A CIDR in front of any value limits it to its addresses, an IPv6 one in
brackets, e.g. "1.1.1.0/24:53", "[2001:db8::/32]:tcp/853" or
"[::/0]:all": "0.0.0.0/0:" and "[::/0]:" take the place of "ipv4:" and
"ipv6:". Like autoSystemRoutingTable, it takes CIDRs only, a single
address as "8.8.8.8/32", and no GeoIP.
"<port>" or "<low>-<high>" alone stands for TCP and UDP, so "dns" is
"53", "853" and "windnsclient" now.
The filters follow:
- One filter per layer permits what goes through the TUN, instead of one
for each value.
- "all" and "misconfigtun" outweigh the local network that "allexceptlan"
leaves open, so with it, "192.168.1.5/32:all" still blocks that address.
- The DNS Client service's mDNS and LLMNR stay allowed on the local network
only, and only while no other value blocks them.
- The warning about blocked DNS servers only names those a value blocks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
