NetRuleRouter Alpha Released to Route Traffic Across Multiple Connections Without Disabling VPN
Developer krox1 has published the first public alpha of NetRuleRouter v0.1.0-alpha.1 for Windows and Linux, a local network policy manager designed to route specific sites, applications, and networks through different connections while a VPN remains active.
The project addresses a common friction point: when a VPN is enabled, many Russian banks, marketplaces, and government services request that it be disabled; when it is turned off, foreign services become unreachable or suffer regional restrictions. The developer began work on 1 April 2026 after reports that Russia’s Ministry of Digital Development was discussing VPN limitations with platforms, followed by real-world prompts from operators and the Gosuslugi app in April 2026.
How NetRuleRouter Works
NetRuleRouter is not a VPN client, proxy, or anonymization service. It manages traffic between two existing operating-system connections labeled Primary (direct Ethernet or Wi-Fi) and Secondary (VPN, second ISP, or another adapter). Users define rules that decide which connection each destination should use.
Supported matching methods include:
- Exact domain (api.example.com)
- Domain and all subdomains (*.example.com)
- Site across TLDs (example.*)
- Exact IPv4 or IPv6 address
- CIDR subnet or IP range
- Top-level domain or internal suffix (.ru, .intra)
- Application by executable name, path, or folder
Rules can also explicitly block destinations or applications. Overlapping rules are resolved by a documented priority engine that favors more specific matches; a visual intersection viewer helps users verify outcomes.
Leak Protection and Fail-Safe Modes
Three leak-protection modes are available. The default “Only sites from rules” mode keeps traffic assigned to the secondary connection from falling back to the primary if the VPN drops. A stricter “Everything” mode applies broader restrictions with explicit exceptions. The developer notes that the alpha still has brief windows at Windows startup and certain DNS or shared-IP edge cases, so protection is not claimed to be absolute.
Practical Use Cases
Typical configurations send Russian banks and marketplaces over the primary link, AI services such as ChatGPT, Claude, and Gemini over the secondary link, and video calls or large downloads over the primary link to avoid VPN latency. Corporate VPNs can remain active alongside a personal VPN because NetRuleRouter respects existing routes to internal company networks.
The alpha ships with region-specific presets (including a Russian set), import/export of rule collections, connection tracing that shows which process opened each socket and which route was chosen, and local history that can be disabled or cleared. A first-run wizard installs the required background service (one-time administrator rights on Windows) and helps bind the correct adapters even when VPN clients create multiple virtual interfaces.
NetRuleRouter does not accelerate connections, combine bandwidth, or protect against account-level blocks by service providers. Its sole purpose is deterministic, user-controlled routing between already-established network interfaces.
Related articles
Rostelecom Refactors InfoSec Careers: Matching Employee Skills to Evolving Business Priorities
Rostelecom's information security block developed a systematic approach to reassess employee expertise and redirect talent to new roles when business structures change rapidly. In one case, an architect hired for a specific team was reassigned after the unit was disbanded, initially moving to a similar position that did not fully align with his broader competencies. HR-business partner Olga Lapshina examined the specialist's full background, including prior work in audits, methodology development, regulatory documentation, university teaching, and scientific research, plus strong mentoring abilities with younger staff. These skills matched the needs of the methodology department, leading to a transfer supported by an individual development plan and a mentor via the internal Tochka Rosta platform. Within two months the employee contributed improvements that accelerated preliminary InfoSec audits by 30 percent and risk assessments by 20 percent while expanding threat scenario coverage by 10 percent. The initiative demonstrates Rostelecom's emphasis on horizontal career movement and retention of experienced professionals through structured career tracks.
How to Avoid Becoming the Hero of 'My Program Deleted 800 GB': Safe Recursive Deletion in Bash and Python
A recent Habr article examines dangerous patterns in recursive file deletion scripts that have caused massive data loss incidents, including an 800 GB wipe triggered by Telegram Desktop on Windows. The piece analyzes classic mistakes such as empty variables in rm commands and extra spaces that turned single paths into multiple destructive arguments, referencing the 2015 Steam Linux bug and the 2011 Bumblebee installer error. It provides hardened Bash templates using set -euo pipefail, ${VAR:?} checks, realpath validation, and --one-file-system flags to prevent deletion of forbidden directories or symlinked targets. The Python section introduces a safe_rmtree wrapper that enforces root boundaries, rejects symlinks, uses resolve(strict=True), and checks shutil.rmtree.avoids_symlink_attacks before proceeding. Additional recommendations include dry-run modes, marker files, temporary directory usage, and logging to make deletion operations auditable and reversible where possible.
Hackers tamper with refrigeration units in European supermarkets, setting temperatures to +50 °C
Attackers gained unauthorized access to refrigeration and freezer control systems in supermarkets across several European countries, including Sweden, Belgium, Luxembourg, and Estonia. In multiple locations they altered temperature settings to +50 °C, risking widespread spoilage of perishable goods. The incidents primarily affected older, unpatched Danfoss controllers that had been connected to networks for remote maintenance. Estonian manufacturer Kitman Coldtech reported that one attack on a legacy Danfoss system was detected and stopped within approximately ten minutes, preventing any damage. Similar intrusions were confirmed by Swedish chains ICA and Coop, following earlier incidents in French supermarkets in October that resulted in product losses. Experts note that legacy industrial controllers remain attractive targets because they are often left exposed once placed online for convenience.
AmneziaWG Container for MikroTik Routers Delivers Top Performance Six Months After Launch
A developer released an AmneziaWG container for MikroTik devices in February 2026 and has since added major improvements in speed, protocol support, and stability. The lightweight container leverages the router's native WireGuard implementation for cryptography while handling AmneziaWG obfuscation in software. Performance now reaches 250-350 Mbit/s on models such as Hap Ax3 and RB5009B after switching to C code and increasing buffer sizes with RouterOS 7.24. New features include server mode for connecting multiple MikroTik devices, random port hopping, IPv6 support, dynamic DNS, and offline configuration. The project survived an early GitHub ban caused by test scripts and has grown to over 370 stars while remaining fully offline and privacy-focused.