amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-15 05:42:07 +00:00

[GH-ISSUE #2904] [Windows] Split tunneling creates /32 routes instead of configured network prefixes in v5.0.0.5 #1319

New issue

Open

opened 2026-10-13 20:40:08 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-13 20:40:08 +00:00

Owner

Originally created by @zomoleg on GitHub (Jul 30, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2904

Description

After upgrading from AmneziaVPN 4.8.21 to 5.0.0.5 on Windows, split tunneling by destination networks no longer works.

The same configuration works correctly in 4.8.21, but in 5.0.0.5 all traffic is routed through the VPN.

Steps to reproduce

Install AmneziaVPN 5.0.0.5 on Windows.
Configure split tunneling with several excluded IPv4 networks (for example 5.35.0.0/19, 31.130.140.0/22, 37.9.64.0/18).
Connect to the VPN.
Run:
CMD:

route print

or
PowerShell:

Get-NetRoute

Expected behavior

Routes should be created with their configured prefix lengths.

Examples:

5.35.0.0/19
31.130.140.0/22
37.9.64.0/18

Traffic to these networks should bypass the VPN.

Actual behavior

Every configured network is installed as a /32 host route instead of the configured prefix.

Examples:

5.35.0.0/19 -> 5.35.0.0/32
31.130.140.0/22 -> 31.130.140.0/32
37.9.64.0/18 -> 37.9.64.0/32

As a result, only the network address itself is excluded while all other addresses inside the subnet continue to use the VPN.

Comparison

Working (4.8.21):

5.35.0.0/19
31.130.140.0/22
37.9.64.0/18
77.88.0.0/18

Broken (5.0.0.5):

5.35.0.0/32
31.130.140.0/32
37.9.64.0/32
77.88.0.0/32

This looks like the prefix length is being lost when Windows routes are created.

Additional information

Windows version: Windows 11 26H1 28000.2525
VPN protocol: AmneziaWG (AWG 2.0)
The same configuration works correctly with AmneziaVPN 4.8.21.
I attached the outputs of route print and Get-NetRoute for both versions for comparison.

Get-NetRoute (4.8.21).txt
Get-NetRoute (5.0.0.5).txt
route print (4.8.21).txt
route print (5.0.0.5).txt

Originally created by @zomoleg on GitHub (Jul 30, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2904 ### Description After upgrading from **AmneziaVPN 4.8.21** to **5.0.0.5** on Windows, split tunneling by destination networks no longer works. The same configuration works correctly in **4.8.21**, but in **5.0.0.5** all traffic is routed through the VPN. ### Steps to reproduce 1. Install AmneziaVPN 5.0.0.5 on Windows. 2. Configure split tunneling with several excluded IPv4 networks (for example `5.35.0.0/19`, `31.130.140.0/22`, `37.9.64.0/18`). 3. Connect to the VPN. 4. Run: CMD: ``` route print ``` or PowerShell: ```powershell Get-NetRoute ``` ### Expected behavior Routes should be created with their configured prefix lengths. Examples: ``` 5.35.0.0/19 31.130.140.0/22 37.9.64.0/18 ``` Traffic to these networks should bypass the VPN. ### Actual behavior Every configured network is installed as a **/32 host route** instead of the configured prefix. Examples: ``` 5.35.0.0/19 -> 5.35.0.0/32 31.130.140.0/22 -> 31.130.140.0/32 37.9.64.0/18 -> 37.9.64.0/32 ``` As a result, only the network address itself is excluded while all other addresses inside the subnet continue to use the VPN. ### Comparison Working (4.8.21): ``` 5.35.0.0/19 31.130.140.0/22 37.9.64.0/18 77.88.0.0/18 ``` Broken (5.0.0.5): ``` 5.35.0.0/32 31.130.140.0/32 37.9.64.0/32 77.88.0.0/32 ``` This looks like the prefix length is being lost when Windows routes are created. ### Additional information * Windows version: Windows 11 26H1 28000.2525 * VPN protocol: AmneziaWG (AWG 2.0) * The same configuration works correctly with AmneziaVPN 4.8.21. * I attached the outputs of `route print` and `Get-NetRoute` for both versions for comparison. [Get-NetRoute (4.8.21).txt](https://github.com/user-attachments/files/30539608/Get-NetRoute.4.8.21.txt) [Get-NetRoute (5.0.0.5).txt](https://github.com/user-attachments/files/30539607/Get-NetRoute.5.0.0.5.txt) [route print (4.8.21).txt](https://github.com/user-attachments/files/30539610/route.print.4.8.21.txt) [route print (5.0.0.5).txt](https://github.com/user-attachments/files/30539609/route.print.5.0.0.5.txt)

bsakaguchi commented

2026-10-13 20:40:09 +00:00

Author

Owner

@Aeon1704 commented on GitHub (Jul 30, 2026):

Facing same problem. But i think app itself doesn't work properly with include\excluded lists. And simply ignores any /prefix range.
Try to add 10.11.0.0/16 as dummy example to list. Only 10.11.0.0 will be added. And i think all previously added IPs with prefix simply considered to be without any prefix.

@Aeon1704 commented on GitHub (Jul 30, 2026): Facing same problem. But i think app itself doesn't work properly with include\excluded lists. And simply ignores any /prefix range. Try to add 10.11.0.0/16 as dummy example to list. Only 10.11.0.0 will be added. And i think all previously added IPs with prefix simply considered to be without any prefix.

bsakaguchi commented

2026-10-13 20:40:10 +00:00

Author

Owner

@zomoleg commented on GitHub (Jul 30, 2026):

Up to and including version 4.8.21.0, routes in Windows were added correctly, with the prefix (5.35.0.0/19 was added as 5.35.0.0/19).
However, in version 5.0.0.5, the prefix is simply ignored (5.35.0.0/19 is added as 5.35.0.0/32).

@zomoleg commented on GitHub (Jul 30, 2026): Up to and including version 4.8.21.0, routes in Windows were added correctly, with the prefix (5.35.0.0/19 was added as 5.35.0.0/19). However, in version 5.0.0.5, the prefix is simply ignored (5.35.0.0/19 is added as 5.35.0.0/32).

bsakaguchi commented

2026-10-13 20:40:10 +00:00

Author

Owner

@Vitalik93 commented on GitHub (Jul 30, 2026):

On Rutracker, their representative wrote that they are aware of this and there will be a fix.

@Vitalik93 commented on GitHub (Jul 30, 2026): On Rutracker, their representative wrote that they are aware of this and there will be a fix.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#1319

No description provided.

Rows
Columns