Local policy · Qeli 0.8.1

Per-app routing

How all, include and exclude select processes on Windows, macOS and Android, while gateway and network routes independently select destinations.

Mental model

Application and destination are selected separately

apps_mode answers “whose traffic?”, while gateway, server push, include and exclude answer “to which destinations?”. Per-app does not automatically turn split tunnel into full tunnel.

AxisKeysResult
Applicationapps_mode, appsWhich processes may use Qeli
Networkgateway, include, exclude, pushWhich destinations of the selected application use Qeli
client.conf

all, include and exclude

apps_modeBehaviorapps field
allNormal device profile without process classificationNot used
includeOnly listed applications may use QeliA non-empty list is required
excludeEvery application except those listed uses QeliA non-empty list is required
Do not leave the list empty. An unknown apps_mode is rejected. Windows/macOS do not start per-app without applicable identifiers; Android rejects include when no installed package matches, while exclude with no matches warns that every application will use the VPN.
0.8.1 matrix

What counts as an application identifier

PlatformIdentifierHow it is applied
WindowsFull path to the .exeWinDivert maps each TCP/UDP endpoint to a PID and executable; DNS and fragments retain ownership
macOS 13+Bundle/code-signing IDTransparent Proxy + DNS Proxy select TCP/UDP/DNS and bind selected sockets to the qeli utun
AndroidPackage nameVpnService uses allowed/disallowed applications; a missing package is skipped and logged
iOS sourceBundle IDSettings are preserved, but arbitrary per-app policy requires MDM and NEAppRule
Linux CLIPreserves INI keys but does not classify applications
Lists are not portable across operating systems. A C:\Program Files\… path, a bundle ID and an Android package name identify an application only on their own platform.
macOS requires a signed build. Per-app uses system/network extensions with Developer ID entitlements. Ad-hoc and cross-built archives do not activate it; a public release also needs notarization and stapling.
Three list formats

Platform-specific client.conf examples

Windows · [qeli]
apps_mode = include
apps = C:\Program Files\Mozilla Firefox\firefox.exe, C:\Program Files\Signal\Signal.exe
macOS · [qeli]
apps_mode = include
apps = com.apple.Safari, org.mozilla.firefox
Android · [qeli]
apps_mode = exclude
apps = com.android.vending, com.google.android.youtube

In a GUI, use the built-in picker when possible: it records the current platform's identifier format and reduces typing mistakes.

Decision matrix

How apps_mode interacts with gateway

gatewaySelected applicationOther applications
falseUses Qeli only for the TUN pool, local include entries and pushed routes; public IPv4 goes directUse the system route
truePublic IPv4 also uses QeliUse the system route
In 0.8.0 the per-app data plane supports IPv4 and IPv6. The platform must advertise the corresponding capability; an unsupported combination fails closed. On iOS, applying per-app policy still requires MDM NEAppRule.
macOS limitations: per-app does not intercept ICMP or apply the host-global kill_switch; selected TCP/UDP/DNS still remain fail-closed inside the classifier. Windows likewise keeps selected traffic fail-closed during reconnect.
Local setting

Use the UI or INI; do not rely on qeli://

In 0.8.0, apps_mode and apps remain local fields and are not carried in qeli://. Keep them in local client.conf or set them through each device's GUI for reproducible policy.

INI round-trip preserves values even on clients that do not apply them. This helps with editing, but keys being present in the file does not imply platform support.
Acceptance check

Test both a selected and an unselected application

apps_mode = include|excludethe mode is valid and the list is non-empty
gateway = false|truedestinations match the split/full model
curl https://api.ipify.orgrun separately from a selected and an unselected application
DNS + TCP + UDPtest DNS and UDP as well as browser TCP
Primary sources

v0.8.1 platform implementations