Skip to content

Split tunnel allow list #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
matthuisman wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Split tunnel allow list #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
aa14a91
switch exclude to include
matthuisman Jun 6, 2025
d4cc8d5
Merge branch 'main' into include_apps
matthuisman Jul 4, 2025
8779824
Merge pull request #2 from tailscale/main
matthuisman Aug 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/workflows/android.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,5 +33,10 @@ jobs:
- name: Build APKs
run: make tailscale-debug.apk

- uses: actions/upload-artifact@v4
with:
name: tailscale-debug.apk
path: tailscale-debug.apk

- name: Run tests
run: make test
10 changes: 7 additions & 3 deletions android/src/main/java/com/tailscale/ipn/App.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -513,15 +513,19 @@ open class UninitializedApp : Application() {
this.restartVPN()
}
fun disallowedPackageNames(): List<String> {
val userAllowed =
getUnencryptedPrefs().getStringSet(DISALLOWED_APPS_KEY, emptySet())?.toList() ?: emptyList()
return userAllowed
}

fun actualDisallowedPackageNames(): List<String> {
val mdmDisallowed =
MDMSettings.excludedPackages.flow.value.value?.split(",")?.map { it.trim() } ?: emptyList()
if (mdmDisallowed.isNotEmpty()) {
TSLog.d(TAG, "Excluded application packages were set via MDM: $mdmDisallowed")
return builtInDisallowedPackageNames + mdmDisallowed
}
val userDisallowed =
getUnencryptedPrefs().getStringSet(DISALLOWED_APPS_KEY, emptySet())?.toList() ?: emptyList()
return builtInDisallowedPackageNames + userDisallowed
return builtInDisallowedPackageNames
}

fun getAppScopedViewModel(): AppViewModel {
Expand Down
7 changes: 5 additions & 2 deletions android/src/main/java/com/tailscale/ipn/IPNService.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,8 +161,11 @@ open class IPNService : VpnService(), libtailscale.IPNService {
b.setUnderlyingNetworks(null) // Use all available networks.

val includedPackages: List<String> =
MDMSettings.includedPackages.flow.value.value?.split(",")?.map { it.trim() } ?: emptyList()
(MDMSettings.includedPackages.flow.value.value?.split(",")?.map { it.trim() } ?: emptyList()) +
UninitializedApp.get().disallowedPackageNames()

if (includedPackages.isNotEmpty()) {
b.addAllowedApplication("com.tailscale.ipn")
// If an admin defined a list of packages that are exclusively allowed to be used via
// Tailscale,
// then only allow those apps.
Expand All @@ -174,7 +177,7 @@ open class IPNService : VpnService(), libtailscale.IPNService {
// Otherwise, prevent certain apps from getting their traffic + DNS routed via Tailscale:
// - any app that the user manually disallowed in the GUI
// - any app that we disallowed via hard-coding
for (disallowedPackageName in UninitializedApp.get().disallowedPackageNames()) {
for (disallowedPackageName in UninitializedApp.get().actualDisallowedPackageNames()) {
TSLog.d(TAG, "Disallowing app: $disallowedPackageName")
disallowApp(b, disallowedPackageName)
}
Expand Down
6 changes: 3 additions & 3 deletions android/src/main/res/values/strings.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -308,9 +308,9 @@
<string name="an_unknown_error_occurred_please_try_again">An unknown error occurred. Please try again.</string>
<string name="request_timed_out_make_sure_that_is_online">Request timed out. Make sure that \'%1$s\' is online.</string>
<string name="split_tunneling">App split tunneling</string>
<string name="exclude_certain_apps_from_using_tailscale">Exclude certain apps from using Tailscale</string>
<string name="selected_apps_will_access_the_internet_directly_without_using_tailscale">Apps selected here will access the Internet directly, without using Tailscale.</string>
<string name="count_excluded_apps">Excluded apps (%1$s)</string>
<string name="exclude_certain_apps_from_using_tailscale">Include certain apps to use Tailscale</string>
<string name="selected_apps_will_access_the_internet_directly_without_using_tailscale">Apps selected here will use Tailscale.</string>
<string name="count_excluded_apps">Included apps (%1$s)</string>
<string name="certain_apps_are_not_routed_via_tailscale">Certain apps are not routed via Tailscale on this device. This setting is managed by your organization and cannot be changed by you. For more information, contact your network administrator.</string>
<string name="only_specific_apps_are_routed_via_tailscale">Only specific apps are routed via Tailscale on this device. This setting is managed by your organization and cannot be changed by you. For more information, contact your network administrator.</string>
<string name="specifies_a_list_of_apps_that_will_be_excluded_from_tailscale_routes_and_dns_even_when_tailscale_is_running_all_other_apps_will_use_tailscale">Specifies a list of apps that will be excluded from Tailscale routes and DNS even when Tailscale is running. All other apps will use Tailscale.</string>
Expand Down