NetRuleRouter Alpha 0.1.0 Released for Selective Traffic Routing Across VPN and Direct Connections

Developer krox12 has released the first public alpha of NetRuleRouter v0.1.0-alpha.1 for Windows and Linux, a local network policy manager that routes traffic between primary and secondary connections without acting as a VPN client itself. The tool emerged from Russian government discussions in March 2026 about restricting VPN access to domestic platforms, as reported by Kommersant and RBC, which led to practical blocks on services like Gosuslugi. NetRuleRouter supports seven matching methods including exact domains, wildcard subdomains, CIDR subnets, and application names, with built-in leak protection modes that prevent protected traffic from falling back to the primary connection when the secondary link drops. It includes Russian presets directing services such as ChatGPT, Claude, and Gemini through the secondary route while keeping banks and marketplaces on the primary internet. The alpha also provides connection tracing, rule intersection analysis, import/export of rule sets, and a first-run wizard that handles TAP adapter changes from VPN clients. Corporate VPN compatibility is supported but requires testing due to potential conflicts with existing route tables and DNS configurations.

HabrOctober 31, 2026Translated from Russian

Read at source

Developer krox12 has released the first public alpha of NetRuleRouter v0.1.0-alpha.1 for Windows and Linux, a local network policy manager designed to route traffic between existing primary and secondary connections without functioning as a VPN client, proxy, or anonymization service.

The project began on 1 April 2026 after reports that Russia’s Ministry of Digital Development was discussing VPN restrictions with domestic platforms. Coverage in Kommersant on 30 March and subsequent RBC articles from 14–16 April documented emerging blocks affecting marketplaces, banks, and the Gosuslugi app, prompting users to toggle VPNs repeatedly.

NetRuleRouter lets users designate a Primary connection (Ethernet or Wi-Fi) and a Secondary connection (VPN, second ISP, or additional adapter) and then apply rules that decide which path specific resources must use. Supported matching methods include exact domains, wildcard subdomains, domain zones such as .ru, IPv4/IPv6 addresses, CIDR ranges, internal suffixes, and application executables or folders.

Three leak-protection modes are available. The default “Only sites from rules” mode keeps traffic assigned to the secondary connection from falling back to the primary when the VPN drops, while still allowing unprotected traffic to use the primary link. Stricter “Everything” and disabled modes are also offered, with known limitations documented for the alpha release.

Built-in diagnostics show live connections, blocked attempts, and suggested additional addresses when a site uses multiple domains. Rule sets can be imported, exported, or loaded from regional presets; the Russian preset routes ChatGPT, Claude, Gemini, and selected AI services through the secondary connection while directing banks and marketplaces through the primary.

The tool supports simultaneous use of corporate and personal VPNs by preserving the corporate tunnel’s own routes and allowing the user to specify which connection the corporate client itself should traverse. A first-run wizard installs the background service (requiring administrator rights once on Windows) and helps bind the secondary adapter even when VPN clients rotate TAP interfaces.

Anthropic ChatGPT Gosuslugi Claude NetRuleRouter

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Policy & Regulation

Policy & Regulation

Trusting Russian Ministry CA Only for One Python Client: Handling CERTIFICATE_VERIFY_FAILED with aiohttp and httpx

A developer connecting a Python bot to the MAX messenger API encountered ClientConnectorCertificateError due to an SSL certificate chain signed by the Russian Ministry of Digital Development. The server presents a leaf certificate for *.max.ru and the intermediate Russian Trusted Sub CA, but the root Russian Trusted Root CA is absent from Debian, certifi, and Windows stores. Adding the intermediate to system stores or certifi would expose all clients in the process, including those talking to Telegram and Anthropic, to broad trust in the government CA. The solution creates a dedicated SSLContext using create_default_context, loads only the Sub CA via load_verify_locations, and enables VERIFY_X509_PARTIAL_CHAIN so the context stops at the intermediate without requiring the root. This context is passed exclusively to the aiohttp TCPConnector for the MAX session, leaving global ssl state, certifi, and other connections untouched. Equivalent patterns are shown for httpx.Client, urllib.request, and requests via a custom HTTPAdapter that injects the context only for the target host.

HabrOct 31, 2026Translated from Russian

Policy & Regulation

Rostelecom Strengthens Data Center Protection Amid Physical Attacks Through Armed Forces Cooperation

Rostelecom is implementing enhanced physical security measures for its data centers in response to recent attacks on Russian facilities. Company president Mikhail Oseevsky stated that passive protection tools and direct coordination with the Russian Armed Forces are being deployed to safeguard infrastructure. Backup systems alone are insufficient against physical threats, prompting a comprehensive approach that avoids disclosure of specific technical details. No significant client migration from Yandex or VK data centers to Rostelecom facilities has been observed, as affected operators quickly restore operations with mutual industry support. The focus remains on protecting both data and the physical locations housing critical equipment following October incidents.

AntiMalwareOct 30, 2026Translated from Russian

Policy & Regulation

Russian Minister Proposes Blocking All SIM Cards Linked to Fraudsters Banned in MAX Messenger

The head of Russia's Ministry of Digital Development, Maksut Shadaev, has suggested extending account bans in the MAX messenger to a broader set of mobile restrictions. Under the proposal, operators would be required to disconnect not only the number used in a fraudulent account but also any other SIM cards belonging to the same individual. The measure would also introduce a cooling-off period preventing the person from registering new numbers after a ban. Officials aim to make it significantly harder for scammers to resume operations following enforcement actions. Key implementation details, including how ownership and involvement in fraud will be verified, remain unspecified in the initial statement. The initiative specifically targets fraud prevention and does not apply to every account suspension in the messenger.

AntiMalwareOct 29, 2026Translated from Russian