The first time people travel abroad they discover their carefully tuned setup suddenly causes problems. And reaching services back home is a separate need with an entirely different solution.
Why the old configuration misbehaves
Because the assumption behind your routing rules has inverted. A typical home configuration says "local traffic direct, everything else through the tunnel". Once you leave, that logic runs backwards:
| Rule | At home | Abroad |
|---|---|---|
geosite:cn → direct | ✅ Fast access to local sites | ❌ Direct from abroad is very slow |
| Everything else → proxy | ✅ Necessary | ❌ Pointless detour |
| Global TUN | ✅ Reasonable | ❌ Drags local network traffic through too |
The result: browsing local sites in your destination country sends traffic all the way to a server on the other side of the world and back, multiplying latency.
What to do instead
- Prepare a "travel" configuration before you goDo not start researching after you arrive.
- Make direct the default outboundLocal sites in your destination need no tunnel at all.
- Route only home-country services through a tunnelAnd that tunnel should terminate in your home country.
- Keep one emergency serverSome destinations have their own restrictions.
Reaching home is a different product
Many people do not realise that ordinary provider servers are one-directional: they take you from home to abroad. Reaching home-country streaming, music or gaming services from abroad requires a return route, and the two are not interchangeable.
- Why — home-country services check the origin IP and restrict or refuse foreign addresses.
- Where to get one — some providers sell dedicated return lines; you can also build your own if you have a public IP at home.
- Traffic direction — abroad → a server in your home country → the service, so the exit IP is domestic.
Practical points while travelling
| Situation | What to watch |
|---|---|
| Airport and hotel Wi-Fi | Avoid sensitive work on public networks even with a tunnel |
| Countries with strict filtering | Bring servers on several protocols; one approach may fail |
| Roaming data | A tunnel sends everything out — watch the cost |
| Time zone changes | Confirm automatic time sync; a wrong clock breaks VMess |
| Local errands | Banking and government apps work better direct; a tunnel triggers fraud checks |
Pre-departure checklist
- Is the travel configuration prepared and tested?
- Do you have a return-route option if you need home services?
- Is the subscription URL saved somewhere reachable without a working tunnel?
- Have you downloaded the client installer locally?
- Does the phone's per-app list exclude banking and payment apps?
- Is automatic time synchronisation enabled?