Rules

Adding and editing rules

From the Rules screen, adding a rule opens a small form with:

• Type — IP/CIDR or Domain.
• Value — a CIDR block (e.g. 10.0.1.0/24; a bare IP like 192.168.50.5 is treated as a single address) or a hostname (e.g. wiki.example.com).
• Label — optional, up to 80 characters. Not sent to the privileged helper; it’s for your own reference only.
• Enabled — on by default.

Certain ranges are rejected outright regardless of type — 0.0.0.0/0 and other very broad ranges (/0 through /7), and loopback addresses — since routing these through a VPN interface would be unsafe or meaningless.

Editing a value re-validates it; editing just the label or the enabled switch saves immediately. Deleting a rule removes it from the list; if it was already applied, the corresponding route is removed the next time you apply. Disabling a rule (rather than deleting it) excludes it from the next apply, but any route it already applied stays in place until you apply again.

Any add, edit, delete, or enable/disable action marks your rule set dirty — nothing changes on the actual network until you press Apply.

How domain rules resolve

Domain rules are resolved using your Mac’s system DNS resolver — the same one your browser uses — not a fixed external one. SplitLane stores every resolved address for a domain (not just the first) and applies each as its own /32 route, so a domain with multiple A records is fully covered at the moment it’s resolved.

Resolution happens automatically right after you save a domain rule, again right before Apply, and when your VPN connects while SplitLane is running. You can also trigger it manually. If resolution fails (DNS timeout, no such domain), the rule is marked unresolved and the previous resolved addresses (if any) are kept rather than discarded.

Known limitation: domains served by large CDNs or SaaS platforms can resolve to different IP addresses over time. Because a domain rule only routes the addresses it resolved at the time it was last resolved, this kind of domain rule can be incomplete — new IPs the CDN starts using afterward won’t automatically be covered until you re-resolve.

Groups

A rule can optionally belong to one named group (1–80 characters, unique within your rule set). Groups exist to let you toggle a whole cluster of rules together rather than one at a time — see Core Concepts for how a group’s enabled state combines with each rule’s own enabled state. Deleting a group moves its rules to Unclassified rather than deleting them.

Import and export (YAML)

SplitLane can import and export rules as YAML — the main use case is sharing a company or team rule set without asking everyone to re-type it. The importer is fully separate from the app’s internal storage format; it’s designed to be readable, commentable, and hand-editable.

Format reference

# SplitLane rules export template
splitlane_rules: 1

# Optional: named, independently toggle-able groups of rules.
# - "name" is required, trimmed, 1-80 characters, unique in this file.
# - "enabled" is optional (defaults to true). A disabled group's rules are
#   all excluded from the applied route snapshot, regardless of each
#   rule's own "enabled" value.
groups:
  - name: Corp network
    enabled: true
    rules:
      # Each rule needs exactly one of "cidr" or "domain" (never both,
      # never neither).
      - cidr: 10.0.0.0/8
        label: Core systems   # optional, trimmed, up to 80 characters
      - domain: wiki.example.com
        label: Company wiki
        enabled: false        # optional, defaults to true

# Optional: rules not in any group.
ungrouped:
  - cidr: 192.168.50.5

• splitlane_rules: 1 is the interchange format’s own version number — independent of the app’s internal storage schema.
• Every rule needs exactly one of cidr or domain; a rule with both, or neither, is rejected.
• label and enabled are both optional per rule.
• Comments (#) are allowed anywhere.
• Not included in this format, and ignored on import: per-rule resolved IP history, any UUID/ID, and per-Mac settings like the VPN interface pattern or the default-gateway-restore toggle — these are environment-specific and aren’t meant to travel between machines.
• Limits: files over 1 MiB, or with more than 500 rules total, are rejected outright. Individual invalid entries (a bad CIDR, a bad domain, a label over 80 characters, or a rule with both/neither of cidr/domain) are skipped and reported in the import preview — they don’t block the rest of the file from importing.

Exporting

You can export selected groups or individual rules, or export a blank, commented template to start from scratch. Export opens a standard save panel for choosing where to write the file.

Importing

Choose a file to import, and SplitLane re-validates every value the same way the manual entry form would. Before anything is written, you see a preview listing what will be added, what’s a duplicate (and will be skipped), and any entries with errors or warnings. Confirming the import only saves the rules and marks your rule set dirty — it never touches your Mac’s actual routes. You still need to press Apply afterward.

Merge behavior: a group in the imported file merges into an existing group of the same name (rather than creating a duplicate group). A rule is skipped as a duplicate if another rule with the same type and value (cidr/domain) already exists anywhere in your rule set.