In short
- Smart routing sends the traffic of Russian services outside the VPN tunnel: there's no need to turn MaskNet off.
- The rest of your traffic goes through the protected MaskNet network.
- The decision is made automatically, at the network level.
- Through the VPN tunnel, an external service sees a MaskNet IP; outside the VPN tunnel, a Russian service sees your Russian IP.
- You keep working with a single connection.
Why one mode doesn't suit every site
The classic VPN model is simple: once you connect, all supported traffic goes through the VPN server you picked.
For many purposes that's enough. But everyday internet use is made of very different services.
In a day, someone opens a Russian bank, then Gosuslugi, a marketplace, a work app, an international website and a video service. These systems have different requirements, infrastructure and security rules.
Some Russian services pay closer attention to connections from foreign IP addresses. Some ask you to sign in again or add an extra check; others show a different regional version of the page.
If handling each of those cases means turning the VPN off by hand, keeping protection on all the time becomes inconvenient.
Gosuslugi, banks and Russian websites work without turning MaskNet off
MaskNet's smart routing sends the traffic of Russian services outside the VPN tunnel.
A request to a bank, Gosuslugi, a marketplace or another Russian website goes over your ordinary internet connection, bypassing MaskNet's foreign location.
The Russian service sees your Russian IP, sign-in to the banking app isn't blocked, and there's no need to toggle MaskNet before each such action.
Outside the VPN tunnel, a Russian service sees the public IP of your ordinary internet connection. That differs from connections that go through the protected MaskNet network and get a MaskNet external IP.
This split is part of smart routing, not a separate mode you have to switch on for each site.
Other services use the protected MaskNet network
When a connection goes through MaskNet infrastructure, traffic between the device and the protected network is encrypted.
The external service then receives the connection from MaskNet's side and sees the public IP of the relevant location instead of your original public IP.
That principle is standard for VPN technology, but in MaskNet it's part of a wider network logic.
Smart routing handles connections differently depending on their destination, instead of forcing all internet traffic down the same path.
The approach is most noticeable in everyday use, when Russian and international services are opened one after another all the time.
Smart routing works automatically
You shouldn't have to compile domain lists, study IP ranges or switch network rules before opening each app.
MaskNet takes that work on.
Smart routing decides how to handle a connection within the service's network logic. The decision takes into account the type of destination and the available infrastructure.
MaskNet stays connected: Russian services see a Russian IP, and traffic to international websites and apps goes through MaskNet servers.
It's one reason MaskNet can't be reduced to choosing a VPN country. Locations remain an important part of the service, but on top of them runs additional logic built around real everyday use.
What this gives you on an ordinary day
Say you check a banking app in the morning, then open international work services and video, visit a marketplace after lunch and use several apps on your phone in the evening.
Without automatic splitting of connections, you'd have to keep track of when to leave the VPN on and when it's better to turn it off for a while.
With MaskNet, the traffic of Russian services goes outside the VPN tunnel, over your ordinary network. All other connections go through MaskNet's protected infrastructure.
The approach is especially useful on a smartphone, where people switch between apps constantly and rarely want to deal with network settings.
The same logic applies to a computer and other supported devices.
The VPN tunnel and the route outside it do different jobs
It's important to understand the difference between the two cases.
When a connection goes through the protected MaskNet network, MaskNet's VPN-level protection applies, and the external service sees a MaskNet IP.
Outside the VPN tunnel, this MaskNet layer isn't used for that particular connection. The website sees your ordinary public IP.
That doesn't mean data sent to your bank or another modern HTTPS service travels across the internet in plain text. HTTPS still protects the connection between the app or browser and the service itself.
So the route outside the VPN tunnel and VPN protection are different layers of network logic, each used where the product needs it.
What to remember
- MaskNet lets you use Russian and international services without constantly turning it off by hand.
- The traffic of banks, Gosuslugi, marketplaces and other Russian services goes outside the VPN tunnel.
- Other connections go through the protected MaskNet network.
- The external IP depends on where smart routing sends a given connection: through MaskNet or outside the VPN tunnel.
- Smart routing manages this logic automatically.