Skip to content

Hosts & TUN Exclusions

Hosts Configuration

In Settings → Advanced → Hosts Configuration, you can define custom local domain resolution using the same format as the system hosts file:

127.0.0.1  example.local
::1        example.local
192.168.1.1 router.local

Generation Rules

Mapping Type Conversion Method
Single domain mapping Converted to a sing-box hosts type DNS server
Wildcard mapping (e.g., *.example.com) Converted to a predefined type DNS rule

How Hosts Configuration Works

  1. Rover reads each line from the Hosts configuration
  2. Single domain mapping (e.g., 127.0.0.1 example.local) generates a hosts type DNS server
  3. Wildcard mapping (e.g., 192.168.1.1 *.example.com) generates a predefined type DNS rule
  4. These rules have the highest priority and take effect before DNS rule matching

Use Cases

Scenario Example
Local development 127.0.0.1 dev.example.com
Internal services 10.0.1.100 gitlab.internal
Ad blocking 0.0.0.0 ads.example.com
DNS hijacking test 127.0.0.1 test.local

Ad Blocking

Blocking ads via Hosts is simple but less flexible than using rule sets (like BanAD). Hosts requires adding entries one by one, while rule sets can auto-update.

TUN Excluded Addresses

In Settings → Advanced → TUN Excluded Addresses, you can configure network segments that should bypass Rover when TUN mode is active. One per line:

192.168.0.0/16
10.0.0.0/8
172.16.0.0/12

Generation Rules

TUN excluded addresses are written to the tun.inet4_route_exclude_address field in the sing-box configuration and excluded at the routing level by the core.

Use Cases

Scenario Excluded Addresses
Internal network access 192.168.0.0/16, 10.0.0.0/8
LAN devices 192.168.1.0/24 (printers, NAS, etc.)
Company VPN Company VPN network segment
Special services IPs that must connect directly

Important

  • TUN excluded addresses only take effect in TUN mode — system proxy mode doesn't need this
  • Excluded addresses completely bypass Rover, including routing rules
  • Once excluded, you cannot route these addresses through a proxy via policy rules

Default Exclusions

Rover excludes common private network segments by default (127.0.0.0/8, 192.168.0.0/16, etc.). You typically only need to add additional custom segments.