[GH-ISSUE #2208] WFP/Split Tunneling breaks when IP Forwarding and Hyper-V Internal Switch are enabled #984

New issue

Open

opened 2026-10-13 20:32:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 20:32:20 +00:00

Owner

Originally created by @sfalkorr on GitHub (Feb 11, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2208

Severity: Medium–High
Impact: Breaks app‑based split tunneling for any user running Hyper‑V with internal routing, Docker Desktop, or host‑VM communication.

Steps to Reproduce:

Enable Hyper-V, create any Internal (or Private) virtual switch.
Example:

powershell
New-VMSwitch -Name "TestInt" -SwitchType Internal
Enable IP Forwarding on the host‑side vEthernet adapter of that switch:

powershell
Set-NetIPInterface -InterfaceAlias "vEthernet (TestInt)" -Forwarding Enabled

Enable Split Tunneling → Apps mode.
Add any application (e.g. chrome.exe) to the bypass list.
Connect AmneziaVPN

Observe — the excluded application loses network connectivity completely.
All other traffic (not matching any exception) works fine through the VPN.

Disable Forwarding on the same interface:

powershell
Set-NetIPInterface -InterfaceAlias "vEthernet (TestInt)" -Forwarding Disabled
Problem disappears immediately — no reboot, no other changes required.

Additional Notes:

Tested on AmneziaVPN 4.8.2.3 and later. 4.8.12.9 some trouble. Windows 1124H2 26100.7462
No changes were made to Windows network stack or Hyper-V configuration — the problem is 100% reproducible by toggling Forwarding.

Root Cause Hypothesis:
Amnezia’s WFP callout driver conflicts with IP Forwarding enabled on non‑VPN virtual interfaces.
The presence of any Hyper‑V vEthernet adapter with Forwarding Enabled is sufficient to trigger the bug.

Originally created by @sfalkorr on GitHub (Feb 11, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2208 Severity: Medium–High Impact: Breaks app‑based split tunneling for any user running Hyper‑V with internal routing, Docker Desktop, or host‑VM communication. Steps to Reproduce: Enable Hyper-V, create any Internal (or Private) virtual switch. Example: powershell New-VMSwitch -Name "TestInt" -SwitchType Internal Enable IP Forwarding on the host‑side vEthernet adapter of that switch: powershell Set-NetIPInterface -InterfaceAlias "vEthernet (TestInt)" -Forwarding Enabled Enable Split Tunneling → Apps mode. Add any application (e.g. chrome.exe) to the bypass list. Connect AmneziaVPN Observe — the excluded application loses network connectivity completely. All other traffic (not matching any exception) works fine through the VPN. Disable Forwarding on the same interface: powershell Set-NetIPInterface -InterfaceAlias "vEthernet (TestInt)" -Forwarding Disabled Problem disappears immediately — no reboot, no other changes required. Additional Notes: Tested on AmneziaVPN 4.8.2.3 and later. 4.8.12.9 some trouble. Windows 1124H2 26100.7462 No changes were made to Windows network stack or Hyper-V configuration — the problem is 100% reproducible by toggling Forwarding. Root Cause Hypothesis: Amnezia’s WFP callout driver conflicts with IP Forwarding enabled on non‑VPN virtual interfaces. The presence of any Hyper‑V vEthernet adapter with Forwarding Enabled is sufficient to trigger the bug.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#984

No description provided.

Rows
Columns