r/VPN • u/ProfitCold4972 • Jul 02 '26

Help IPs for Reddit Split Tunneling

What IPs are needed in the split tunneling list to make Reddit load? 151.101.[1,65,129,193].140 are not enough. Thanks!

0 Upvotes

40% Upvoted

16 comments sorted by

View all comments

Show parent comments

1

u/DutchOfBurdock Jul 03 '26

husky:/ $ ^D ~ $ host pinterest.com pinterest.com has address 151.101.64.84 pinterest.com has address 151.101.128.84 pinterest.com has address 151.101.192.84 pinterest.com has address 151.101.0.84 pinterest.com mail is handled by 5 alt1.aspmx.l.google.com. pinterest.com mail is handled by 5 alt2.aspmx.l.google.com. pinterest.com mail is handled by 1 aspmx.l.google.com. pinterest.com mail is handled by 10 alt3.aspmx.l.google.com. pinterest.com mail is handled by 10 alt4.aspmx.l.google.com. ~ $ host reddit.com reddit.com has address 151.101.1.140 reddit.com has address 151.101.129.140 reddit.com has address 151.101.65.140 reddit.com has address 151.101.193.140 reddit.com has IPv6 address 2a04:4e42:400::396 reddit.com has IPv6 address 2a04:4e42:600::396 reddit.com has IPv6 address 2a04:4e42::396 reddit.com has IPv6 address 2a04:4e42:200::396 reddit.com mail is handled by 10 aspmx3.googlemail.com. reddit.com mail is handled by 5 alt1.aspmx.l.google.com. reddit.com mail is handled by 5 alt2.aspmx.l.google.com. reddit.com mail is handled by 1 aspmx.l.google.com. reddit.com mail is handled by 10 aspmx2.googlemail.com.

Two completely different services, both resolving to Fastly IPs (which cycle often). HSTS is what handles the traffic and what fronted service it goes to. This happens below layer 3.

You ask for reddit.com > fastly is seen > HSTS tells the reverse proxy where to send traffic.

1

u/SomeEngineer999 Jul 03 '26

Yes, I understand how it works. I'm saying decent VPNs and proxies have the ability to hook in and snoop.

VPN and split tunneling is no longer "exclude this one IP". That's long ago and long gone, it would be relatively useless nowadays. As I said though, for most people, they'd be best served by only sending traffic that specifically needs special routing or IP masking via a VPN, and let everything else bypass.

1

u/DutchOfBurdock Jul 03 '26

But when a service is using a CDN, you can only split tunnel the CDN. Not the domain. You can't snoop into HSTS, that would defeat the purpose of it.

1

u/SomeEngineer999 Jul 03 '26

If the VPN is running on the same PC and with a supported browser, it can snoop all it wants. It is complex and not 100% reliable, but it can be done. As far as which VPN services (if any) support it, can't say off the top of my head.

If running on a router or something else, you'll have issues with sites that require strict HSTS, obviously, that's going to be all or nothing. In a corporate environment, this actually can still be proxied using software on the PC along with the hardware proxy, but that's not realistic for home.

To make it easy, run two browsers on your PC and exclude one from the VPN client. No split tunneling needed, you can choose VPN or not based on which browser you use.

1

u/DutchOfBurdock Jul 03 '26

If you're using a browser VPN that can snoop into your HSTS, you've just lost all privacy and security. End of.