Identity first, policy second
In DHCP-managed topologies, OpenSurge uses a reservation to keep a device on a stable IPv4 address and associates that address with its MAC identity. In bypass-router mode, a stable router-side IPv4 address is enough to start; MAC information can remain optional.
The generated mihomo overlay places source-specific rules before the ordinary global rules. That makes device behavior explicit without turning each device into a separate proxy client.
Dedicated does not mean isolated from the LAN
A dedicated egress selector applies to public traffic. Local and private destinations remain direct so casting, local services, game discovery, and controller traffic can continue to work inside the household network.
- Follow the gateway rule set.
- Use a device-specific selector for public destinations.
- Apply targeted overrides by domain, IP, protocol, port, or rule provider.
- Reject selected traffic for a specific device.
Observe the actual egress chain
The Web GUI attributes active connections and transfer rates to observed or registered devices. It shows the outbound chain reported by mihomo instead of assuming that the selected label is the route a connection actually used.
FAQ
Questions people ask before changing the network
Does changing the Mac local mode change device policy?
No. The Mac local rule/global/direct switch is source-scoped and does not replace the policies generated for downstream devices.
Can an unmanaged device receive a dedicated route?
The device needs a stable source identity. In bypass-router mode that can be a stable IPv4 address; DHCP-managed modes normally use a reservation with MAC identity.