Split Tunnel

Split tunnel routes traffic from selected apps or subnets outside (or exclusively inside) the VPN tunnel. As with all network policy, the daemon enforces the rules — the library only configures them. The current configuration is always readable from KapeVpnManager:

vpn.SplitTunnelEnabled   // bool
vpn.SplitTunnelRules     // IReadOnlyList<KapeSplitTunnelRule>
vpn.BypassSubnets        // IReadOnlyList<string>
vpn.SplitTunnelDns       // bool

Enabling

await vpn.SetSplitTunnelEnabledAsync(true);

When disabled, all traffic uses the tunnel and any configured rules are kept but ignored.

App Rules

Each rule pairs an application path with a mode. SetSplitTunnelRulesAsync replaces the whole list:

await vpn.SetSplitTunnelRulesAsync(new[]
{
    new KapeSplitTunnelRule("/usr/bin/curl", KapeSplitTunnelMode.Bypass),
    new KapeSplitTunnelRule(@"C:\Program Files\App\app.exe", KapeSplitTunnelMode.OnlyVpn),
});

KapeSplitTunnelMode	Behaviour
Bypass	The app's traffic goes over the regular internet, never the VPN
OnlyVpn	The app's traffic is only allowed while the VPN is connected

The path identifies the application per platform:

Platform	Path
Windows	Executable path (.exe) or Start menu shortcut
macOS	App bundle path (.app)
Linux	Executable path

The daemon resolves links and helper executables when it applies the rules, so a rule covers the app's child processes as well.

Subnet Rules

Subnets (IPv4 or IPv6, CIDR notation) can bypass the VPN regardless of which app generates the traffic. SetBypassSubnetsAsync replaces the whole list:

await vpn.SetBypassSubnetsAsync(new[] { "192.168.1.0/24" });

DNS for Bypassed Apps

By default, apps that bypass the VPN still resolve names through the VPN's DNS. Turn this on to have them use the system DNS instead:

await vpn.SetSplitTunnelDnsAsync(true);