Targets
The "Targets" tab defines which traffic the set applies to. Traffic is filtered by domains, IP addresses, GeoSite/GeoIP categories, and source devices.
TLS version filter
At the top of the tab is the TLS version selector:
- Any - process all TLS traffic
- 1.2 - only TLS 1.2
- 1.3 - only TLS 1.3
Useful when different TLS versions need different bypass strategies (some providers block TLS 1.2 and TLS 1.3 in different ways).
Domains
Manual domain entry for bypass. Enter a domain and press Enter.
- Multiple domains can be added separated by commas or newlines
- Duplicates with another set trigger a warning
- The Edit list button opens a text editor (one domain per line)
GeoSite categories
Instead of adding domains one by one, pick a category from the GeoSite database. Each category contains hundreds or thousands of domains (for example, youtube, discord, google).
To use GeoSite, the database must be loaded (Settings -> Geodat settings).
Clicking a category shows the list of domains it contains.
IP addresses
Manual entry of IPs or CIDR ranges (for example, 10.0.0.0/8, 192.168.1.100).
Works the same way as domains: bulk editing supported, duplicates warned.
GeoIP categories
The GeoIP equivalent for IP ranges. Categories are keyed to countries and ASNs.
Source devices
Limits the set to traffic from specific devices on the network.
Devices discovered from the ARP table are matched by their MAC address. Devices you added manually have no MAC address on the network, so they are matched by the IP address you entered for them. Give a manually added device a fixed or reserved address, and note that it cannot be matched at all when an intermediate router replaces the source address of its traffic before it reaches b4.
The table shows available devices:
| Column | Description |
|---|---|
| Select | Checkbox to include the device |
| MAC | Device MAC address, or matched by IP for a manually added device |
| IP | Current IP address |
| Name | Device alias or vendor |
If no device is selected, the set applies to all traffic. When devices are selected, only their traffic is matched. Device-bound sets take priority over generic ones.
Every routing rule matches a destination address. Source devices decide whose traffic is offered to that rule, not which traffic is steered, so a set whose only target is a source device routes nothing and b4 installs no rule for it.
To send everything from a device, keep the device selected and turn on Match any IP address on the IP addresses tab. Traffic the router itself originates is left alone for such a set, because it can never come from a source device.