DNS-only blocking didn't stop apps like WhatsApp that use
cached/hardcoded server IPs. Now uses two modes:
MODE 1 (apps blocked): Routes ALL traffic (0.0.0.0/0) through VPN.
Non-blocked apps excluded via addDisallowedApplication.
Blocked apps' entire traffic (DNS + TCP + UDP) is dropped.
WhatsApp, Instagram etc are fully blocked - no messages in or out.
MODE 2 (no apps blocked, only domain rules): DNS-only route.
Routes only DNS server IPs through VPN.
Domain blocking works for all apps with zero overhead.
Automatically switches between modes based on active rules.