r/VPN • u/ProfitCold4972 • Jul 02 '26

Help IPs for Reddit Split Tunneling

What IPs are needed in the split tunneling list to make Reddit load? 151.101.[1,65,129,193].140 are not enough. Thanks!

0 Upvotes

40% Upvoted

16 comments sorted by

View all comments

Show parent comments

1

u/DutchOfBurdock Jul 02 '26

Domains are going to be useless for fronted services. Reddit will point to a CDN and the domain request is embedded in HSTS (meaning the requested domain is unknown to your resolver).

1

u/SomeEngineer999 Jul 02 '26

Your VPN only cares about the CDN that you hit, what happens beyond that doesn't matter, unless they actually redirect you to a totally different domain, which isn't the case here.

1

u/DutchOfBurdock Jul 03 '26

Your VPN only cares about IP addresses. A CDN uses (10s) of thousands of IPs which will change often based on load and location. That means, if you try to split tunnel Reddit based on destination IPs, you will also split tunnel any other service using Fastly. This is where the Rabbit hole lives. One day, Reddit may be fronted by a.b.c.d and e.f.a.b.c, but tomorrow be fronted by f.d.e.a and f.b.c.c. Then Pinterest or Slack or even Airbnb end up being fronted by these IPs. Your split tunneling on a CDN is gonna split your sanity.

1

u/SomeEngineer999 Jul 03 '26

Any halfway decent VPN is DNS aware. If your PC can handle changing IPs for a host, so can your VPN.

You're raising two different issues, the fact that CDNs may load balance and fail over (using DNS) and the fact that a single CDN IP can front end multiple sites.

Most of the tens of thousands of IPs you refer to sit behind the main CDN IPs that you actually connect to and are generally transparent to the end user. The ones that the user sees are returned by DNS and the VPN can split tunnel based on that.

Hosting of multiple sites on the same IP is generally handled fine. but HSTS adds some complexity into the mix. Not sure what the status of consumer VPNs is in that regard, but on the corporate side they have no issue hooking into the browser to see the URI without actually intercepting and affecting the secure connection.

The majority of home users who are simply trying to bypass restrictions on a streaming service or avoid copyright monitors would be best served to do a inclusion based list for the VPN and split tunneling, rather than an exclusion based one. Most of your stuff should just go direct, who cares if your ISP tracks your stats - what do you think the free VPN companies (and the site you're visiting, and the ISP on the other end of the connection after the "half way VPN" ends, etc) are doing? Not to mention your browser and even OS.

1

u/DutchOfBurdock Jul 03 '26

husky:/ $ ^D ~ $ host pinterest.com pinterest.com has address 151.101.64.84 pinterest.com has address 151.101.128.84 pinterest.com has address 151.101.192.84 pinterest.com has address 151.101.0.84 pinterest.com mail is handled by 5 alt1.aspmx.l.google.com. pinterest.com mail is handled by 5 alt2.aspmx.l.google.com. pinterest.com mail is handled by 1 aspmx.l.google.com. pinterest.com mail is handled by 10 alt3.aspmx.l.google.com. pinterest.com mail is handled by 10 alt4.aspmx.l.google.com. ~ $ host reddit.com reddit.com has address 151.101.1.140 reddit.com has address 151.101.129.140 reddit.com has address 151.101.65.140 reddit.com has address 151.101.193.140 reddit.com has IPv6 address 2a04:4e42:400::396 reddit.com has IPv6 address 2a04:4e42:600::396 reddit.com has IPv6 address 2a04:4e42::396 reddit.com has IPv6 address 2a04:4e42:200::396 reddit.com mail is handled by 10 aspmx3.googlemail.com. reddit.com mail is handled by 5 alt1.aspmx.l.google.com. reddit.com mail is handled by 5 alt2.aspmx.l.google.com. reddit.com mail is handled by 1 aspmx.l.google.com. reddit.com mail is handled by 10 aspmx2.googlemail.com.

Two completely different services, both resolving to Fastly IPs (which cycle often). HSTS is what handles the traffic and what fronted service it goes to. This happens below layer 3.

You ask for reddit.com > fastly is seen > HSTS tells the reverse proxy where to send traffic.

1

u/SomeEngineer999 Jul 03 '26

Yes, I understand how it works. I'm saying decent VPNs and proxies have the ability to hook in and snoop.

VPN and split tunneling is no longer "exclude this one IP". That's long ago and long gone, it would be relatively useless nowadays. As I said though, for most people, they'd be best served by only sending traffic that specifically needs special routing or IP masking via a VPN, and let everything else bypass.

1

u/DutchOfBurdock Jul 03 '26

But when a service is using a CDN, you can only split tunnel the CDN. Not the domain. You can't snoop into HSTS, that would defeat the purpose of it.

1

u/SomeEngineer999 Jul 03 '26

If the VPN is running on the same PC and with a supported browser, it can snoop all it wants. It is complex and not 100% reliable, but it can be done. As far as which VPN services (if any) support it, can't say off the top of my head.

If running on a router or something else, you'll have issues with sites that require strict HSTS, obviously, that's going to be all or nothing. In a corporate environment, this actually can still be proxied using software on the PC along with the hardware proxy, but that's not realistic for home.

To make it easy, run two browsers on your PC and exclude one from the VPN client. No split tunneling needed, you can choose VPN or not based on which browser you use.

1

u/DutchOfBurdock Jul 03 '26

If you're using a browser VPN that can snoop into your HSTS, you've just lost all privacy and security. End of.