Routes

A route is the way a tab reaches its target. Every tab has one:

• Direct - straight from your computer.
• A manual proxy - SOCKS5, HTTP or HTTPS.
• A ProxyPass node.

Each tab can take a different route, so one tab can reach a customer network while the next one goes straight out.

Add a manual proxy

1. Open Settings > Manual proxy.
2. Fill in Name, Type, Host and Port.
3. If the proxy needs a sign-in, turn on Auth · credentials in the profile and fill in User and Password. Vandle stores them, so there is no prompt on connect.
4. Click Test. It reports Reachable · … ms, or why the test failed.
5. Click Save.

Type is one of:

• SOCKS5,
• HTTP - an HTTP proxy that opens the connection for you,
• HTTPS - the same, with an encrypted connection to the proxy itself.

For SOCKS5, DNS via proxy decides who looks up names. Yes (no leak) lets the proxy do it, so your own DNS server never sees which hosts you reach. No looks them up on your computer.

A stored password is protected by the master key. If Vandle is locked when you save, it asks you to unlock it first.

Load ProxyPass nodes

1. Open Settings > ProxyPass list.
2. Paste your Management key.
3. Click Load from the management API.

The list shows every node with its state: active, offline or blocked. Your manual proxies appear there too, marked manual. Add a manual one takes you to the manual proxy form.

Keep the management key stored. Vandle needs it each time a tab connects through a node, because the node's address comes from the management API.

Group key · fallback is only needed when your management key lacks the "Node Secret" permission.

Choose the route for a new tab

In the picker (Ctrl+Shift+T), the Route row at the bottom sets how a target you type gets out. It appears once you have at least one proxy, and starts at Direct each time.

Saved connections and machines from Settings > Machines keep their own route. The Route row does not change them.

Set the route of a saved connection

1. Right-click the connection in the sidebar and choose Edit….
2. Under Route, pick Direct (no proxy) or a proxy.
3. Click Apply.

The route belongs to the machine behind the connection. If several connections use the same machine, the dialog says so: the change applies to all of them.

Give a whole folder a proxy

1. Right-click the folder and choose Edit….
2. Under Default proxy for everything in this folder, pick a proxy.
3. Click Apply.

A folder with its own proxy shows a shield icon. Hover it to see which proxy.

How a connection inside the folder gets out:

• A connection with a proxy of its own uses that proxy.
• A connection set to Direct (no proxy) takes the folder's proxy.
• A folder set to No shared proxy passes on the proxy of the nearest folder above it.

See which route a tab uses

The chip at the top right of the window shows the route of the tab in front:

• Direct, or the proxy it goes through,
• for SSH and SFTP tabs the whole path, from proxy to target host and port,
• followed by how long the connection took to open, in ms.

For SSH, SFTP, remote desktop, database, MQTT and Docker tabs, hovering the chip shows how long the tab has been connected. In the sidebar, hover a tab to see Route: and the route.

Routes and Web tabs

Web tabs on different routes run in separate browsers. Your cookies, logins and extensions are kept per route, so a site you signed in to directly asks you to sign in again through a proxy. See Browser profiles.

Diagnose a route

When a tab does not connect, click the route chip. Under This route:

• Check the name - opens the DNS tool with the tab's host. It asks DNS from your computer, not through the proxy.
• Check the route - opens the Route tool with the tab's host, port and route. It shows where the time goes: Name resolved, Proxy reached, Through the proxy, Target open. Then it connects several times and reports min, median and max.
• Check the public IP - shows the public address the route leaves from.

For an encrypted Web page, the lock left of the page title offers Inspect in Toolbox, which opens the certificate tool over the same route.

These actions are also in Settings > Hotkeys as Diagnose the name, Diagnose the route and Inspect the certificate. They have no key by default; click one there and press the combination you want.

Host keys and routes

SSH and SFTP check the server's host key on the first connect. The dialog shows the Target and the Route:

• Always trust stores the key.
• Trust just this once connects without storing it.
• Cancel does not connect.

The key is checked against the server you asked for, never against the proxy in between. It is stored per server and route. The same address through another proxy can be a different machine, so Vandle asks again there.

If a stored key changes, the dialog warns you and shows the old fingerprint. Replace the old key stores the new one.