Table of Contents

Class VpnKillSwitchRules

Namespace
VpnHood.Core.Client.VpnServices.Abstractions
Assembly
VpnHood.Core.Client.VpnServices.Abstractions.dll

Represents what a kill switch's block lets out besides the tunnel and the VPN service: the device-level split only, what the adapter's routes leave out.

public class VpnKillSwitchRules
Inheritance
VpnKillSwitchRules
Inherited Members

Remarks

The app-level splits (country, IP via app, domain) are the service's: it sends their traffic out itself while connected, which the block lets through as the service's own, so none of their addresses goes into the block, and while blocked with no tunnel they wait for it. A country's thousands of ranges would be too many for the OS's firewall anyway.

Properties

AdapterName

Gets the tunnel's adapter, by the name its settings give it (AdapterName): its traffic passes once it is up.

public required string AdapterName { get; init; }

Property Value

string

DnsServers

Gets the resolvers DNS may reach outside the tunnel: an out-of-tunnel plan's. Every other plain DNS query, to port 53, outside it is blocked, a LAN router's too, which would otherwise learn every name; where a platform's block cannot see the port, as for traffic Windows routes itself, one to an address that passes passes.

public required IReadOnlyList<IPAddress> DnsServers { get; init; }

Property Value

IReadOnlyList<IPAddress>

PassIpRanges

Gets what the adapter's routes leave out, which passes: the local networks unless they are included, multicast, broadcast, and the person's IP-via-device list; not the server's address, which only the service reaches.

public required IpRangeOrderedList PassIpRanges { get; init; }

Property Value

IpRangeOrderedList

Methods

CreateBySettings(string, IReadOnlyList<IpRange>, bool)

Creates the rules by the person's settings, with no session: a connect's block until its adapter starts, and the app's own while disconnected with the block kept (the app's KillSwitchMode.Lockdown).

public static VpnKillSwitchRules CreateBySettings(string adapterName, IReadOnlyList<IpRange> includeIpRangesByDevice, bool splitLocalNetwork)

Parameters

adapterName string

The name of the tunnel's adapter.

includeIpRangesByDevice IReadOnlyList<IpRange>

The addresses the device's tunnel captures (IncludeIpRangesByDevice); the rest passes.

splitLocalNetwork bool

true if the local networks, multicast and broadcast stay out of the tunnel, and so pass.

Returns

VpnKillSwitchRules

The rules, with no resolver passing.

Remarks

The server's own exclusions come only with a session, and so does its DNS plan, so no resolver passes, nor the local networks unless the person's split leaves them out — the replies to an inbound connection too, SSH's into a locked-down box.