Local policy · Qeli 0.8.1
Per-app routing
How all, include and exclude select processes on Windows, macOS and Android, while gateway and network routes independently select destinations.
Application and destination are selected separately
apps_mode answers “whose traffic?”, while gateway, server push, include and exclude answer “to which destinations?”. Per-app does not automatically turn split tunnel into full tunnel.
| Axis | Keys | Result |
|---|---|---|
| Application | apps_mode, apps | Which processes may use Qeli |
| Network | gateway, include, exclude, push | Which destinations of the selected application use Qeli |
all, include and exclude
apps_mode | Behavior | apps field |
|---|---|---|
all | Normal device profile without process classification | Not used |
include | Only listed applications may use Qeli | A non-empty list is required |
exclude | Every application except those listed uses Qeli | A non-empty list is required |
Do not leave the list empty. An unknown
apps_mode is rejected. Windows/macOS do not start per-app without applicable identifiers; Android rejects include when no installed package matches, while exclude with no matches warns that every application will use the VPN.What counts as an application identifier
| Platform | Identifier | How it is applied |
|---|---|---|
| Windows | Full path to the .exe | WinDivert maps each TCP/UDP endpoint to a PID and executable; DNS and fragments retain ownership |
| macOS 13+ | Bundle/code-signing ID | Transparent Proxy + DNS Proxy select TCP/UDP/DNS and bind selected sockets to the qeli utun |
| Android | Package name | VpnService uses allowed/disallowed applications; a missing package is skipped and logged |
| iOS source | Bundle ID | Settings are preserved, but arbitrary per-app policy requires MDM and NEAppRule |
| Linux CLI | — | Preserves INI keys but does not classify applications |
Lists are not portable across operating systems. A
C:\Program Files\… path, a bundle ID and an Android package name identify an application only on their own platform.macOS requires a signed build. Per-app uses system/network extensions with Developer ID entitlements. Ad-hoc and cross-built archives do not activate it; a public release also needs notarization and stapling.
Platform-specific client.conf examples
apps_mode = include
apps = C:\Program Files\Mozilla Firefox\firefox.exe, C:\Program Files\Signal\Signal.exe
apps_mode = include
apps = com.apple.Safari, org.mozilla.firefox
apps_mode = exclude
apps = com.android.vending, com.google.android.youtube
In a GUI, use the built-in picker when possible: it records the current platform's identifier format and reduces typing mistakes.
How apps_mode interacts with gateway
gateway | Selected application | Other applications |
|---|---|---|
false | Uses Qeli only for the TUN pool, local include entries and pushed routes; public IPv4 goes direct | Use the system route |
true | Public IPv4 also uses Qeli | Use the system route |
In 0.8.0 the per-app data plane supports IPv4 and IPv6. The platform must advertise the corresponding capability; an unsupported combination fails closed. On iOS, applying per-app policy still requires MDM
NEAppRule.macOS limitations: per-app does not intercept ICMP or apply the host-global
kill_switch; selected TCP/UDP/DNS still remain fail-closed inside the classifier. Windows likewise keeps selected traffic fail-closed during reconnect.Use the UI or INI; do not rely on qeli://
In 0.8.0, apps_mode and apps remain local fields and are not carried in qeli://. Keep them in local client.conf or set them through each device's GUI for reproducible policy.
INI round-trip preserves values even on clients that do not apply them. This helps with editing, but keys being present in the file does not imply platform support.
Test both a selected and an unselected application
apps_mode = include|excludethe mode is valid and the list is non-emptygateway = false|truedestinations match the split/full modelcurl https://api.ipify.orgrun separately from a selected and an unselected applicationDNS + TCP + UDPtest DNS and UDP as well as browser TCP