[PR #3224] Fix on-link LAN exclusions in macOS site split tunneling #3134

New issue

Open

opened 2026-10-14 21:07:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-14 21:07:44 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amnezia-client/pull/3224
Author: @renosaza
Created: 9/27/2026
Status: 🔄 Open

Base: dev ← Head: macos-lan-split-route

📝 Commits (1)

66c3df7 Fix on-link LAN exclusions for macOS split tunneling

📊 Changes

2 files changed (+74 additions, -46 deletions)

View changed files

📝 service/server/router_mac.cpp (+71 -46)
📝 service/server/router_mac.h (+3 -0)

📄 Description

Fixes #3223.

On macOS, site split tunneling previously added a directly connected LAN subnet via the physical router. XRay's split default routes can then send LAN packets to that router instead of resolving the destination on-link.

For an excluded IPv4 network contained in the physical interface's connected subnet, install direct routes in both the global and interface scopes. Keep the gateway route for other exclusions. Record which direct routes were actually added so disconnect removes only routes owned by AmneziaVPN.

Checks:

git diff --check passed.
Verified the macOS /sbin/route add/delete syntax for direct global and interface-scoped network routes on the affected machine.
Reproduced the original failure and verified that paired direct /24 routes restore access to a LAN host before this code change.

The patched application was not built locally because CMake and Qt development headers are unavailable on this Mac. A packaged-app regression check after CI build is still needed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amnezia-client/pull/3224 **Author:** [@renosaza](https://github.com/renosaza) **Created:** 9/27/2026 **Status:** 🔄 Open **Base:** `dev` ← **Head:** `macos-lan-split-route` --- ### 📝 Commits (1) - [`66c3df7`](https://github.com/amnezia-vpn/amnezia-client/commit/66c3df72efb60a47dfa0887cb7b44200d866aea7) Fix on-link LAN exclusions for macOS split tunneling ### 📊 Changes **2 files changed** (+74 additions, -46 deletions) <details> <summary>View changed files</summary> 📝 `service/server/router_mac.cpp` (+71 -46) 📝 `service/server/router_mac.h` (+3 -0) </details> ### 📄 Description Fixes #3223. On macOS, site split tunneling previously added a directly connected LAN subnet via the physical router. XRay's split default routes can then send LAN packets to that router instead of resolving the destination on-link. For an excluded IPv4 network contained in the physical interface's connected subnet, install direct routes in both the global and interface scopes. Keep the gateway route for other exclusions. Record which direct routes were actually added so disconnect removes only routes owned by AmneziaVPN. Checks: - `git diff --check` passed. - Verified the macOS `/sbin/route` add/delete syntax for direct global and interface-scoped network routes on the affected machine. - Reproduced the original failure and verified that paired direct `/24` routes restore access to a LAN host before this code change. The patched application was not built locally because CMake and Qt development headers are unavailable on this Mac. A packaged-app regression check after CI build is still needed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-14 21:07:44 +00:00

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#3134

No description provided.

Rows
Columns