[PR #3159] fix(windows): preserve LAN access with kill switch #3110

New issue

Open

opened 2026-10-14 21:07:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-14 21:07:33 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amnezia-client/pull/3159
Author: @HeisLuka
Created: 9/12/2026
Status: 🔄 Open

Base: dev ← Head: fix/issue-1566-lan-killswitch

📝 Commits (1)

1b6a552 fix(windows): preserve LAN access with kill switch

📊 Changes

1 file changed (+120 additions, -1 deletions)

View changed files

📝 client/platforms/windows/daemon/windowsfirewall.cpp (+120 -1)

📄 Description

Preserve access to directly connected LAN networks when the regular Windows Kill Switch is enabled.

Related to #1566.

Problem

On Windows, the Kill Switch can block traffic to local network hosts even when Windows has a valid local/static route for them.

For example:

192.168.0.93/32 via 192.168.0.1

The route itself may correctly point to the physical interface, but Windows Filtering Platform rules still block the connection.

This is visible in #1566, where LAN access worked in 4.8.2.3 but stopped working in later versions when Kill Switch was enabled.

Changes

When enabling the regular Windows Kill Switch:

inspect currently active network interfaces;
ignore the VPN adapter and loopback;
derive the actually connected local network prefixes;
only consider local-use ranges:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
169.254.0.0/16
IPv6 ULA
IPv6 link-local
allow traffic to those connected prefixes through the existing enableLanBypass() WFP rules.

This avoids blindly bypassing all RFC1918 networks. A private network is only permitted when it is actually configured on an active local interface.

Kill Switch semantics

The existing WFP filter priorities are preserved:

peer/full-tunnel block: low priority;
connected LAN permit: slightly higher priority;
strict Kill Switch block: higher priority.

Therefore LAN remains accessible with the regular Kill Switch, while Strict Kill Switch behavior is unchanged.

Scope

This PR only addresses the Windows firewall/WFP part of LAN access.

It does not change Windows route capture behavior. The related routing issue is handled separately in #3155.

Because #1566 can involve both routing and firewall behavior depending on the protocol/configuration, this PR uses Related to #1566 rather than closing the issue by itself.

---

<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amnezia-client/pull/3159 **Author:** [@HeisLuka](https://github.com/HeisLuka) **Created:** 9/12/2026 **Status:** 🔄 Open **Base:** `dev` ← **Head:** `fix/issue-1566-lan-killswitch` --- ### 📝 Commits (1) - [`1b6a552`](https://github.com/amnezia-vpn/amnezia-client/commit/1b6a5525f9e7c74021aa3117e22c0b0d7deea8cc) fix(windows): preserve LAN access with kill switch ### 📊 Changes **1 file changed** (+120 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `client/platforms/windows/daemon/windowsfirewall.cpp` (+120 -1) </details> ### 📄 Description Preserve access to directly connected LAN networks when the regular Windows Kill Switch is enabled. Related to #1566. ## Problem On Windows, the Kill Switch can block traffic to local network hosts even when Windows has a valid local/static route for them. For example: ```text 192.168.0.93/32 via 192.168.0.1 The route itself may correctly point to the physical interface, but Windows Filtering Platform rules still block the connection. This is visible in #1566, where LAN access worked in 4.8.2.3 but stopped working in later versions when Kill Switch was enabled. Changes When enabling the regular Windows Kill Switch: inspect currently active network interfaces; ignore the VPN adapter and loopback; derive the actually connected local network prefixes; only consider local-use ranges: 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 IPv6 ULA IPv6 link-local allow traffic to those connected prefixes through the existing enableLanBypass() WFP rules. This avoids blindly bypassing all RFC1918 networks. A private network is only permitted when it is actually configured on an active local interface. Kill Switch semantics The existing WFP filter priorities are preserved: peer/full-tunnel block: low priority; connected LAN permit: slightly higher priority; strict Kill Switch block: higher priority. Therefore LAN remains accessible with the regular Kill Switch, while Strict Kill Switch behavior is unchanged. Scope This PR only addresses the Windows firewall/WFP part of LAN access. It does not change Windows route capture behavior. The related routing issue is handled separately in #3155. Because #1566 can involve both routing and firewall behavior depending on the protocol/configuration, this PR uses Related to #1566 rather than closing the issue by itself. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-14 21:07:33 +00:00

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#3110

No description provided.

Rows
Columns