[GH-ISSUE #3270] Daemon deadlock when passing a long list of split tunneling IP rules to kernel #1518

New issue

Open

opened 2026-10-13 20:44:08 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-13 20:44:08 +00:00

Owner

Originally created by @PhoenixWhitebrow on GitHub (Oct 10, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/3270

Describe the bug
The issue manifests when trying to pass a long list of bypass IPs/ranges to AmneziaAPN.service.
It seems that the daemon's context buffer, which is only 1024 bits, being overflown trying to handle hundreds of replies from the kernel at the same millisecond when passing all the ip route rules at the same time.

Also, if the list of ranges contain the overlapping ranges, the daemon goes to deadlock after receiving the error from kernel. It's technically another issue, but it might be fixed alongside the main bug.

Looks like deadlock happens in both cases due to this part of code in the client/platforms/linux/daemon/linuxroutemonitor.cpp:

    if (rtm->rtm_type == RTN_THROW) {
    QString gateway = NetworkUtilities::getGatewayAndIface().first;
    if (gateway.isEmpty()) {
        logger.warning() << "No default gateway available, skipping exclusion route";
        return false; // <-- THIS!
    }

To Reproduce
Steps to reproduce the behavior:

Go to AmneziaVPN GUI
Click on 'Split tunneling disabled'
Click on 'Site-based split tunneling'
Click on '⋮'
Click on 'Import'
Click on 'Replace site list'
Select JSON file containing rules for at least 108 addresses
Enable the 'Split tunneling' killswitch
Click on '🏠'
Click on 'Connect'
In Terminal execute command: sudo journalctl -u AmneziaVPN.service -n 350 --no-pager

Expected behavior

In the logs after each line with
'[DEBUG] AmneziaVPN LinuxRouteMonitor : Adding exclusion route for {ip_range}'
there is a line with
'Gateway {ip} for interface {interface}';
All the split tunneling rules are applied and work properly;
After flushing split-tunneling rules in GUI and adding a single domain to the rules, and then disconnecting and reconnecting to the tunnel all the split tunneling, the new split-tunneling rule is applied and work properly;

Actual behavior

In the logs after about 107 successfully applied rules, errors start to appear:
'[DEBUG] AmneziaVPN LinuxRouteMonitor : Adding exclusion route for {ip_range}'
Error in received packet: Numerical argument out of domain
[WARNING] AmneziaVPN LinuxRouteMonitor : No default gateway available, skipping exclusion route;
Split tunneling doesn't work;
After flushing split-tunneling rules in GUI and adding a single domain to the rules, and then disconnecting and reconnecting to the tunnel all the split tunneling, the new split-tunneling rule doesn't work;
Note: To make split tunneling work again you need to kill the AmneziaVPN (GUI) process, stop the AmneziaVPN.service, restart NetworkManager, start AmneziaVPN.service and start the GUI again.

Log files
daemon.log

Desktop (please complete the following information):

OS: Arch Linux, KDE Plasma 6.7.5, NetworkManager, systemctl-resolved, nft
Version 5.0.3.0

Server (please complete the following information):

AmneziaVPN Premium servers (AmneziaWG protocol)

Additional context
This is critical when trying to apply complex split tunneling rules including a long list of ranges, for example, containing a full or partial list of country-specific IPs.

Originally created by @PhoenixWhitebrow on GitHub (Oct 10, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/3270 **Describe the bug** The issue manifests when trying to pass a long list of bypass IPs/ranges to AmneziaAPN.service. It seems that the daemon's context buffer, which is only 1024 bits, being overflown trying to handle hundreds of replies from the kernel at the same millisecond when passing all the ip route rules at the same time. Also, if the list of ranges contain the overlapping ranges, the daemon goes to deadlock after receiving the error from kernel. It's technically another issue, but it might be fixed alongside the main bug. Looks like deadlock happens in both cases due to this part of code in the [client/platforms/linux/daemon/linuxroutemonitor.cpp](https://github.com/amnezia-vpn/amnezia-client/blob/dev/client/platforms/linux/daemon/linuxroutemonitor.cpp#L170): ``` if (rtm->rtm_type == RTN_THROW) { QString gateway = NetworkUtilities::getGatewayAndIface().first; if (gateway.isEmpty()) { logger.warning() << "No default gateway available, skipping exclusion route"; return false; // <-- THIS! } ``` **To Reproduce** Steps to reproduce the behavior: 1. Go to AmneziaVPN GUI 2. Click on 'Split tunneling disabled' 3. Click on 'Site-based split tunneling' 4. Click on '⋮' 5. Click on 'Import' 6. Click on 'Replace site list' 7. Select JSON file containing rules for at least 108 addresses 8. Enable the 'Split tunneling' killswitch 9. Click on '🏠' 10. Click on 'Connect' 11. In Terminal execute command: `sudo journalctl -u AmneziaVPN.service -n 350 --no-pager` **Expected behavior** 1. In the logs after each line with '[DEBUG] AmneziaVPN LinuxRouteMonitor : Adding exclusion route for {ip_range}' there is a line with 'Gateway {ip} for interface {interface}'; 2. All the split tunneling rules are applied and work properly; 3. After flushing split-tunneling rules in GUI and adding a single domain to the rules, and then disconnecting and reconnecting to the tunnel all the split tunneling, the new split-tunneling rule is applied and work properly; **Actual behavior** 1. In the logs after about 107 successfully applied rules, errors start to appear: '[DEBUG] AmneziaVPN LinuxRouteMonitor : Adding exclusion route for {ip_range}' `Error in received packet: Numerical argument out of domain` `[WARNING] AmneziaVPN LinuxRouteMonitor : No default gateway available, skipping exclusion route`; 2. Split tunneling doesn't work; 3. After flushing split-tunneling rules in GUI and adding a single domain to the rules, and then disconnecting and reconnecting to the tunnel all the split tunneling, the new split-tunneling rule doesn't work; _Note:_ To make split tunneling work again you need to kill the AmneziaVPN (GUI) process, stop the AmneziaVPN.service, restart NetworkManager, start AmneziaVPN.service and start the GUI again. **Log files** [daemon.log](https://github.com/user-attachments/files/33282791/daemon.log) **Desktop (please complete the following information):** - OS: Arch Linux, KDE Plasma 6.7.5, NetworkManager, systemctl-resolved, nft - Version 5.0.3.0 **Server (please complete the following information):** - AmneziaVPN Premium servers (AmneziaWG protocol) **Additional context** This is critical when trying to apply complex split tunneling rules including a long list of ranges, for example, containing a full or partial list of country-specific IPs.

bsakaguchi commented

2026-10-13 20:44:09 +00:00

Author

Owner

@PhoenixWhitebrow commented on GitHub (Oct 10, 2026):

I've managed to vibe-code a possible fix – implemented async kernel calls, batching only 50 calls at a time, with no other major logic affected. Tested it on a heavy (bulk JSON with 8658 IP ranges + pinpont JSON with only 12 hostnames) rule list, and it works like a charm! Tunnel starts isntantly, closes instantly too, and after tunnel restart everything still works.
Cannot push my branch to remote repo, though… I get 403 error :(

@PhoenixWhitebrow commented on GitHub (Oct 10, 2026): I've managed to vibe-code a possible fix – implemented async kernel calls, batching only 50 calls at a time, with no other major logic affected. Tested it on a heavy (bulk JSON with 8658 IP ranges + pinpont JSON with only 12 hostnames) rule list, and it works like a charm! Tunnel starts isntantly, closes instantly too, and after tunnel restart everything still works. Cannot push my branch to remote repo, though… I get 403 error :(

bsakaguchi referenced this issue

2026-10-14 21:01:47 +00:00

[PR #1518] [MERGED] feature: additional logs for proxy bypass #2398

bsakaguchi referenced this issue

2026-10-14 21:03:05 +00:00

[PR #1839] [MERGED] update new code from dev #2561