regions where your origin is blocked or your origin blocks them.
- Direct — send straight to your origin with no overhead. The default for everyone unmatched.
- Block — reject with HTTP 451. Use for sanctioned jurisdictions you must not serve.
Starting presets
- Restore RU/BY access — route Russia and Belarus through the exit pool, block sanctioned countries, everyone else direct.
- Block sanctioned only — refuse sanctioned jurisdictions with 451, everyone else (incl. RU/BY) direct. Pick this for compliance-only.
- Direct, no rules — send everything to origin; useful to confirm DNS before layering logic.
Matching
Match by ISO country codes (comma-separated) and/or ASNs. An empty country list means any. More specific rules should sit above broad ones, since the first match wins.
Exit pools
Proxy actions send traffic through an exit pool. Shared pools are included on every plan; Pro and above get a dedicated pool with automatic IP rotation when an address is banned — without you touching anything.
Defaults already solve the common case (restricted regions proxied, everyone else direct). Only add rules when you need country-specific behaviour.