Skip to content

Commit 49a7065

Browse files
GeiserXclaude
GeiserX
and
claude
committed
docs: update ROADMAP to v1.9.0, remove monetization, add visibility section
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 96a0710 commit 49a7065

1 file changed

Lines changed: 123 additions & 142 deletions

File tree

‎ROADMAP.md‎

Lines changed: 123 additions & 142 deletions
Original file line numberDiff line numberDiff line change
@@ -1,86 +1,98 @@
11
# VPN Bypass - Product Roadmap
22

3-
## Current State (v1.1)
3+
## Current State (v1.9.0)
44

5-
### ✅ Phase 1 Complete - Polish & Stability
5+
### ✅ Phase 1 Complete - Core & Polish (v1.0 - v1.2)
66

77
| Feature | Status | Notes |
88
|---------|--------|-------|
9-
| **Improved VPN Detection** | ✅ Done | GlobalProtect, Cisco, OpenVPN, WireGuard, Fortinet, Zscaler, Cloudflare WARP, Tailscale exit node |
9+
| **Menu Bar App** | ✅ Done | Real-time VPN status, route count, quick controls |
10+
| **Domain-based Bypass** | ✅ Done | Custom domains + 37+ pre-configured services |
11+
| **Route Management** | ✅ Done | Kernel routing table + `/etc/hosts` DNS bypass |
12+
| **VPN Detection** | ✅ Done | GlobalProtect, Cisco, OpenVPN, WireGuard, Fortinet, Zscaler, WARP, Tailscale, Check Point |
1013
| **Network Change Handling** | ✅ Done | NWPathMonitor + debouncing, auto-refresh on wake |
11-
| **Notifications** | ✅ Done | UNUserNotificationCenter, per-event toggles, appears in System Settings |
14+
| **Notifications** | ✅ Done | Per-event toggles, silent mode, System Settings integration |
1215
| **Route Verification** | ✅ Done | Ping test (disabled by default - many servers block ICMP) |
1316
| **Import/Export Config** | ✅ Done | JSON export/import in Settings |
1417
| **Launch at Login** | ✅ Done | SMAppService, enabled by default |
15-
| **Privileged Helper** | ✅ Done | No sudo prompts, auto-install on first launch |
18+
| **Privileged Helper** | ✅ Done | No sudo prompts, auto-install + auto-update on version mismatch |
1619
| **Auto DNS Refresh** | ✅ Done | Periodic re-resolution (default 1h), keeps hosts file fresh |
1720
| **Loading States** | ✅ Done | Spinner during route operations, UI blocking |
1821
| **Incremental Routes** | ✅ Done | Toggle single service/domain without full rebuild |
1922
| **Bulk Operations** | ✅ Done | All/None for services and domains |
23+
| **Respect User's DNS** | ✅ Done | Detects pre-VPN DNS from primary interface |
24+
| **Homebrew Cask** | ✅ Done | `brew install --cask vpn-bypass` with auto-update CI |
25+
| **Route Health Dashboard** | ✅ Done | Active routes, services, domains, DNS server, timing in Logs tab |
2026

21-
### ✅ Core Features (v1.0)
22-
- Menu bar app with real-time VPN status
23-
- Domain-based bypass rules
24-
- Pre-configured services (37 services: Telegram, YouTube, WhatsApp, Spotify, Netflix, etc.)
25-
- Route management via system routing table
26-
- Optional `/etc/hosts` management for DNS bypass
27-
- Settings UI with Domains, Services, General, Logs tabs
28-
- Activity logging with copy functionality
27+
### ✅ Phase 1.5 Complete - Performance & Reliability (v1.3 - v1.6)
28+
29+
| Feature | Status | Notes |
30+
|---------|--------|-------|
31+
| **Instant Startup** | ✅ Done | DNS disk cache enables routes in ~2-3s, background refresh |
32+
| **True Parallel DNS** | ✅ Done | Dig + DoH race simultaneously; VPN-blocked DNS falls back in ~2s |
33+
| **Batch Route Operations** | ✅ Done | Single XPC call instead of 300+ individual calls (3-5min → ~10s) |
34+
| **DoH Fallback** | ✅ Done | Cloudflare + Google DNS over HTTPS when regular DNS fails |
35+
| **DoT Support** | ✅ Done | DNS over TLS as additional resolution method |
36+
| **DNS Disk Cache** | ✅ Done | Persists resolved IPs, fallback when DNS fails |
37+
| **Auto-Retry on DNS Failure** | ✅ Done | 15s retry with cancellation support |
38+
| **12-Hour Watchdog** | ✅ Done | Restarts network monitor to prevent stale state on long uptimes |
39+
| **GCD Thread Pool Fix** | ✅ Done | Eliminated thread starvation causing ifconfig timeouts |
40+
| **VPN Two-Pass Detection** | ✅ Done | Collects ALL interfaces first, then validates |
41+
| **URL Input Cleaning** | ✅ Done | Paste full URLs, strips protocol/port/path/auth automatically |
42+
| **SOCKS5 Proxy** | ✅ Done | Aggressive bypass for corporate VPNs blocking UDP |
43+
| **Light/Dark Mode** | ✅ Done | Full compatibility for dropdown and all UI elements |
44+
45+
### ✅ Phase 1.7 Complete - VPN Compatibility & Robustness (v1.7 - v1.9)
46+
47+
| Feature | Status | Notes |
48+
|---------|--------|-------|
49+
| **Check Point VPN** | ✅ Done | Process-based detection for Endpoint Security VPN |
50+
| **Zscaler CGNAT Fix** | ✅ Done | Distinguishes Zscaler/WARP from Tailscale in shared 100.64.x.x range |
51+
| **Tailscale CGNAT Fix** | ✅ Done | No longer misidentified as corporate VPN when GlobalProtect disconnects |
52+
| **Gateway Robustness** | ✅ Done | Re-detects gateway on user actions and VPN interface switches |
53+
| **VPN Interface Hopping** | ✅ Done | Routes re-applied when VPN switches interfaces (utun4 → utun5) |
54+
| **Auto-Merge Service Updates** | ✅ Done | App upgrades apply new domains/IPs while preserving user preferences |
55+
| **OpenAI/ChatGPT Domains** | ✅ Done | Comprehensive domain list including CDN, auth, Azure, LiveKit |
56+
| **Runtime Version Display** | ✅ Done | Reads from bundle, always matches release |
2957

3058
---
3159

3260
## Roadmap
3361

34-
### Phase 1.2: DNS & Distribution (v1.2) ✅ COMPLETE
35-
**Completed: January 2026**
36-
37-
| Feature | Status | Notes |
38-
|---------|--------|-------|
39-
| **Respect User's DNS** | ✅ Done | Detects pre-VPN DNS from primary interface, uses for all resolution |
40-
| **Homebrew Tap** | ✅ Done | `brew tap geiserx/vpn-bypass && brew install --cask vpn-bypass` |
41-
| **Route Health Dashboard** | ✅ Done | Shows active routes, services, domains, DNS server, timing info in Logs tab |
42-
43-
**Note**: ASN-based routing considered but deferred - current hardcoded IP ranges + DNS resolution is sufficient.
44-
45-
### Phase 2: Advanced Routing (v1.3 - v1.5)
46-
**Timeline: 3-6 months**
47-
48-
| Feature | Description | Tier |
49-
|---------|-------------|------|
50-
| **App-based Routing** | Bypass VPN for specific apps (Safari, Chrome, Spotify app) | **Premium** |
51-
| **Inverse Mode** | Route ONLY specific traffic through VPN, bypass everything else | **Premium** |
52-
| **Kill Switch** | Block all traffic if VPN disconnects unexpectedly | **Premium** |
53-
| **DNS Leak Protection** | Ensure DNS queries don't leak through VPN | **Premium** |
54-
| **IPv6 Leak Protection** | Block IPv6 to prevent leaks | **Premium** |
55-
| **Connection Profiles** | Different configs for "Home", "Work", "Travel" | **Premium** |
56-
| **Scheduled Rules** | Auto-enable/disable bypasses based on time | **Premium** |
57-
| **Local DNS Proxy** | Run local DNS that uses ISP DNS for bypass domains | **Premium** |
58-
59-
### Phase 3: Power Features (v2.0+)
60-
**Timeline: 6-12 months**
61-
62-
| Feature | Description | Tier |
63-
|---------|-------------|------|
64-
| **Custom DNS** | Use specific DNS servers for bypassed traffic (DoH/DoT) | **Premium** |
65-
| **Blocklists Integration** | Block ads/trackers/malware domains | **Premium** |
66-
| **Network-based Profiles** | Auto-switch profile based on WiFi SSID | **Premium** |
67-
| **Bandwidth Monitor** | Track data through VPN vs bypassed | **Premium** |
68-
| **CLI Interface** | Command-line control for automation | **Premium** |
69-
| **API/Webhooks** | Integration with other tools | **Enterprise** |
70-
| **Statistics Dashboard** | Detailed analytics and history | **Premium** |
71-
| **Traffic Verification** | Verify traffic actually goes through correct interface | **Premium** |
72-
73-
### Phase 4: Enterprise & Advanced (v3.0+)
74-
**Timeline: 12+ months**
75-
76-
| Feature | Description | Tier |
77-
|---------|-------------|------|
78-
| **Multi-device Sync** | Sync settings across devices via iCloud | **Premium** |
79-
| **MDM Support** | Enterprise deployment and management | **Enterprise** |
80-
| **Policy Templates** | Pre-built configs for common scenarios | **Enterprise** |
81-
| **Audit Logging** | Detailed logs for compliance | **Enterprise** |
82-
| **Custom Branding** | White-label for enterprises | **Enterprise** |
83-
| **Priority Support** | Dedicated support channel | **Enterprise** |
62+
### Phase 2: Advanced Routing (v2.0 - v2.5)
63+
64+
| Feature | Description |
65+
|---------|-------------|
66+
| **App-based Routing** | Bypass VPN for specific apps (Safari, Chrome, Spotify app) |
67+
| **Inverse Mode** | Route ONLY specific traffic through VPN, bypass everything else |
68+
| **Kill Switch** | Block all traffic if VPN disconnects unexpectedly |
69+
| **DNS Leak Protection** | Ensure DNS queries don't leak through VPN |
70+
| **IPv6 Leak Protection** | Block IPv6 to prevent leaks |
71+
| **Connection Profiles** | Different configs for "Home", "Work", "Travel" |
72+
| **Scheduled Rules** | Auto-enable/disable bypasses based on time |
73+
| **Local DNS Proxy** | Run local DNS that uses ISP DNS for bypass domains |
74+
75+
### Phase 3: Power Features (v3.0+)
76+
77+
| Feature | Description |
78+
|---------|-------------|
79+
| **Custom DNS** | Use specific DNS servers for bypassed traffic (DoH/DoT) |
80+
| **Blocklists Integration** | Block ads/trackers/malware domains |
81+
| **Network-based Profiles** | Auto-switch profile based on WiFi SSID |
82+
| **Bandwidth Monitor** | Track data through VPN vs bypassed |
83+
| **CLI Interface** | Command-line control for automation |
84+
| **API/Webhooks** | Integration with other tools |
85+
| **Statistics Dashboard** | Detailed analytics and history |
86+
| **Traffic Verification** | Verify traffic actually goes through correct interface |
87+
88+
### Phase 4: Advanced (v4.0+)
89+
90+
| Feature | Description |
91+
|---------|-------------|
92+
| **Multi-device Sync** | Sync settings across devices via iCloud |
93+
| **MDM Support** | Deployment and management for organizations |
94+
| **Policy Templates** | Pre-built configs for common scenarios |
95+
| **Audit Logging** | Detailed logs for compliance |
8496

8597
---
8698

@@ -91,78 +103,15 @@
91103
2. ✅ **Static IP Ranges** - Services like Telegram have known ranges
92104
3. ✅ **Hosts File** - Local DNS override, immune to VPN DNS hijacking
93105
4. ✅ **Auto DNS Refresh** - Catches IP changes within 1 hour
106+
5. ✅ **DNS Disk Cache** - Instant startup + fallback when DNS fails
107+
6. ✅ **DoH/DoT Fallback** - Bypasses VPN DNS hijacking via encrypted DNS
108+
7. ✅ **SOCKS5 Proxy** - Aggressive bypass when VPN blocks UDP
94109

95110
### Future Protection Layers
96-
5. 🔲 **ASN Routing** - Route all IPs owned by a service
97-
6. 🔲 **Multiple DNS** - Query Google + Cloudflare for redundancy
98-
7. 🔲 **Local DNS Proxy** - Intercept and resolve locally
99-
8. 🔲 **Traffic Verification** - Confirm correct interface usage
100-
101-
---
102-
103-
## Feature Tiers
104-
105-
### 🆓 Free Tier
106-
Core functionality for individual users:
107-
- VPN detection and status display
108-
- Up to **5 custom domains**
109-
- Up to **3 pre-configured services**
110-
- Basic route management
111-
- Activity logs (last 24 hours)
112-
- Community support
113-
114-
### 💎 Premium Tier ($9.99 one-time or $4.99/year)
115-
Full power for power users:
116-
- **Unlimited** domains and services
117-
- App-based routing (bypass specific apps)
118-
- Inverse mode (route only specific traffic)
119-
- Kill switch and leak protection
120-
- Connection profiles
121-
- Custom DNS for bypassed traffic
122-
- Scheduled rules
123-
- Unlimited log history
124-
- Email support
125-
126-
### 🏢 Enterprise Tier ($49/year per seat)
127-
For teams and organizations:
128-
- Everything in Premium
129-
- Multi-device sync
130-
- MDM/deployment support
131-
- Policy templates
132-
- Audit logging
133-
- API access
134-
- Priority support
135-
- Custom branding option
136-
137-
---
138-
139-
## Licensing Implementation Options
140-
141-
### Option 1: Gumroad (Simplest)
142-
- One-time purchase with license key
143-
- User enters key in Settings
144-
- App validates key via Gumroad API
145-
- Pros: Easy to set up, handles payments
146-
- Cons: No subscription management built-in
147-
148-
### Option 2: LemonSqueezy (Modern)
149-
- Supports one-time and subscriptions
150-
- Built-in license key generation
151-
- Webhook support for real-time validation
152-
- Pros: Modern API, good for subscriptions
153-
- Cons: Newer platform
154-
155-
### Option 3: Paddle (Professional)
156-
- Full-featured payment platform
157-
- Handles taxes globally
158-
- Mac App Store alternative
159-
- Pros: Professional, handles compliance
160-
- Cons: More complex setup
161-
162-
### Recommended Approach
163-
1. **Start with Gumroad** for quick launch
164-
2. Migrate to **LemonSqueezy** when you need subscriptions
165-
3. Consider **Paddle** for enterprise/international
111+
8. 🔲 **ASN Routing** - Route all IPs owned by a service
112+
9. 🔲 **Multiple DNS** - Query Google + Cloudflare for redundancy
113+
10. 🔲 **Local DNS Proxy** - Intercept and resolve locally
114+
11. 🔲 **Traffic Verification** - Confirm correct interface usage
166115

167116
---
168117

@@ -181,27 +130,59 @@ For teams and organizations:
181130
3. **Beautiful UI** - Modern SwiftUI interface
182131
4. **No VPN Required** - Works with ANY VPN, not tied to a provider
183132
5. **Privacy-focused** - No analytics, no cloud dependency
184-
6. **Defense-in-Depth** - Routes + Hosts + Auto-refresh for maximum protection
133+
6. **Defense-in-Depth** - Routes + Hosts + DoH + SOCKS5 + Auto-refresh for maximum protection
134+
7. **Instant Startup** - DNS cache enables routes in seconds, not minutes
135+
136+
---
137+
138+
## Community & Visibility
139+
140+
### Awesome Lists
141+
142+
| List | Stars | Status |
143+
|------|-------|--------|
144+
| [serhii-londar/open-source-mac-os-apps](https://github.com/serhii-londar/open-source-mac-os-apps) | 47.7k | ✅ Listed |
145+
| [jaywcjlove/awesome-mac](https://github.com/jaywcjlove/awesome-mac) | 99.5k | PR submitted |
146+
| [dkhamsing/open-source-ios-apps](https://github.com/dkhamsing/open-source-ios-apps) | 49k | PR submitted |
147+
| [matteocrippa/awesome-swift](https://github.com/matteocrippa/awesome-swift) | 26k | PR submitted |
148+
| [jaywcjlove/awesome-swift-macos-apps](https://github.com/jaywcjlove/awesome-swift-macos-apps) | 1.2k | PR submitted |
149+
| [phmullins/awesome-macos](https://github.com/phmullins/awesome-macos) | 3k | PR submitted |
150+
151+
### Other Channels
152+
153+
| Channel | Type | Notes |
154+
|---------|------|-------|
155+
| **Hacker News** | Show HN post | High-impact if it hits front page |
156+
| **Reddit** | r/macapps, r/opensource, r/swift | r/macapps is the most targeted audience |
157+
| **Product Hunt** | Product launch | Good for long-term discoverability |
158+
| **AlternativeTo** | List as alternative to split-tunnel VPNs | Passive SEO traffic |
159+
| **Lobste.rs** | Show post | Dev-heavy audience (invite required) |
160+
| **Swift Forums** | forums.swift.org | "Built with SwiftUI" showcase angle |
161+
| **Dev.to / Medium** | Technical write-up | Split tunneling, route management, SwiftUI |
162+
| **MacStories** | Email tips line | They cover Mac utilities |
163+
| **Homebrew core cask** | Move from tap to homebrew-cask | Massively increases `brew search` discoverability |
164+
| **MacUpdate** | App listing | Still gets traffic for Mac app searches |
165+
| **Slant** | Q&A recommendation | "Best VPN tools for macOS" |
185166

186167
---
187168

188169
## Next Steps
189170

190-
1. ✅ **v1.1**: Completed - notifications, helper, DNS refresh, loading states
191-
2. 🔲 **v1.2**: Config migration, ASN routing, Homebrew tap
192-
3. 🔲 **v1.3**: Implement license system (Gumroad)
193-
4. 🔲 **v1.4**: Add app-based routing (Premium)
194-
5. 🔲 **v1.5**: Add kill switch + leak protection (Premium)
171+
1. ✅ **v1.0 - v1.2**: Core features, notifications, helper, Homebrew
172+
2. ✅ **v1.3 - v1.6**: Performance overhaul, instant startup, DoH/DoT, DNS cache
173+
3. ✅ **v1.7 - v1.9**: VPN compatibility (Check Point, Zscaler, Tailscale), gateway robustness, auto-merge
174+
4. 🔲 **v2.0**: Implement license system + app-based routing (Premium)
175+
5. 🔲 **v2.5**: Kill switch + leak protection + connection profiles (Premium)
176+
6. 🔲 **v3.0**: CLI interface + network profiles + statistics
195177

196178
---
197179

198180
## Technical Debt / Known Issues
199181

200-
- [x] Config migration: new default services don't auto-merge into existing user config
201182
- [ ] Helper installation can fail silently on some systems
202183
- [ ] Route verification unreliable (many servers block ICMP)
203-
- [ ] Homebrew Cask not published to a tap yet
184+
- [ ] No automated UI tests
204185

205186
---
206187

207-
*Last updated: January 17, 2026*
188+
*Last updated: March 4, 2026*

0 commit comments

Comments
 (0)