Traffic routing and paths
Business traffic. Each takes its own path.
Business services go through the designated egress point, everyday access connects directly. Select routes by domain, IP or rule set, and let the client or node execute them.
See how to set it upEveryday access, direct local connection.
Set rules by domain, IP, destination port or protocol, and you can also use rule sets to manage a group of services uniformly. Services that require a designated egress choose Relay, while other access is handled by direct connection rules or the default action.
The client's DIRECT uses the device's local network. Choosing a direct-connection Gateway as a proxy node still routes access through the Gateway.
Learn about client traffic routing →Rules are handled by the node.
Devices retain their connection settings; business egress is adjusted centrally by administrators.
Business traffic routing policySelect an egress by service.
Add a rule for a domain or IP range.
At the egress, specify the next hop.
Split routing hands designated business traffic to another Connector that already has an established link, while all other access still goes direct from the local machine. The node downloads and applies the published policy, and devices keep their existing configuration.
A direct Gateway can also enforce rules uniformly, choosing Relay, direct node connection, or blocking based on the destination.
Learn about node traffic routing →Specific rules, placed first.
Business rules are matched from top to bottom, and the first match determines the path. Place the specific domains of company business before general rules; access that does not match uses the default action.
The client's platform security rules run before business rules: local, private network, and control domains go direct, and known cloud metadata endpoints are denied. Custom business rules cannot override them.
Besides choosing a path by destination, you can also set a fixed Cloud Pulse egress in the WireGuard or RouterOS configuration of a standard Relay. Only that one configuration changes; other devices keep their own settings.
Learn about independent terminal egress →Frequently asked questions.
After saving a rule, will the device use the new configuration?
Saving a draft does not change the current configuration. After client rules are published, employees still need to refresh and enable the new subscription version; after node policies are published, the node still needs to download, apply, and return a receipt. Once application is confirmed, verify the connection by accessing business services from the device.
What happens to access if the specified egress is offline?
If the egress specified by a node policy, or the Relay chosen by default by the Gateway, is unavailable, the corresponding access is blocked and will not automatically fall back to a direct connection. Publish again after resolving the fault or explicitly changing the egress.
Can the node identify all domains and also handle IPv6?
The execution node needs firmware supporting traffic routing and the corresponding mode enabled. Node routing uses IPv4 and blocks IPv6. DoH, ECH or caching may prevent domain recognition; that traffic follows IPv4 rules or the default action. Policies handle only bound endpoints or the corresponding authorized inbound traffic; RouterOS handles only traffic sent into the tunnel.
After a terminal is bound to Cloud Pulse, can node policies still be used?
First clear the endpoint configuration’s individual Cloud Pulse binding, then select a node routing policy. Each Gateway executing a policy must separately associate and verify its Cloud Pulse egress. Connector policies select other Connectors through next-hop links.