Identity first, policy second

In DHCP-managed topologies, OpenSurge uses a reservation to keep a device on a stable IPv4 address and associates that address with its MAC identity. In bypass-router mode, a stable router-side IPv4 address is enough to start; MAC information can remain optional.

The generated mihomo overlay places source-specific rules before the ordinary global rules. That makes device behavior explicit without turning each device into a separate proxy client.

Dedicated does not mean isolated from the LAN

A dedicated egress selector applies to public traffic. Local and private destinations remain direct so casting, local services, game discovery, and controller traffic can continue to work inside the household network.

  • Follow the gateway rule set.
  • Use a device-specific selector for public destinations.
  • Apply targeted overrides by domain, IP, protocol, port, or rule provider.
  • Reject selected traffic for a specific device.

Reuse matching logic without baking in an exit

The rule library separates reusable rule sets, outlet-free routing templates, and each device's hit action. One template can therefore describe a service once while different devices send its matches to different fixed exits or independently switchable selectors.

OpenSurge includes an inspectable Claude Code community example as a learning starter. It remains inactive until an operator chooses a device and an exit, and it is not presented as an official Anthropic rule list.

  • Keep small domain, IP CIDR, or classical lists inline.
  • Use HTTP rule providers for larger operator-owned lists.
  • Combine rule sets in an outlet-free routing template.
  • Choose the fixed action or selector only on the device route.

Observe the actual egress chain

The Web GUI attributes active connections and transfer rates to observed or registered devices. It shows the outbound chain reported by mihomo instead of assuming that the selected label is the route a connection actually used.

FAQ

Questions people ask before changing the network

Does changing the Mac local mode change device policy?

No. The Mac local rule/global/direct switch is source-scoped and does not replace the policies generated for downstream devices.

Can an unmanaged device receive a dedicated route?

The device needs a stable source identity. In bypass-router mode that can be a stable IPv4 address; DHCP-managed modes normally use a reservation with MAC identity.