TikTok autonomous systems
A service may serve part of its traffic (images, video, updates) through third-party CDNs and caches inside ISPs; those addresses are not included. If something still loads the wrong way after routing, add Cloudflare or check a specific domain in DNS lookup.
How to route one service through a VPN and the rest directly
WireGuard
Choose “WireGuard AllowedIPs” and paste the line into the client’s [Peer] section instead of 0.0.0.0/0. Only these subnets go through the tunnel. To build “everything except the LAN” lists, use the AllowedIPs calculator.
MikroTik
The address-list format adds the subnets to a list. Then a mangle rule with a routing mark and a separate routing table through the tunnel:
/routing table add name=via-vpn fib
/ip route add dst-address=0.0.0.0/0 gateway=wg0 routing-table=via-vpn
/ip firewall mangle add chain=prerouting dst-address-list=telegram action=mark-routing new-routing-mark=via-vpn passthrough=noThe simpler way without mangle is the “MikroTik routes” format: one route per subnet. A full config with WireGuard: MikroTik generator.
Keenetic
In the web UI: Routing → Add route, one at a time. Faster from the CLI (Telnet/SSH or the web CLI): put your connection’s name (for example Wireguard0) in the interface field, paste the Keenetic commands and run system configuration save.
Linux, OpenWrt
ip route commands last until reboot. On OpenWrt an ipset or nftables set plus a marking rule is easier to keep; both formats are available.