gistfile1.txt

function FindProxyForURL(url, host) {
  // Home tower: always direct on the LAN, never via the Roku tunnel.
  // Must precede the private-subnet rule, which would otherwise match
  // the 192.168.1.207 /etc/hosts override and route this to SOCKS.
  if (host === "enthooz.duckdns.org") return "DIRECT";

  // Roku corp domains
  if (dnsDomainIs(host, ".roku.com") || dnsDomainIs(host, ".rokulabs.net")) {
    return "SOCKS5 127.0.0.1:1080; SOCKS 127.0.0.1:1080";
  }

  // Home LAN — never hairpin through the tunnel
  if (isInNet(host, "192.168.0.0", "255.255.0.0"))
    return "DIRECT";

  // Corp private nets — via tunnel
  if (isInNet(host, "10.0.0.0", "255.0.0.0") ||
      isInNet(host, "172.16.0.0", "255.240.0.0"))
    return "SOCKS5 127.0.0.1:1080; SOCKS 127.0.0.1:1080; DIRECT";

  return "DIRECT";
}