Introducing Geo Exclusion for NymVPN

Firefox and Mullvad Browser are the two to reach for. Both can be pointed at a SOCKS5 proxy in their own settings, so neither depends on your OS supporting one. Mullvad Browser is a privacy-hardened build of Firefox, so the steps below apply to both.

1. Open Settings and search proxy. Or navigate there: Privacy and security → Advanced settings → Configure proxy.
2. Choose Manual, not Automatic proxy configuration URL.
3. Find the SOCKS Host row. Paste 127.0.0.1 into the wide box beside that label — the box has no placeholder text, so it looks blank and unlabelled.
4. Paste your port 1081 into the narrow Port box next to it.
5. Select SOCKS v5. Firefox offers SOCKS v4 as well, but only v5 works here.
6. Below, check Proxy DNS when using SOCKS v5. This stops DNS lookups leaking outside the proxy.

⚠️ Leave the HTTP Proxy and HTTPS Proxy rows empty. The dialog stacks three identical-looking host and port rows. Only the SOCKS one applies. Filling in the wrong row will give you a browser that quietly fails to load anything, with no error explaining why.

On Android, use split tunneling instead

Android has no system-wide SOCKS5 setting, and mobile browsers can't be pointed at a proxy. A few apps support SOCKS5 in their own settings, Telegram among them under Data and Storage, but for most cases NymVPN's split tunneling is the better tool. It needs no proxy at all:

1. Open Settings in NymVPN and go to Split tunneling.
2. Search for the app you want to connect directly.
3. Set it to Direct connection.

Split tunneling sends a whole app outside the tunnel; Geo Exclusion divides one app's traffic by destination, for when a single app talks to both local and international services.

Checking that it's working

One IP lookup won't tell you. A local site reporting your real address is equally consistent with Geo Exclusion working and with the VPN having dropped. Check two places at once.

Open two IP-checking services in the same browser: one hosted inside the excluded region, one outside.

• Inside the region: your real local IP address. That traffic is going direct.
• Outside: a NymVPN exit address. Your protected traffic is still in the tunnel.

The pair is the confirmation. For a sharper signal, check both before configuring the proxy too: beforehand both should report the NymVPN address, and the local service will probably be slow. Afterwards only the local reading should change.

What Geo Exclusion does not do

This matters more than the setup.

Traffic to excluded regions bypasses the VPN. It is not protected, and your internet provider sees the metadata exactly as it would if the VPN were off. That is the point: those connections have to look local to work. It also means your usual protection doesn't extend to them.

So use it deliberately. Turn it on because specific local services need to work, know those connections are exposed, and keep anything you want protected on the other side of the tunnel. Where exposure carries real risk, don't route it through an excluded range.

It is also a beta, currently on one region, with per-app setup on most platforms. So it's not yet set-and-forget.

Local access shouldn't cost you protection

Every privacy tool runs into the same trade: the more thoroughly it protects you, the more of ordinary life it breaks. People respond by switching it off, which is the worst outcome available. We designed Geo Exclusion so the answer to a bank that won't load is a setting, not a disconnection.