Why GPT-Realtime-2 Needs a Different Clash Lane Than ChatGPT

In May 2026 OpenAI expanded the GPT-Realtime family with GPT-Realtime-2, pushing voice-first, sub-second latency experiences from demos into production SDKs. Developers no longer only hit REST endpoints with short request–response cycles. The OpenAI Realtime API keeps a persistent Realtime WebSocket on wss://api.openai.com/v1/realtime (or model-specific variants your SDK constructs), exchanges JSON events for session setup, and streams audio frames in both directions for minutes at a time. That transport shape punishes the same routing mistakes that barely show up when you load a ChatGPT thread in Chrome.

If your Clash profile was tuned for browser ChatGPT or generic PROXY buckets, Realtime traffic may never reach the outbound you think you selected. A blunt GEOIP,CN,DIRECT line can win before api.openai.com is classified; DNS that resolves outside Mihomo can synthesize addresses your split rules never see; Node, Python, or mobile runtimes may open raw TLS sockets while the marketing site happily followed OS proxy settings. The result looks like an OpenAI outage: HTTP 401 during upgrade, endless “connecting” spinners, audio that plays two seconds then freezes, or sessions that survive the handshake only to die when your url-test group flaps to a faster node mid-utterance.

This article complements—not replaces—sibling guides on Clash Official Site. For consumer web ChatGPT and GPT-5.5 Instant slowdowns, start with the GPT-5.5 Instant routing walkthrough. For IDE-shaped Codex and MCP tool calls, see the Codex MCP split guide. Here the vocabulary is Realtime-first: WebSocket upgrades, streaming audio, long TCP sessions, and capture paths for SDKs that do not behave like browsers.

Symptoms That Look Like “GPT-Realtime-2 Is Down”

Support threads cluster around predictable transport failures rather than model quality debates. REST calls to api.openai.com/v1/chat/completions succeed while wss://api.openai.com/v1/realtime never completes the HTTP 101 Switching Protocols upgrade; the first audio chunk arrives, then silence until the client times out; latency spikes appear only on half-duplex turns when the model speaks back; mobile or embedded SDK samples work on hotel Wi-Fi abroad but fail on your home LAN with Clash enabled; switching nodes mid-debug fixes one session and breaks the next because failover tore down an active WebSocket. Each pattern is a routing or capture problem long before you need to open an OpenAI status page.

Browsers honor OS proxy tables or ship encrypted DNS that accidentally aligns with your Mihomo listener. Language runtimes and native SDKs often ignore HTTP_PROXY unless you inject it, and they rarely respect browser-only Secure DNS toggles. Broad domestic shortcuts in community rule packs may classify synthesized fake-ip answers as local traffic. Aggressive health checks in subscription bundles optimize for speed-test HTML, not 90-second audio streams where a 200 ms ping hop collapses under sustained upload. Reproduce once with Mihomo’s live connection view filtered on api.openai.com and openai; the hostname and matched-rule columns usually tell the story before you touch YAML again.

Realtime API Endpoints and Hostnames to Route

Treat the following as a baseline inventory you confirm in your own logs, not a frozen vendor manifest. Feature flags, beta channels, and enterprise tenants extend the list in ways forum copy-paste cannot predict.

• Primary WebSocket API: api.openai.com on path /v1/realtime is the anchor for GPT-Realtime-2 sessions. Missing or mis-routing it produces classic handshake failures even when REST endpoints on the same host work.
• Session REST helpers: Some SDKs create ephemeral session tokens via HTTPS on the same host before upgrading to WebSocket. If only the REST leg is routed, you may authenticate successfully yet fail the upgrade on a different capture path.
• CDN and static assets: Documentation samples, WASM helpers, or web demo shells may pull from broader openai.com or oaistatic.com edges. A lean API-only rule block still looks fine in a speed test until a demo page stalls mid-load.
• Attachment and upload lanes: Domains such as oaiusercontent.com appear when sessions move files or previews through OpenAI-managed buckets—more common as Realtime apps mix voice with vision or document context.
• Chat-adjacent web properties: Browser-based Realtime demos may also touch chatgpt.com for login or session refresh. Log first; assume nothing about which stack your sample uses.
• Azure OpenAI (optional fork): Organizations routed through Azure may need parallel handling for *.openai.azure.com Realtime deployments. That is a different certificate and routing story from consumer api.openai.com; do not fold them together without evidence.

When in doubt, favor suffix rules tied to observations, then tighten to exact DOMAIN entries when noisy CDNs share infrastructure with unrelated workloads. Shared-rule hygiene appears in the rule-based routing tutorial; the discipline holds even when OpenAI ships new Realtime model strings every quarter.

TUN Mode Versus System Proxy for Realtime WebSocket

Choosing between TUN mode and system proxy is the first architectural fork for Realtime SDKs—not an afterthought once YAML looks pretty.

When system proxy (mixed-port) is enough

Browser demos, Electron shells that honor OS settings, and some HTTP client libraries that read HTTP_PROXY / HTTPS_PROXY may work with Mihomo’s mixed port alone. Enable system proxy in Clash Verge, confirm your demo tab shows api.openai.com hitting the intended group in logs, and only then declare victory. This path keeps domestic apps untouched and avoids driver prompts on managed laptops.

When you need TUN capture

Node ws clients, Python websockets libraries, mobile native SDKs, and many CI runners open direct sockets without reading environment variables. If connection logs stay empty during a failing Realtime session, Mihomo never saw the flow—enable TUN (or inject proxy variables into the exact process launcher your IDE uses). Pair TUN with DNS hijacking so DOMAIN rules match reliably; otherwise fake-ip and Secure DNS fights return. For capture trade-offs and platform prompts, read the Clash TUN mode guide and the system-proxy versus TUN troubleshooting article.

Proxy-Groups, Rule Order, and OPENAI_REALTIME Lanes

Mihomo stops at the first matching rule. That single fact explains a surprising share of OpenAI Realtime API grief: a careless GEOIP,CN,DIRECT line—or an overbroad domestic keyword match—wins before your Realtime lane sees api.openai.com, forcing the SDK down a path that never completes a WebSocket upgrade while your browser happily used a different stack. Create a named group—call it OPENAI_REALTIME or reuse OPENAI_API if you already maintain one— as a select or conservative url-test, list outbounds you trust for long HTTPS and WebSocket sessions, and hang OpenAI-shaped suffixes on it before catch-all geography shortcuts.

Illustrative excerpt; rename proxies to match your profile and extend suffixes strictly with log evidence when community bundles reorder silently:

proxy-groups:
  - name: OPENAI_REALTIME
    type: select
    proxies:
      - NODE-SJC
      - NODE-TYOKYO
      - DIRECT

rules:
  - DOMAIN,api.openai.com,OPENAI_REALTIME
  - DOMAIN-SUFFIX,openai.com,OPENAI_REALTIME
  - DOMAIN-SUFFIX,oaiusercontent.com,OPENAI_REALTIME
  - DOMAIN-SUFFIX,oaistatic.com,OPENAI_REALTIME
  - DOMAIN-SUFFIX,chatgpt.com,OPENAI_REALTIME
  # Optional enterprise lane discovered in traces:
  # - DOMAIN-SUFFIX,openai.azure.com,OPENAI_REALTIME
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

If you merge remote rule providers, diff the combined file after every refresh. Silent reordering turns a green Realtime session red without OpenAI changing a byte. Comment rare rows with the hostname that justified them; kernels update, subscriptions churn, and YAML amnesia arrives faster than you expect. Readers who also run ChatGPT in parallel should cross-check the ChatGPT and Claude split guide for overlapping suffixes, then return here to specialize WebSocket behavior.

WebSocket, TCP, and UDP: What Realtime Actually Uses

The core GPT-Realtime-2 session rides TCP TLS. Your client performs an HTTPS handshake, sends an Upgrade: websocket request, and receives HTTP 101 before binary audio frames flow inside the WebSocket framing layer. Mihomo and Mihomo-compatible cores proxy this cleanly when the upstream node supports CONNECT or compatible WebSocket forwarding—provided the session stays on the same outbound and is not interrupted by aggressive failover timers.

UDP enters the story only when your application stack adds side channels—WebRTC experiments, QUIC probes, or third-party voice bridges—not as the default OpenAI Realtime WebSocket transport. If connection logs show no UDP flows during a pure SDK sample, do not waste hours tuning udp flags copied from game or Discord guides. When UDP does appear and matters, borrow discipline from the Discord voice routing article and the all-nodes-red UDP and DNS checklist, but keep the Realtime WebSocket lane separate so entertainment rules do not steal API traffic.

Common WebSocket-specific failure modes through proxies include: middleboxes that buffer small frames and add latency to interactive audio; nodes that reset idle TCP channels even though the Realtime session is logically quiet between utterances; TLS intercept appliances on corporate LANs that break wss upgrades; and client libraries that disable WebSocket compression inconsistently, masquerading as proxy bugs. When in doubt, compare the same SDK sample on a known-good network against your Clash path with logs open—symmetry beats theory.

Node Region Selection for Streaming Audio

Latency tables optimized for speed-test HTML lie about Realtime suitability. A hop with 180 ms ICMP may still deliver stable full-duplex audio if jitter stays low and upload bandwidth survives continuous PCM or Opus frames. Conversely, a 60 ms node that drops sustained uploads or resets long TLS sessions will garble voice even when REST calls feel snappy.

Pragmatic heuristics for May 2026 deployments:

• Geography: US West (SJC, LAX) and Tokyo remain common defaults for OpenAI-shaped traffic from East Asia. Pick one region per session and avoid manual node hopping mid-call.
• Health checks: Widen url-test intervals or switch Realtime groups to manual select while debugging. Aggressive failover during an active WebSocket is a frequent self-inflicted disconnect.
• Throughput over ping: Favor nodes that survive large uploads in logs over nodes that win lightweight latency lotteries.
• Provider honesty: If every outbound on a subscription shows red simultaneously, fix DNS, UDP, or captive portal issues first—see the all-nodes-red guide—before blaming GPT-Realtime-2.

DNS Fake-IP, Secure DNS, and WebSocket Upgrades

DNS fake-ip excels when every consumer asks Mihomo first. It fails when a Realtime SDK resolves through OS DoH, hardcoded public resolvers, or a browser-only path while your WebSocket client uses another stack. OAuth or token exchange that opens in Chrome may complete while the SDK still points at a domestic or poisoned answer for api.openai.com, so your policy never triggers and the upgrade dies with generic network errors. Align three knobs together: the dns: section, whether TUN hijacks DNS, and whether Sniffer overrides are necessary for IP-first habits inside legacy libraries.

When you enable Sniffer for TLS Server Name Indication recovery, treat it as instrumentation rather than a permanent excuse to keep sloppy ordering. Official OpenAI endpoints overwhelmingly present usable SNI on api.openai.com, but enterprise middleware on managed laptops still happens. Log first; Sniffer second; reorder rules third. If QUIC expectations conflict with domestic monitoring on your LAN, reuse the same override philosophy you already applied to streaming stacks—the packet shapes differ, the discipline does not.

Log-Backed Verification for Realtime Sessions

Use the same micro-checklist after each profile tweak so spring 2026 upgrades do not erase tribal knowledge:

1. Reload Mihomo, open the live connection view, and filter on api.openai.com, openai, oaiuser, and any enterprise substring you already know.
2. Start the smallest failing Realtime action—a session.create event, a short utterance, or the official sample loop—and capture every new hostname before closing the panel.
3. Confirm the WebSocket upgrade shows as TCP TLS to api.openai.com on OPENAI_REALTIME (or your intended group) for the entire session, not only the first REST helper call.
4. From the shell that mirrors SDK environment variables, run curl -I https://api.openai.com plus one attachment URL copied from the log; align proxy variables with the process that launches your Realtime client.
5. Record working triplets: core Mihomo build, DNS mode, and exact proxy-group labels. Future bisects should diff that note instead of improvising during an on-call blur.

When dependency traffic overlaps—GitHub samples, npm CDNs, container registries—reuse lanes from the GitHub routing guide rather than duplicating spaghetti. Realtime apps still download the world even when the hot path is a single WebSocket.

What Stable Routing Cannot Fix

Polite routing will not override expired organization policies, revoked API keys, missing billing alignment, model availability gates in your tenant tier, or account regions where Realtime models are not enabled. It cannot manufacture throughput on an exhausted subscription node. What it does fix is the maddening class of failures where REST samples work, support insists “nothing changed,” and your WebSocket still dies because capture and resolver mismatch stayed invisible until you read the connection table with intent.

Operational stability for voice agents means predictable TCP behavior on long sessions, not merely winning latency lotteries on speed-test pages. A slightly slower node that completes TLS and survives full-duplex audio beats an ultra-low ping hop that flakes mid-utterance—especially when GPT-Realtime-2 streams bundle multiple JSON events per spoken phrase and retries amplify backoff noise.

FAQ

ChatGPT voice works; my Realtime SDK WebSocket still fails. Where do I look?

Compare resolver and proxy paths. Browsers often follow OS or extension DNS while SDKs use another stack. Inspect Mihomo logs for api.openai.com during the WebSocket attempt; if nothing appears, you still have a capture problem before you have an OpenAI problem.

Does Realtime API require UDP forwarding in Clash?

Not for the primary wss://api.openai.com session, which is TCP-based. Add UDP rules only when logs show distinct UDP flows your app actually uses—do not copy game or voice-chat templates blindly.

Can I rely on openai.com suffix rules alone?

Often yes for a first pass, but Realtime is sensitive to ordering and DNS alignment. Pin api.openai.com as an exact DOMAIN row at the top, extend suffixes from failing traces, and keep the block above GEOIP shortcuts.

Is global TUN mandatory for GPT-Realtime-2?

No. TUN is a scalpel when binaries ignore environment variables, not a default posture. Start with explicit Realtime rules and selective capture; escalate only after LAN and domestic exceptions look sane.

Closing Thoughts

GPT-Realtime-2 rewards teams who treat the OpenAI Realtime API like the long-lived WebSocket workload it is—not like a single REST curl hidden inside a voice demo screenshot. Clash and Mihomo already solve that shape when you invest in honest first-match semantics, deliberate TUN versus system-proxy choices, resolver alignment, and hostname lists backed by live telemetry. The difference from generic OpenAI essays is vocabulary: api.openai.com WebSocket upgrades, streaming audio frames, session stickiness, and TCP-stable nodes deserve explicit rows, not leftovers from an entertainment-focused subscription bundle.

Many one-click utilities only flip a global switch. They either tunnel everything—breaking domestic workflows that still matter—or ship domain lists that aged out before Realtime models shipped. Neither approach survives a week of real SDK duty where a five-minute voice agent must stay connected across dozens of JSON events. A policy you can diff, comment, and bisect wins because it mirrors how your connection table actually behaved during the last outage.

Compared with those black-box clients, polished dashboards that hide routing detail tend to stall the moment OpenAI adds a new Realtime edge or shifts session tokens to a fresher path—leaving you with green status lights and red WebSocket close codes. Clash Official Site keeps the engineering posture first: practical Clash split rules for Realtime WebSocket traffic, lanes that respect how modern SDKs open sockets, and binaries that expose the telemetry you need to extend rules without guesswork. If you want a maintained Clash Verge-class experience without stitching releases by hand, download Clash Official Site for free and layer the OPENAI_REALTIME block from this guide onto your existing profile.