Implement initial proof-of-concept for split tunnel functionality on Windows,
allowing applications to route traffic through a designated network interface
while bypassing default system routing.
Features:
- Split tunnel module with TCP/UDP proxy infrastructure
- Firewall integration with split tunnel verdict handling
- SplitTunneling context attached to connections
- Configuration options: enable toggle, interface selection, and policy rules
- UI display of split tunnel connection details in connection info panel
- Subsystem configuration for user-level access
Windows-specific implementation:
- Uses proxy-based interface routing on Windows
- Automatic or manual interface detection and binding
- Support for IPv4 and IPv6 traffic
Note: Linux implementation is under development. SPN takes precedence over
split tunnel when both are enabled, ensuring SPN connections bypass this feature.
Add a synchronous HookMgr[T] that lets callers register pre-connect
hooks before SPN dials a home hub. The IVPN interop layer subscribes
to this hook and uses Linux ip-rule/ip-route to steer SPN hub IPs
through a dedicated routing table (717) pointing to the non-VPN default
gateway, preventing SPN control traffic from being tunnelled into IVPN.
- service/mgr: add generic HookMgr[T] (synchronous, cancellable)
- spn/captain: expose HookSPNConnecting; invoke it in connectToHomeHub
- service/netenv: add GatewayInfo + GatewaysInfo() with interface/mask
- service/interop/ivpn: add ensureSpnHubBypassVpnRoutes managing policy
routing; call it from the SPN pre-connect hook and on VPN stop/connect
- nfq/packet: add hex comments next to mark constants
https://github.com/safing/portmaster-shadow/issues/34
Bugs fixed:
- Inbound UDP from VPN server incorrectly blocked
- Firewall verdicts possible before client status initialized
Also: move interop before interception in startup order, simplify DNS state tracking.
Allow Portmaster to cooperate with the IVPN client:
- Accept IVPN VPN tunnel and service process connections
- Delegate DNS control to Portmaster when custom DNS is configured
- Auto-connect to IVPN daemon on startup and on ping
- Hook into firewall verdict pipeline via new ExtVerdictHandler
- Add GroupModule to wrap interception, dnsmonitor, and compat modules
- Simplify pause/resume operations by grouping related modules
- Update worker info collection to handle nested module groups
- Remove deprecated flags and improve module lifecycle management
- Add proper atomic state tracking for nfqueue interception
https://github.com/safing/portmaster/issues/2050
* [service] Subscribe to systemd-resolver events
* [service] Add disabled state to the resolver
* [service] Add ETW DNS event listener
* [service] DNS listener refactoring
* [service] Add windows core dll project
* [service] DNSListener refactoring, small bugfixes
* [service] Change dns bypass rule
* [service] Update gitignore
* [service] Remove shim from integration module
* [service] Add DNS packet analyzer
* [service] Add self-check in dns monitor
* [service] Fix go linter errors
* [CI] Add github workflow for the windows core dll
* [service] Minor fixes to the dns monitor
* Move portbase into monorepo
* Add new simple module mgr
* [WIP] Switch to new simple module mgr
* Add StateMgr and more worker variants
* [WIP] Switch more modules
* [WIP] Switch more modules
* [WIP] swtich more modules
* [WIP] switch all SPN modules
* [WIP] switch all service modules
* [WIP] Convert all workers to the new module system
* [WIP] add new task system to module manager
* [WIP] Add second take for scheduling workers
* [WIP] Add FIXME for bugs in new scheduler
* [WIP] Add minor improvements to scheduler
* [WIP] Add new worker scheduler
* [WIP] Fix more bug related to new module system
* [WIP] Fix start handing of the new module system
* [WIP] Improve startup process
* [WIP] Fix minor issues
* [WIP] Fix missing subsystem in settings
* [WIP] Initialize managers in constructor
* [WIP] Move module event initialization to constrictors
* [WIP] Fix setting for enabling and disabling the SPN module
* [WIP] Move API registeration into module construction
* [WIP] Update states mgr for all modules
* [WIP] Add CmdLine operation support
* Add state helper methods to module group and instance
* Add notification and module status handling to status package
* Fix starting issues
* Remove pilot widget and update security lock to new status data
* Remove debug logs
* Improve http server shutdown
* Add workaround for cleanly shutting down firewall+netquery
* Improve logging
* Add syncing states with notifications for new module system
* Improve starting, stopping, shutdown; resolve FIXMEs/TODOs
* [WIP] Fix most unit tests
* Review new module system and fix minor issues
* Push shutdown and restart events again via API
* Set sleep mode via interface
* Update example/template module
* [WIP] Fix spn/cabin unit test
* Remove deprecated UI elements
* Make log output more similar for the logging transition phase
* Switch spn hub and observer cmds to new module system
* Fix log sources
* Make worker mgr less error prone
* Fix tests and minor issues
* Fix observation hub
* Improve shutdown and restart handling
* Split up big connection.go source file
* Move varint and dsd packages to structures repo
* Improve expansion test
* Fix linter warnings
* Fix interception module on windows
* Fix linter errors
---------
Co-authored-by: Vladimir Stoilov <vladimir@safing.io>
Alexandr Stelnykovych
Alexandr Stelnykovych
Daniel
Vladimir Stoilov