[Bug]: Firewall + Split Tunnel misbehavior after updating to 2.24.12

[Supremaker]

Preflight checks

• I have searched existing issues and this bug has not already been reported.
• I am running the latest version of the app available for my platform.
• I understand that incomplete reports may be closed without investigation.

Describe the bug

Flatpak Split Tunnelling stops working after updating to 2.24.12

Operating system

Arch

OS details

CachyOS

App version

2.24.12

Steps to reproduce

Update to 2.24.12
Works normally on 2.23.11

Expected behavior

Don't connect to flatpaks through vpn.

Actual behavior

Attempts to connect through vpn but fails.

Debug log or username

ws.log

Is this a regression?

New to this version

Screenshots

No response

Additional context

No response

[jaxu]

Hi there,

Thanks for the report. We're not able to reproduce this, and your log is from the GUI client only (we'd need the helper log as well to debug split tunneling). Can you use the Export Log function in the log viewer in the app and send that log, or use the in app Send Debug Log functionality and send us your username?

[Supremaker]

log.txt
Also sent a Debug Log under the username "Supremaker"

[jaxu]

Your debug log unfortunately didn't show anything out of the ordinary. I've also reviewed changes between 2.23.11 and 2.24.12 and nothing changes the way Flatpaks are treated between these versions.

Can you confirm that:

• Non-flatpak apps split tunnel correctly for you?
• Other flatpak apps behave the same way? e.g. if you install org.google.Chrome and exclude it, does it work?

[Supremaker]

Non-flatpaks work properly
Tested with flatpak Chrome, some pages seem to work but the connection is extremely slow

Tested with org.vinegarhq.Sober
When split tunnelling is enabled it seems to not be able to connect to any servers

[Supremaker]

Your debug log unfortunately didn't show anything out of the ordinary. I've also reviewed changes between 2.23.11 and 2.24.12 and nothing changes the way Flatpaks are treated between these versions.

Can you confirm that:

* Non-flatpak apps split tunnel correctly for you?

* Other flatpak apps behave the same way? e.g. if you install org.google.Chrome and exclude it, does it work?

So after testing a few things I just found the issue and split tunnel seems to misbehave only when firewall is enabled, just sent another log under the same username

[jaxu]

I've analyzed this and found a potential issue but this would have never worked in any previous version either.

You are using

• Custom Config, with a VPN DNS that times out outside the tunnel (though it's a publicly routable address)
• Split tunneling with a Flatpak
• Local DNS is /etc/resolv.conf that forwards to 127.0.0.53.

This case would not have worked in any version, but you claim it worked in 2.23.11. Are you sure nothing else on your system has changed?

[Supremaker]

I've analyzed this and found a potential issue but this would have never worked in any previous version either.

You are using

* Custom Config, with a VPN DNS that times out outside the tunnel (though it's a publicly routable address)

* Split tunneling with a Flatpak

* Local DNS is /etc/resolv.conf that forwards to 127.0.0.53.

This case would not have worked in any version, but you claim it worked in 2.23.11. Are you sure nothing else on your system has changed?

Yes, the only change i did was updating Windscribe, the reason why my local dns fowards to 127.0.0.53 is because I'm using Blocky to have DOH

[jaxu]

Can I please a a log from the working configuration in 2.23.11 please?

[Supremaker]

Can I please a a log from the working configuration in 2.23.11 please?

Downgraded to 2.23.11 sent logs under the same username

[jaxu]

You are connected to a different (Windscribe, New York - Empire) location in this log. In the 2.24.x failures you are connected to a custom config (Brazil.conf)

This is the difference, not the version. This matches my analysis, which says the custom config case has never worked. We'll fix this in an upcoming release. In the meantime, it should work the same for you in 2.24 if you pick the same location.

[Supremaker]

You are connected to a different (Windscribe, New York - Empire) location in this log. In the 2.24.x failures you are connected to a custom config (Brazil.conf)

This is the difference, not the version. This matches my analysis, which says the custom config case has never worked. We'll fix this in an upcoming release. In the meantime, it should work the same for you in 2.24 if you pick the same location.

Something is wrong on the logs, i never connected to NYC, I only connect through my Wireguard config, quite weird.
Let me send another debug real quick