amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-15 13:52:15 +00:00

[GH-ISSUE #1623] [FEATURE] Split tunneling #684

New issue

Open

opened 2026-10-13 20:26:29 +00:00 by bsakaguchi · 6 comments

bsakaguchi commented

2026-10-13 20:26:29 +00:00

Owner

Originally created by @igolikov on GitHub (May 26, 2025).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1623

Dear Amnezia team, is it possible to add feature that allows to exclude some networks from tunneling?
Like everything except 192.168.50.0/24 will be tunneling via Amnezia. Right now when I start Amnezia VPN everything is routed via Amnezia, even other VPN connections

Originally created by @igolikov on GitHub (May 26, 2025). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1623 Dear Amnezia team, is it possible to add feature that allows to exclude some networks from tunneling? Like everything except 192.168.50.0/24 will be tunneling via Amnezia. Right now when I start Amnezia VPN everything is routed via Amnezia, even other VPN connections

bsakaguchi commented

2026-10-13 20:26:30 +00:00

Author

Owner

@back-lacking commented on GitHub (Jun 2, 2025):

this is offered within the client.

@back-lacking commented on GitHub (Jun 2, 2025): this is offered within the client. ![Image](https://github.com/user-attachments/assets/253bbdcd-381d-4adc-b481-f5c370cb06a9)

bsakaguchi commented

2026-10-13 20:26:30 +00:00

Author

Owner

@igolikov commented on GitHub (Jun 2, 2025):

this is offered within the client.

No, that is opposite:

Site-based tunneling routes traffic for specific domains(actually IPs) through Amnezia. Since websites often use multiple domains (e.g., chatgpt.com, openai.com), you must configure each domain individually.
This method performs poorly with sites protected by services like Cloudflare. Amnezia remembers the current IP address , but the IP can change unexpectedly within minutes

what I need is just opposite - route everything via VPN except some subnets

@igolikov commented on GitHub (Jun 2, 2025): > this is offered within the client. No, that is opposite: 1. Site-based tunneling routes traffic for specific domains(actually IPs) through Amnezia. Since websites often use multiple domains (e.g., chatgpt.com, openai.com), you must configure each domain individually. 2. This method performs poorly with sites protected by services like Cloudflare. Amnezia remembers the current IP address , but the IP can change unexpectedly within minutes what I need is just opposite - route everything via VPN except some subnets ![Image](https://github.com/user-attachments/assets/0e30695d-6108-4312-b880-1334da221d78)

bsakaguchi commented

2026-10-13 20:26:30 +00:00

Author

Owner

@Noxius87 commented on GitHub (Jun 2, 2025):

From what is currently implemented in AmneziaVPN - this mod looks like the most logical solution for your request. All traffic, except for the excluded sites, will go through VPN

@Noxius87 commented on GitHub (Jun 2, 2025): From what is currently implemented in AmneziaVPN - this mod looks like the most logical solution for your request. All traffic, except for the excluded sites, will go through VPN ![Image](https://github.com/user-attachments/assets/e90c12ed-7496-4bd0-ab68-4296f86642b0)

bsakaguchi commented

2026-10-13 20:26:31 +00:00

Author

Owner

@igolikov commented on GitHub (Jun 3, 2025):

this is offered within the client.

thanks for pointing me, have not noticed that yet

I have added 10.62.0.0/23 to that list (that seems to be excessive - that is private network and Amnezia should not affect such networks) - and it doesn't work, i noticed that Amnezia adds some routes when I run it

before

10.62.0.0/23 via 192.168.184.1 dev tun0 proto static metric 10

after starting Amnezia

0.0.0.0/1 dev amn0 metric 1
128.0.0.0/1 dev amn0 metric 1
...
10.62.0.0/23 via 192.168.88.1 dev enp6s0 
10.62.0.0/23 via 192.168.184.1 dev tun0 proto static metric 10

so Amnezia routes 10.62.0.0/23 via my physical nic with higher priority

@igolikov commented on GitHub (Jun 3, 2025): > this is offered within the client. thanks for pointing me, have not noticed that yet I have added 10.62.0.0/23 to that list (that seems to be excessive - that is private network and Amnezia should not affect such networks) - and it doesn't work, i noticed that Amnezia adds some routes when I run it before ``` 10.62.0.0/23 via 192.168.184.1 dev tun0 proto static metric 10 ``` after starting Amnezia ``` 0.0.0.0/1 dev amn0 metric 1 128.0.0.0/1 dev amn0 metric 1 ... 10.62.0.0/23 via 192.168.88.1 dev enp6s0 10.62.0.0/23 via 192.168.184.1 dev tun0 proto static metric 10 ``` so Amnezia routes 10.62.0.0/23 via my physical nic with higher priority

bsakaguchi commented

2026-10-13 20:26:31 +00:00

Author

Owner

@burner1024 commented on GitHub (Jun 11, 2025):

It seems to work for me (100.64. range - tailscale).
However, if killswitch is enabled while using split tunneling with subnet exception, systemd-resolved spikes to 100% CPU and stays there. With killswitch disabled, CPU usage is normal.

@burner1024 commented on GitHub (Jun 11, 2025): It seems to work for me (100.64. range - tailscale). However, if killswitch is enabled while using split tunneling with subnet exception, systemd-resolved spikes to 100% CPU and stays there. With killswitch disabled, CPU usage is normal.

bsakaguchi commented

2026-10-13 20:26:31 +00:00

Author

Owner

@orange-banal-pole commented on GitHub (Oct 9, 2025):

On Linux, split tunneling doesn't support subnets. While the program accepts them, it never adds them to the routing table. Instead, it adds a single IP address.

To reproduce:

Add 1.1.1.0/24 in the GUI interface. Connect to the VPN. Look at the routing table. It has a single IP address 1.1.1.0 instead of the subnet.

@orange-banal-pole commented on GitHub (Oct 9, 2025): On Linux, split tunneling doesn't support subnets. While the program accepts them, it never adds them to the routing table. Instead, it adds a single IP address. To reproduce: Add `1.1.1.0/24` in the GUI interface. Connect to the VPN. Look at the routing table. It has a single IP address `1.1.1.0` instead of the subnet.

bsakaguchi referenced this issue

2026-10-13 21:17:47 +00:00

[PR #684] [MERGED] Remove shadowsocks libs from Android build #2025