Split-Tunneling works as expected for applications on the include list except...

[JJDizz1L]

We are happy to answer your questions about the code or discuss technical ideas.

Please complete the following checklist (by adding [x]):

• I have searched open and closed issues for duplicates
• This isn't a feature request
• This is not a report about my app not working as expected

---

I am happy to report that split-tunneling does work properly on my Arch Linux (CachyOS) system.
Thanks for this feature (finally)!

However, I did notice that while it does work for the applications that I have included on my split-tunneling list, the VPN also applies to my browser, Helium Browser (UnGoogled Chromium), even though I do not have it on my list of "included".

It's not a big deal, but it's interesting that it's applying to an application that I did not explictly tell it to apply to.

[luke-titley-proton]

I guess you're using split tunneling in 'include' mode, where you have to explicitly include it for it to be in the vpn tunnel?

This is implemented as kind of the inverse of exclude, where we basically exclude apps that have not been been added to the include list. What we do is track when applications are started and then mark them for include/exclude, we have to do it from the moment they start because it's based on the application executable path and that can actually mutate in certain cases.

What this ultimately means is when your using split tunneling in 'include' mode, it's the same as 'exclude' mode only we're doing the excluding automatically for you (by matching the inverse of the included apps), so the excluded app still needs to be restarted after connecting for it to be excluded from the vpn tunnel.

As a precaution, when in doubt we opt for keeping the app in the tunnel, because that's safest for the user.

I know it's not very intuitive but that's how our current implementation works. We've got quite a few ideas for ways to improve this and we're hopeful that we'll be able to execute some of those ideas in the near future.

[jack-martyn]

I have the same issue as the OP, and rather surprised with the weird logic used by Proton with its include list processing.

I hope you find a way to improve it, as the split tunnel is breaking less-visible applications for me, like background services/process in Linux are getting it's traffic sent out via the VPN.

[Retalak]

I guess you're using split tunneling in 'include' mode, where you have to explicitly include it for it to be in the vpn tunnel?

This is implemented as kind of the inverse of exclude, where we basically exclude apps that have not been been added to the include list. What we do is track when applications are started and then mark them for include/exclude, we have to do it from the moment they start because it's based on the application executable path and that can actually mutate in certain cases.

What this ultimately means is when your using split tunneling in 'include' mode, it's the same as 'exclude' mode only we're doing the excluding automatically for you (by matching the inverse of the included apps), so the excluded app still needs to be restarted after connecting for it to be excluded from the vpn tunnel.

As a precaution, when in doubt we opt for keeping the app in the tunnel, because that's safest for the user.

I know it's not very intuitive but that's how our current implementation works. We've got quite a few ideas for ways to improve this and we're hopeful that we'll be able to execute some of those ideas in the near future.

This is an extremely problematic approach/implementation. If I put it to include and only select a few apps, it should not affect other apps at all, period. This leads to several issues with apps that don't play well with VPNs, and is quite frustrating from a user experience perspective. It is particularly annoying for Steam, because if Steam gets directed through the VPN, so do all the processes (games) it spawns. Many servers/anticheats/etc will not load/kick you/etc if you are connected through a VPN, and I do not want my game traffic going through the VPN in general. On SCP:SL for example, I often have to spam click to join the servers for several minutes when they are full, and it is extremely frustrating to go through all that just realize that my Steam, and thus the game are routed through the VPN and I get kicked.

Also, I reported a similar issue via the proton support email where if you resume from "deep" (suspend-to-ram) sleep, all apps will be directed through the VPN. Overall very disappointed with the shortcomings of the Proton VPN app for Linux having come from PIA, whose app functioned flawlessly on Linux (including split tunneling).