[GH-ISSUE #1566] Kill Switch blocks local network access with static routes (Regression since v4.8.2.3) #655

New issue

Open

opened 2026-10-13 20:25:59 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-13 20:25:59 +00:00

Owner

Originally created by @Ceasy on GitHub (May 6, 2025).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1566

Describe the bug
In AmneziaVPN client version 4.8.5.0 and later, the Kill Switch feature blocks access to local network hosts (e.g., via RDP or ping), even when persistent static routes with a low metric (metric 1) are configured for these hosts via the local gateway. This prevents simultaneous use of Kill Switch protection and access to local resources like RDP servers. This behavior is a regression, as the same setup worked correctly in version 4.8.2.3.

To Reproduce
Steps to reproduce the behavior:

Install AmneziaVPN client version 4.8.5.0 (or later) on Windows 11 x64.
Configure a VPN connection.
Enable "Split tunneling applications" mode in the connection settings. Ensure the RDP client (mstsc.exe) is NOT selected for tunneling.
Enable the Kill Switch option for the connection.
Add a persistent static route for a local network host (e.g., 192.168.0.93) via the command prompt (as Administrator):
```
route add 192.168.0.93 mask 255.255.255.255 192.168.0.1 metric 1 -p
```
Connect the AmneziaVPN.
Try to connect to the local host (192.168.0.93) via RDP or ping it (ping 192.168.0.93).
See error: The connection fails (RDP times out, ping hangs or times out).

Expected behavior
With the Kill Switch enabled and a specific static route configured for a local host (with metric 1), the connection to that local host (via RDP, ping, etc.) should be successful, bypassing the VPN tunnel as intended by the static route and split tunneling configuration. This was the behavior in version 4.8.2.3.

Log files

Screenshots

Desktop (please complete the following information):

OS: Windows 11 Pro x64 (Or your specific Win 11 edition)
Version 4.8.5.0 (Problem version)

Smartphone (please complete the following information):

Device: N/A
OS: N/A
Version N/A

Server (please complete the following information):

OS: Ubuntu 22.04

Additional context
This issue prevents using the Kill Switch feature while needing access to local network resources like RDP servers or network shares. The key finding is that this configuration worked perfectly in version 4.8.2.3 x64 but stopped working in version 4.8.5.0 (and likely subsequent versions). Downgrading back to 4.8.2.3 resolves the issue, confirming it's a regression related to changes in the Kill Switch implementation or its interaction with system routing/firewalling after version 4.8.2.3.

Originally created by @Ceasy on GitHub (May 6, 2025). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1566 **Describe the bug** In AmneziaVPN client version 4.8.5.0 and later, the Kill Switch feature blocks access to local network hosts (e.g., via RDP or ping), even when persistent static routes with a low metric (`metric 1`) are configured for these hosts via the local gateway. This prevents simultaneous use of Kill Switch protection and access to local resources like RDP servers. This behavior is a regression, as the same setup worked correctly in version 4.8.2.3. **To Reproduce** Steps to reproduce the behavior: 1. Install AmneziaVPN client version **4.8.5.0** (or later) on Windows 11 x64. 2. Configure a VPN connection. 3. Enable **"Split tunneling applications"** mode in the connection settings. Ensure the RDP client (`mstsc.exe`) is **NOT** selected for tunneling. 4. Enable the **Kill Switch** option for the connection. 5. Add a persistent static route for a local network host (e.g., `192.168.0.93`) via the command prompt (as Administrator): ```cmd route add 192.168.0.93 mask 255.255.255.255 192.168.0.1 metric 1 -p ``` 6. Connect the AmneziaVPN. 7. Try to connect to the local host (`192.168.0.93`) via RDP or ping it (`ping 192.168.0.93`). 8. See error: The connection fails (RDP times out, ping hangs or times out). **Expected behavior** With the Kill Switch enabled and a specific static route configured for a local host (with `metric 1`), the connection to that local host (via RDP, ping, etc.) should be successful, bypassing the VPN tunnel as intended by the static route and split tunneling configuration. This was the behavior in version **4.8.2.3**. **Log files** - **Screenshots** - **Desktop (please complete the following information):** - OS: **Windows 11 Pro x64** (Or your specific Win 11 edition) - Version **4.8.5.0** (Problem version) **Smartphone (please complete the following information):** - Device: N/A - OS: N/A - Version N/A **Server (please complete the following information):** - OS: Ubuntu 22.04 **Additional context** This issue prevents using the Kill Switch feature while needing access to local network resources like RDP servers or network shares. The key finding is that this configuration **worked perfectly in version 4.8.2.3 x64** but stopped working in version 4.8.5.0 (and likely subsequent versions). Downgrading back to 4.8.2.3 resolves the issue, confirming it's a regression related to changes in the Kill Switch implementation or its interaction with system routing/firewalling after version 4.8.2.3.

bsakaguchi commented

2026-10-13 20:26:00 +00:00

Author

Owner

@S0me1-dev commented on GitHub (Feb 27, 2026):

same issue here. kill switch block all local lan connections even if are they in split and whitelist.
if turn it off all work like before.
Fix plz

@S0me1-dev commented on GitHub (Feb 27, 2026): same issue here. kill switch block all local lan connections even if are they in split and whitelist. if turn it off all work like before. Fix plz

bsakaguchi referenced this issue

2026-10-13 21:17:33 +00:00

[PR #655] [CLOSED] fixed allowed_ips parsing for api configs #2004