[Bug]: Added domains behave opposite of intended in Bypass / VPN Only modes

[smailpouri]

Version: v4.8.0
Installation Method: Homebrew (brew install --cask vpn-bypass)
VPN Type: WireGuard

Bug Description:
Adding a domain to the list:

• In VPN Only mode, the domain should go through the VPN — but its traffic goes through the direct connection instead.
• In Bypass mode, the domain should bypass the VPN (go direct) — but its traffic goes through the VPN instead.

Custom mode works correctly.

Expected Behavior:
VPN Only → domain via VPN; Bypass → domain direct.

Steps to Reproduce:

1. Add a domain (e.g. speedtest.net) in VPN Only or Bypass mode.
2. Connect WireGuard (NetBird must be connected for WireGuard to connect while the app runs).
3. Visit the domain / run a speed test — traffic goes the wrong way: direct in VPN Only, through the VPN in Bypass.
4. Also: with NetBird off, WireGuard won't connect while the app runs; quitting the app fixes it.

Environment:

• macOS (Apple Silicon)
• Helper installed
• NetBird + WireGuard

Checklist:

• I have searched existing issues to ensure this isn't a duplicate
• I have tried restarting the app

[GeiserX]

Sorry about that, seems very few people actually using this option. It was working at some point when I added this feature after someone asking for it.
Thanks for sharing, will prepare a PR.

[GeiserX]

Thanks — good report, and you were right that something real was wrong. It splits into two different things:

VPN Only — real bug, fix in #104. wg-quick-style WireGuard captures traffic with 0.0.0.0/1 + 128.0.0.0/1 and leaves default alone. VPN Only installed those same two routes via your local gateway — which didn't add anything: it repointed WireGuard's own routes in place, and deleted them on teardown. That's the inversion you saw, and it's also why WireGuard often couldn't connect while the app ran (both sides fighting over the same two kernel entries — wg-quick aborts on the route conflict). After #104 the app uses four /2 routes instead: more specific than WireGuard's /1s, so they coexist and never touch each other, and your listed domains still win with /32 routes. Selection also changed: the tunnel that owns the /1 pair is now treated as the one carrying traffic, so with NetBird up first, WireGuard still becomes "the VPN" that your listed domains route into.

Bypass — working as designed, but the test measures the wrong thing. The app routes the IPs it resolves for your listed domains. A speed test is the hardest possible case: the speedtest.net page connects to Ookla test servers (*.ooklaserver.net and friends) that aren't in your list at all, and your browser can resolve different CDN IPs than the app did — especially with WireGuard's own DNS active. So the test traffic legitimately rides the VPN even though speedtest.net's own IPs are bypassed. If you want a whole flow steered, Custom mode (which you found works) or adding the actual endpoint domains is the way to do it.

The WireGuard connect problem should disappear with #104 in both modes.