2030039 - Firefox VPN: Add wildcard/regex domain exclusions with exceptions

Status: UNCONFIRMED

(Firefox :: IP Protection, enhancement)

Description

[Valeriy Efremov]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0

Steps to reproduce:

1. Open Firefox
2. Enable Firefox VPN
3. Go to VPN settings
4. Try to add a domain to the exclusion list
5. Attempt to use a wildcard (e.g., *.ru) or a regex pattern

Actual results:

The VPN only accepts exact domain names. Wildcards and regular expressions are not supported.

Expected results:

It should be possible to:

• Use wildcard patterns (e.g., *.ru) or regular expressions to exclude groups of domains
• Define more specific rules that override general patterns (e.g., exclude *.ru but allow a specific domain within that zone)

This would provide more flexible and practical control over VPN routing.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Firefox::IP Protection' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Ariel]

Adding a use case from a university network. Institutional services span many subdomains (e.g. login.nyu.edu, brightspace.nyu.edu, library.nyu.edu, proxy.library.nyu.edu), and SSO redirects between them. On top of that, academic journals (JSTOR, ScienceDirect, IEEE Xplore, etc.) grant access based on the campus IP, so they also need to be excluded

With exact-host matching only, users must add every subdomain by hand, and missing one silently breaks login or journal access, which is hard to diagnose. A suffix rule like *.nyu.edu would solve this

Bug 2016676 reverted implicit subdomain matching because a broad exclusion and a per-site “Use VPN for this site” toggle conflicted, with no defined precedence. An explicit opt-in syntax (only when the user types *.) plus a “most specific rule wins” policy would address both that conflict and the override case requested in this bug’s description