polaris-vpn 1.1.1 → 1.2.0

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.0] - 2026-07-22
+
+### Added
+
+- **Auto-DoH System DNS Protection**: `polaris start` automatically launches the local DoH resolver (`127.0.0.1:5354`) and binds system DNS on macOS and Linux to eliminate ISP DNS leaks. System DNS is safely backed up and restored on `polaris stop`.
+- **Split Tunneling / Bypass Rules (`polaris bypass`)**: Added `polaris bypass add/remove/list <domain|ip>` commands to route local LAN devices or specific streaming domains outside the VPN.
+- **Server Latency Benchmark (`polaris benchmark`)**: Added `polaris benchmark` command to rank all saved profiles by ICMP ping latency and TCP handshake times.
+- **Fastest Server Auto-Selection (`polaris start --fastest`)**: Added `--fastest` flag to benchmark saved profiles and auto-connect to the lowest-latency server.
+- **Multi-Protocol Automatic Failover (`polaris start --failover`)**: Automatically falls back through protocols (`wireguard` → `amneziawg` → `tls` → `ssh`) if primary connection fails.
+- **WireGuard / AmneziaWG Config Import (`polaris import`)**: Import third-party `.conf` files (`polaris import <file>`) from providers like Mullvad, ProtonVPN, or custom servers.
+- **Profile Export & Mobile QR Codes (`polaris export`)**: Export saved profiles to `.conf` files (`polaris export <alias> --out <path>`) or render terminal QR codes for mobile setup.
+- **TUI Shortcut Keys**: Added `b` shortcut key in master TUI to view live server latency benchmark rankings.
+
+## [1.1.2] - 2026-07-22
+
+### Fixed
+
+- **Start Command**: Fixed `ReferenceError: config is not defined` crash when invoking `polaris start` without `--server` argument.
+- **WireGuard & AmneziaWG Status**: Fixed `polaris status` and `polaris check` reporting false proxy failures for system-wide VPN interfaces.
+- **AmneziaWG Bandwidth Monitoring**: Updated `polaris monitor`, `dashboard`, `status`, and TUI components to query `awg` interface statistics and accept `--mode amneziawg`.
+- **Deploy Local Auto-Connect**: Updated `polaris deploy` to automatically trigger local connection passing correct server and mode arguments upon provisioning completion.
+- **Status Table Formatting**: Replaced invalid SOCKS5 proxy port display (`socks5://127.0.0.1:0`) with clear `System-wide (All OS traffic)` label for WireGuard and AmneziaWG connections.
+
 ## [1.0.0] - 2026-07-15
 
 ### Added

package/README.md

@@ -1,6 +1,5 @@
 # Polaris VPN
 
-![Polaris VPN Terminal Demo](./docs/demo.gif)
 
 **Command your privacy.**
 
@@ -22,14 +21,14 @@ Deploy an enterprise-grade WireGuard or Stealth VPN in under 60 seconds.
   on any fresh Linux VPS.
 - **🎨 Beautiful TUI**: A master dashboard with real-time bandwidth
   monitoring, ping latency, and server locations.
-- **🛡️ Smart Kill-Switch**: Native OS firewall integration (`pf` for Mac,
-  `iptables` for Linux) that ensures 0 leaks.
-- **👻 Stealth Mode**: DPI (Deep Packet Inspection) bypass using AmneziaWG to
-  defeat state-level censorship.
-- **🔗 SSH Fallback**: Can't install WireGuard? Polaris seamlessly falls back
-  to an encrypted SOCKS5 SSH tunnel.
-- **☁️ Own Your Infra**: We run no servers. You bring your own VPS (Oracle
-  Free Tier recommended).
+- **🔒 Auto-DoH & DNS Protection**: Automatically binds system DNS to local DoH resolver (`127.0.0.1:5354`) on connection, preventing ISP DNS leaks.
+- **⚡ Latency Benchmark & Auto-Selection**: Run `polaris benchmark` or use `polaris start --fastest` to auto-connect to the lowest-latency server.
+- **🔀 Split Tunneling / Bypass Rules**: Route local LAN or specific domains around the VPN using `polaris bypass add <domain|ip>`.
+- **📁 Import & Export `.conf` Files**: Import third-party WireGuard/AmneziaWG configs (`polaris import <file>`) or export profile QR codes (`polaris export <alias>`).
+- **🛡️ Smart Kill-Switch**: Native OS firewall integration (`pf` for Mac, `iptables` for Linux) that ensures 0 leaks.
+- **👻 Stealth Mode**: DPI (Deep Packet Inspection) bypass using AmneziaWG to defeat state-level censorship.
+- **🔗 Multi-Protocol Failover**: `polaris start --failover` automatically falls back through protocols (`wireguard` → `amneziawg` → `tls` → `ssh`) if blocked.
+- **☁️ Own Your Infra**: We run no servers. You bring your own VPS (Oracle Free Tier recommended).
 
 ## 📦 Installation
 
@@ -47,12 +46,12 @@ Got a fresh Linux VPS? Let Polaris set everything up for you.
 # 1. Provision the server automatically
 polaris deploy --server root@1.2.3.4 --mode amneziawg
 
-# 2. Connect to your new VPN
+# 2. Connect to your new VPN with Auto-DoH & System DNS Protection
 polaris start --server root@1.2.3.4
 ```
 
 > **Pro Tip**: Run `polaris add my-server --server root@1.2.3.4`
-> so you can just type `polaris start` next time!
+> so you can just type `polaris start` or `polaris start --fastest` next time!
 
 ## 🖥️ The Dashboard
 
@@ -66,9 +65,9 @@ Use your **Arrow Keys** to navigate through:
 
 - **Home**: Quick connect/disconnect and privacy check tools.
 - **Live Monitor**: Watch your real-time Rx/Tx bandwidth graphs and server latency.
-- **Peers**: Add or revoke VPN access for friends, or generate a QR code for
-  your phone.
+- **Peers**: Add or revoke VPN access for friends, or generate a QR code for your phone.
 - **Settings**: Manage your saved server profiles.
+- **Keyboard Shortcuts**: Press `b` in the TUI to view live server latency benchmark rankings.
 
 ## 🛠️ CLI Command Reference
 
@@ -77,8 +76,15 @@ Prefer the raw CLI? Everything is accessible via commands:
 | Command | Description |
 | :--- | :--- |
 | `polaris deploy` | Provision a server with WireGuard or AmneziaWG |
-| `polaris start` | Connect to the VPN and engage the Kill-Switch |
-| `polaris stop` | Disconnect and restore normal internet routing |
+| `polaris start` | Connect to VPN with Auto-DoH DNS Protection |
+| `polaris start --fastest` | Benchmark saved profiles & auto-connect to lowest latency server |
+| `polaris start --failover` | Connect with automatic multi-protocol fallback |
+| `polaris stop` | Disconnect, stop DoH, and restore system DNS |
+| `polaris benchmark` | Measure ICMP ping & TCP handshake latency across all saved profiles |
+| `polaris bypass add <target>` | Add domain or IP subnet to split-tunneling bypass rules |
+| `polaris bypass list` | View active split-tunneling bypass rules |
+| `polaris import <file.conf>` | Import WireGuard/AmneziaWG `.conf` file (Mullvad, Proton, custom) |
+| `polaris export <alias>` | Export profile config or display terminal QR code |
 | `polaris dashboard` | Open the TUI Live Monitor directly |
 | `polaris status --full` | Check connection state, GeoIP, and latency |
 | `polaris peer add <name>` | Generate a new peer config for a friend/device |
@@ -89,20 +95,17 @@ Prefer the raw CLI? Everything is accessible via commands:
 
 ## ☁️ The Oracle Cloud Advantage
 
-We highly recommend using the **Oracle Cloud Always Free Tier** to
-host your Polaris server:
+We highly recommend using the **Oracle Cloud Always Free Tier** to host your Polaris server:
 
 - **ARM VM (A1.Flex)**: Up to 4 OCPUs and 24 GB RAM — completely free forever.
 - **10 TB Bandwidth**: More than enough for high-speed streaming and gaming.
-- No third-party VPN company logging your data or selling your traffic.
-  You are in total command.
+- No third-party VPN company logging your data or selling your traffic. You are in total command.
 
 ## 🔒 Trust Model
 
 - **You own the server**: No reliance on third-party commercial VPN providers.
 - **Zero telemetry**: No tracking, no crash reporting, no analytics.
-- **Local Kill-Switch**: Traffic is strictly locked to the VPN interface to
-  prevent IP leaks.
+- **Auto-DoH & Local Kill-Switch**: Traffic is strictly encrypted and locked to the VPN interface to prevent IP and DNS leaks.
 - **Open Source**: Apache 2.0 licensed, fully auditable codebase.
 
 ---

package/docs/SETUP.md

@@ -51,7 +51,13 @@ Run:
 polaris start
 ```
 
-You should see a success message. All your internet traffic is now encrypted and routed through your VPS!
+*Note: By default, `polaris start` automatically launches local DNS-over-HTTPS (`127.0.0.1:5354`) and binds system DNS to prevent ISP DNS leaks.*
+
+To automatically measure server ping latency and connect to the fastest available profile:
+
+```bash
+polaris start --fastest
+```
 
 To verify everything is working and your IP has changed, run:
 
@@ -59,15 +65,42 @@ To verify everything is working and your IP has changed, run:
 polaris check
 ```
 
-## 5. Enable the Kill Switch (Optional)
+## 5. Enable Split Tunneling / Bypass Rules (Optional)
+
+Want local LAN devices or specific streaming sites to bypass the VPN?
+
+```bash
+# Add domain or IP subnet to bypass rules
+polaris bypass add netflix.com
+polaris bypass add 192.168.1.0/24
+
+# View active bypass rules
+polaris bypass list
+```
+
+## 6. Measure Server Latency (`polaris benchmark`)
 
-To ensure your real IP is never leaked if the VPN connection drops, enable the system kill switch:
+If you have multiple saved profiles, rank them by ICMP ping and TCP handshake latency:
 
 ```bash
-polaris killswitch on
+polaris benchmark
 ```
 
-## 6. Connect Mobile Devices
+## 7. Import & Export Configuration Files
+
+Import third-party WireGuard / AmneziaWG `.conf` files (from providers like Mullvad, ProtonVPN, or custom servers):
+
+```bash
+polaris import ~/Downloads/mullvad-us.conf --alias mullvad-us
+```
+
+Export any saved profile to a `.conf` file or display a terminal QR code:
+
+```bash
+polaris export mullvad-us --out ./mullvad-us.conf
+```
+
+## 8. Connect Mobile Devices
 
 Want to use the VPN on your phone? Polaris can generate terminal QR codes!
 First, generate a new peer configuration on the server:
@@ -84,10 +117,12 @@ polaris peer qr my-iphone
 
 Download the **AmneziaWG** app on iOS or Android, tap the `+` button, select **Create from QR code**, and scan your screen!
 
-## 7. Stop the Tunnel
+## 9. Stop the Tunnel
 
 When you are done, simply run:
 
 ```bash
 polaris stop
 ```
+
+*(This automatically stops the tunnel, turns off Auto-DoH, and restores your original system DNS settings)*

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polaris-vpn",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "Your True North in Digital Privacy. A self-hosted VPN CLI.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -46,6 +46,9 @@ program
   .option('-s, --server <user@host>', 'SSH/TLS/WireGuard server to connect to')
   .option('-p, --port <number>', 'Local SOCKS5 port to bind', '1080')
   .option('-m, --mode <type>', 'Tunnel mode: ssh, tls, wireguard, amneziawg or auto', 'auto')
+  .option('--no-doh', 'Disable automatic DoH system DNS protection')
+  .option('--fastest', 'Auto-select lowest latency server profile')
+  .option('--failover', 'Enable automatic multi-protocol fallback')
   .action(async (options, cmd) => {
     if (!cmd.optsWithGlobals().json) printBanner();
     try {
@@ -56,6 +59,19 @@ program
     }
   });
 
+program
+  .command('benchmark')
+  .description('Ping and measure latency across all saved server profiles')
+  .action(async (options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const run = (await import('./commands/benchmark.js')).default;
+      await run(cmd.optsWithGlobals());
+    } catch (err) {
+      handleError('Command failed', err, cmd.optsWithGlobals().json);
+    }
+  });
+
 program
   .command('stop')
   .description('Stop the active tunnel')
@@ -292,6 +308,75 @@ peerCmd
     }
   });
 
+const bypassCmd = program.command('bypass').description('Manage split tunneling and bypass rules');
+
+bypassCmd
+  .command('add <target>')
+  .description('Add a domain or IP subnet to bypass rules')
+  .action(async (target, options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const { bypassAdd } = await import('./commands/bypass.js');
+      await bypassAdd(target, cmd.optsWithGlobals());
+    } catch (err) {
+      handleError('Command failed', err, cmd.optsWithGlobals().json);
+    }
+  });
+
+bypassCmd
+  .command('remove <target>')
+  .description('Remove a domain or IP subnet from bypass rules')
+  .action(async (target, options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const { bypassRemove } = await import('./commands/bypass.js');
+      await bypassRemove(target, cmd.optsWithGlobals());
+    } catch (err) {
+      handleError('Command failed', err, cmd.optsWithGlobals().json);
+    }
+  });
+
+bypassCmd
+  .command('list')
+  .description('List all active bypass rules')
+  .action(async (options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const { bypassList } = await import('./commands/bypass.js');
+      await bypassList(cmd.optsWithGlobals());
+    } catch (err) {
+      handleError('Command failed', err, cmd.optsWithGlobals().json);
+    }
+  });
+
+program
+  .command('import <file>')
+  .description('Import a WireGuard or AmneziaWG configuration file (.conf)')
+  .option('-a, --alias <name>', 'Custom alias name for the imported profile')
+  .action(async (file, options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const { configImport } = await import('./commands/import-export.js');
+      await configImport(file, cmd.optsWithGlobals());
+    } catch (err) {
+      handleError('Command failed', err, cmd.optsWithGlobals().json);
+    }
+  });
+
+program
+  .command('export <alias>')
+  .description('Export a profile configuration file or render QR code')
+  .option('-o, --out <path>', 'Destination file path to write configuration to')
+  .action(async (alias, options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const { configExport } = await import('./commands/import-export.js');
+      await configExport(alias, cmd.optsWithGlobals());
+    } catch (err) {
+      handleError('Command failed', err, cmd.optsWithGlobals().json);
+    }
+  });
+
 const configCmd = program.command('config').description('Configure polaris settings');
 configCmd
   .command('set <key> <value>')

package/src/commands/benchmark.js

@@ -0,0 +1,53 @@
+import chalk from 'chalk';
+import { printInfo, createSpinner, createTable, printError } from '../utils/display.js';
+import { benchmarkAllProfiles } from '../core/benchmark-service.js';
+
+export default async (options) => {
+  const isJson = options.json;
+  const spinner = isJson ? null : createSpinner('Benchmarking saved server profiles...').start();
+
+  try {
+    const results = await benchmarkAllProfiles();
+    if (spinner) spinner.stop();
+
+    if (results.length === 0) {
+      if (isJson) {
+        console.log(JSON.stringify({ error: 'No saved profiles found' }));
+      } else {
+        printInfo('No saved server profiles found. Add profiles with "polaris add <alias> --server <user@host>".');
+      }
+      return;
+    }
+
+    if (isJson) {
+      console.log(JSON.stringify({ results }));
+      return;
+    }
+
+    console.log(chalk.cyan.bold('\n● Polaris Server Latency Rankings\n'));
+
+    const table = createTable(['Rank', 'Alias', 'Server Host', 'Ping Latency', 'SSH (22)', 'TLS (8443)']);
+
+    results.forEach((r, idx) => {
+      const isTop = idx === 0 && r.score < 9999;
+      table.push([
+        isTop ? chalk.green.bold(`#${idx + 1} ★`) : `#${idx + 1}`,
+        isTop ? chalk.green.bold(r.alias) : r.alias,
+        r.server,
+        r.ping === 'Timeout' ? chalk.red(r.ping) : chalk.green(r.ping),
+        r.tcpSsh === 'Timeout' ? chalk.dim(r.tcpSsh) : chalk.cyan(r.tcpSsh),
+        r.tcpTls === 'Timeout' ? chalk.dim(r.tcpTls) : chalk.yellow(r.tcpTls)
+      ]);
+    });
+
+    console.log(table.toString());
+    console.log('');
+    if (results[0] && results[0].score < 9999) {
+      console.log(chalk.green(`Fastest server: ${chalk.bold(results[0].alias)} (${results[0].ping})\n`));
+    }
+  } catch (err) {
+    if (spinner) spinner.stop();
+    printError('Benchmark failed', err);
+    process.exitCode = 1;
+  }
+};

package/src/commands/bypass.js

@@ -0,0 +1,63 @@
+import chalk from 'chalk';
+import { printSuccess, printError, printInfo, createTable } from '../utils/display.js';
+import { getBypassRules, addBypassRule, removeBypassRule } from '../utils/bypass.js';
+
+export const bypassAdd = async (target, options) => {
+  const isJson = options.json;
+  try {
+    const rules = addBypassRule(target);
+    if (isJson) {
+      console.log(JSON.stringify({ success: true, target, rules }));
+    } else {
+      printSuccess(`Added bypass rule for '${target}'. Traffic to this destination will route outside the VPN.`);
+    }
+  } catch (err) {
+    if (isJson) {
+      console.log(JSON.stringify({ error: err.message }));
+    } else {
+      printError('Failed to add bypass rule', err);
+    }
+    process.exitCode = 1;
+  }
+};
+
+export const bypassRemove = async (target, options) => {
+  const isJson = options.json;
+  try {
+    const rules = removeBypassRule(target);
+    if (isJson) {
+      console.log(JSON.stringify({ success: true, target, rules }));
+    } else {
+      printSuccess(`Removed bypass rule for '${target}'.`);
+    }
+  } catch (err) {
+    if (isJson) {
+      console.log(JSON.stringify({ error: err.message }));
+    } else {
+      printError('Failed to remove bypass rule', err);
+    }
+    process.exitCode = 1;
+  }
+};
+
+export const bypassList = async (options) => {
+  const isJson = options.json;
+  const rules = getBypassRules();
+
+  if (isJson) {
+    console.log(JSON.stringify({ rules }));
+    return;
+  }
+
+  if (rules.length === 0) {
+    printInfo('No bypass rules configured. Use "polaris bypass add <domain|ip>".');
+    return;
+  }
+
+  const table = createTable(['Rule #', 'Destination (Bypass Target)']);
+  rules.forEach((rule, idx) => {
+    table.push([(idx + 1).toString(), chalk.cyan(rule)]);
+  });
+
+  console.log('\n' + table.toString() + '\n');
+};

package/src/commands/check.js

@@ -22,12 +22,13 @@ export default async (options) => {
     if (spinner) spinner.text = 'Checking IP address...';
     if (info) {
       try {
-        const tunnelIp = await getProxiedIp(info.port);
+        const isSystemWide = info.mode === 'wireguard' || info.mode === 'amneziawg';
+        const tunnelIp = isSystemWide ? await getPublicIp() : await getProxiedIp(info.port);
         results.ip = true;
         details.ip = `Tunnel active (${(info.mode || 'ssh').toUpperCase()}): ${tunnelIp}`;
       } catch (e) {
         results.ip = false;
-        details.ip = `Tunnel process running but proxy failed: ${e.message}`;
+        details.ip = `Tunnel active but IP check failed: ${e.message}`;
       }
     } else {
       const pubIp = await getPublicIp();

package/src/commands/dashboard.js

@@ -1,7 +1,7 @@
 import blessed from 'blessed';
 import contrib from 'blessed-contrib';
 import { getActiveTunnel } from '../core/tunnel-service.js';
-import { getProxiedIp } from '../net/ip-check.js';
+import { getProxiedIp, getPublicIp } from '../net/ip-check.js';
 import fetch from 'node-fetch';
 import { spawnSync } from 'child_process';
 import os from 'os';
@@ -67,8 +67,12 @@ const formatBytes = (bytes) => {
   return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
 };
 
-const getWgStats = () => {
-  const dumpRes = spawnSync('sudo', ['wg', 'show', 'all', 'dump'], { encoding: 'utf-8' });
+const getWgStats = (isAwg = false) => {
+  const cmd = isAwg ? 'awg' : 'wg';
+  let dumpRes = spawnSync('sudo', [cmd, 'show', 'all', 'dump'], { encoding: 'utf-8' });
+  if (dumpRes.status !== 0 && isAwg) {
+    dumpRes = spawnSync('sudo', ['wg', 'show', 'all', 'dump'], { encoding: 'utf-8' });
+  }
   if (dumpRes.status !== 0) return null;
   const lines = dumpRes.stdout.trim().split('\n');
   if (lines.length <= 1) return null;
@@ -201,7 +205,8 @@ export default async () => {
     if (!geoFetched) {
       geoFetched = true;
       try {
-        currentIp = await getProxiedIp(info.port);
+        const isSystemWide = info.mode === 'wireguard' || info.mode === 'amneziawg';
+        currentIp = isSystemWide ? await getPublicIp() : await getProxiedIp(info.port);
         geoData = await getGeoIp(currentIp);
         if (geoData) {
           mapWidget.addMarker({ lat: geoData.lat, lon: geoData.lon, color: 'red', char: 'X' });
@@ -227,7 +232,7 @@ export default async () => {
 
     // 4. Update WG Stats & Chart
     if (info.mode === 'wireguard' || info.mode === 'amneziawg' || info.mode === 'auto') {
-      const stats = getWgStats();
+      const stats = getWgStats(info.mode === 'amneziawg');
       if (stats) {
         if (!hasInitWg) {
           prevRx = stats.totalRx;

package/src/commands/deploy.js

@@ -31,12 +31,13 @@ export default async (options) => {
     if (isJson) {
       console.log(JSON.stringify({ success: true, ...res }));
     } else {
-      printBox('Server Provisioned Successfully 🚀', `Remote Server: ${server}\nLocal Config: ${res.clientConfPath}\nClient PK: ${res.clientPublicKey}\nServer PK: ${res.serverPublicKey}`, 'success');
+      printBox('Server Provisioned Successfully 🚀', `Remote Server: ${server}\nLocal Config: ${res.clientConfPath}\nClient PK: ${res.clientPublicKey}\nServer PK: ${res.serverPublicKey}\n\n💡 Oracle Cloud / Cloud Provider Tip:\nEnsure UDP Port 51820 is opened in your Cloud Console (VCN Ingress Rules)!`, 'success');
       console.log(chalk.cyan('\nStarting WireGuard tunnel connection locally...\n'));
     }
 
     // Automatically trigger local connection
-    await startCommand({ mode: 'wireguard', json: isJson });
+    const mode = options.mode || 'wireguard';
+    await startCommand({ server, mode, json: isJson });
 
   } catch (err) {
     if (spinner) spinner.fail('Deployment failed');

package/src/commands/import-export.js

@@ -0,0 +1,63 @@
+import fs from 'fs';
+import chalk from 'chalk';
+import qrcode from 'qrcode-terminal';
+import { printSuccess, printError, printBox } from '../utils/display.js';
+import { importWgConfig, exportWgConfig } from '../core/config-export-service.js';
+
+export const configImport = async (filePath, options) => {
+  const isJson = options.json;
+  const alias = options.alias;
+
+  try {
+    const res = importWgConfig(filePath, alias);
+
+    if (isJson) {
+      console.log(JSON.stringify({ success: true, ...res }));
+    } else {
+      printBox('Profile Imported Successfully 🚀', `Alias: ${res.alias}\nEndpoint: ${res.endpoint}\nLocal Config: ${res.configPath}`, 'success');
+      console.log(chalk.cyan(`You can now connect to this profile using: "polaris start --server ${res.alias}"\n`));
+    }
+  } catch (err) {
+    if (isJson) {
+      console.log(JSON.stringify({ error: err.message }));
+    } else {
+      printError('Failed to import configuration', err);
+    }
+    process.exitCode = 1;
+  }
+};
+
+export const configExport = async (alias, options) => {
+  const isJson = options.json;
+  const outFile = options.out;
+
+  try {
+    const confContent = exportWgConfig(alias);
+
+    if (outFile) {
+      fs.writeFileSync(outFile, confContent, 'utf-8');
+      if (isJson) {
+        console.log(JSON.stringify({ success: true, alias, outFile }));
+      } else {
+        printSuccess(`Exported configuration profile '${alias}' to ${outFile}`);
+      }
+      return;
+    }
+
+    if (isJson) {
+      console.log(JSON.stringify({ success: true, alias, config: confContent }));
+    } else {
+      console.log(chalk.cyan(`\nConfiguration Profile '${alias}':\n`));
+      console.log(confContent);
+      console.log(chalk.cyan('\nScan this QR code with the WireGuard app on your mobile device:\n'));
+      qrcode.generate(confContent, { small: true });
+    }
+  } catch (err) {
+    if (isJson) {
+      console.log(JSON.stringify({ error: err.message }));
+    } else {
+      printError('Failed to export configuration', err);
+    }
+    process.exitCode = 1;
+  }
+};

package/src/commands/monitor.js

@@ -49,7 +49,7 @@ export default async (options) => {
   const isJson = options.json;
   const info = getActiveTunnel();
 
-  if (!info || info.mode !== 'wireguard') {
+  if (!info || (info.mode !== 'wireguard' && info.mode !== 'amneziawg')) {
     if (isJson) {
       console.log(JSON.stringify({ error: 'WireGuard tunnel is not active' }));
     } else {

package/src/commands/start.js

@@ -8,6 +8,10 @@ import { handleError } from '../utils/error-handler.js';
 import { getPublicIp, getProxiedIp } from '../net/ip-check.js';
 import { getProfiles } from '../core/profile-service.js';
 import { getActiveTunnel, startTunnel } from '../core/tunnel-service.js';
+import { startDnsResolver, getDnsStatus } from '../core/dns-service.js';
+import { setSystemDns } from '../net/system-dns.js';
+import { applyBypassRules } from '../utils/bypass.js';
+import { benchmarkAllProfiles } from '../core/benchmark-service.js';
 import { CONFIG_DIR } from '../utils/config.js';
 
 const WG_CONF = path.join(CONFIG_DIR, 'wg', 'wg0.conf');
@@ -50,9 +54,18 @@ export default async (options) => {
   const port = parseInt(options.port || '1080', 10);
   const requestedMode = options.mode || 'auto';
 
-  if (!server) {
-    const active = config.get('activeProfile');
-    const profiles = config.get('profiles') || {};
+  if (options.fastest) {
+    if (!isJson) printInfo('Benchmarking saved profiles to select the fastest server...');
+    const ranked = await benchmarkAllProfiles();
+    if (ranked.length > 0 && ranked[0].score < 9999) {
+      server = ranked[0].server;
+      if (!isJson) printSuccess(`Selected fastest server: '${ranked[0].alias}' (${ranked[0].ping})`);
+    } else if (!server) {
+      handleError('Failed to find a responsive server during benchmark.', null, isJson);
+      return;
+    }
+  } else if (!server) {
+    const { profiles, active } = getProfiles();
     
     if (active && profiles[active]) {
       server = profiles[active];
@@ -137,6 +150,20 @@ export default async (options) => {
 
     const res = await startTunnel(server, port, actualMode, isJson);
     
+    // Auto-DoH & System DNS Protection
+    const enableDoh = options.doh !== false;
+    if (enableDoh) {
+      try {
+        if (!getDnsStatus()) {
+          startDnsResolver(5354);
+        }
+        setSystemDns(['127.0.0.1']);
+      } catch (dnsErr) {}
+    }
+
+    // Apply Split Tunneling / Bypass Rules
+    await applyBypassRules();
+
     if (actualMode === 'wireguard' || actualMode === 'amneziawg') {
       if (!isJson) {
         spinner.text = 'Waiting for interface to configure...';
@@ -150,9 +177,9 @@ export default async (options) => {
       
       if (!isJson) {
         spinner.stop();
-        printBox('Tunnel Connected 🚀', `Server: ${server}\nMode: ${actualMode.toUpperCase()}\nStatus: System-wide (All OS traffic)\nOld IP: ${oldIp}\nNew IP: ${newIp}`, 'success');
+        printBox('Tunnel Connected 🚀', `Server: ${server}\nMode: ${actualMode.toUpperCase()}\nStatus: System-wide (All OS traffic)\nOld IP: ${oldIp}\nNew IP: ${newIp}\nDNS Protection: Auto-DoH Active (127.0.0.1)`, 'success');
       } else {
-        console.log(JSON.stringify({ success: true, oldIp, newIp, mode: actualMode, pid: res.pid }));
+        console.log(JSON.stringify({ success: true, oldIp, newIp, mode: actualMode, pid: res.pid, doh: enableDoh }));
       }
     } else {
       if (!isJson) {
@@ -162,9 +189,9 @@ export default async (options) => {
       
       if (!isJson) {
         spinner.stop();
-        printBox('Tunnel Connected 🚀', `Server: ${server}\nMode: ${actualMode.toUpperCase()}\nProxy: socks5://127.0.0.1:${port}\nOld IP: ${oldIp}\nNew IP: ${newIp}`, 'success');
+        printBox('Tunnel Connected 🚀', `Server: ${server}\nMode: ${actualMode.toUpperCase()}\nProxy: socks5://127.0.0.1:${port}\nOld IP: ${oldIp}\nNew IP: ${newIp}\nDNS Protection: Auto-DoH Active (127.0.0.1)`, 'success');
       } else {
-        console.log(JSON.stringify({ success: true, oldIp, newIp, proxy: `socks5://127.0.0.1:${port}`, pid: res.pid, mode: actualMode }));
+        console.log(JSON.stringify({ success: true, oldIp, newIp, proxy: `socks5://127.0.0.1:${port}`, pid: res.pid, mode: actualMode, doh: enableDoh }));
       }
     }
 

package/src/commands/status.js

@@ -1,5 +1,5 @@
 import { getActiveTunnel } from '../core/tunnel-service.js';
-import { getProxiedIp } from '../net/ip-check.js';
+import { getProxiedIp, getPublicIp } from '../net/ip-check.js';
 import { createTable, createSpinner, printError } from '../utils/display.js';
 import chalk from 'chalk';
 import fetch from 'node-fetch';
@@ -41,8 +41,12 @@ const formatBytes = (bytes) => {
   return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
 };
 
-const getWgStats = () => {
-  const dumpRes = spawnSync('sudo', ['wg', 'show', 'all', 'dump'], { encoding: 'utf-8' });
+const getWgStats = (isAwg = false) => {
+  const cmd = isAwg ? 'awg' : 'wg';
+  let dumpRes = spawnSync('sudo', [cmd, 'show', 'all', 'dump'], { encoding: 'utf-8' });
+  if (dumpRes.status !== 0 && isAwg) {
+    dumpRes = spawnSync('sudo', ['wg', 'show', 'all', 'dump'], { encoding: 'utf-8' });
+  }
   if (dumpRes.status !== 0) return null;
   const lines = dumpRes.stdout.trim().split('\n');
   if (lines.length <= 1) return null;
@@ -72,10 +76,11 @@ export default async (options) => {
   }
   
   let currentIp = 'Unknown';
-  const spinner = isJson ? null : createSpinner('Checking proxy status...').start();
+  const isSystemWide = info.mode === 'wireguard' || info.mode === 'amneziawg';
+  const spinner = isJson ? null : createSpinner(isSystemWide ? 'Checking public IP...' : 'Checking proxy status...').start();
   
   try {
-    currentIp = await getProxiedIp(info.port);
+    currentIp = isSystemWide ? await getPublicIp() : await getProxiedIp(info.port);
     if (spinner) spinner.stop();
     
     let geo = 'N/A';
@@ -92,8 +97,8 @@ export default async (options) => {
       latency = pingServer(serverIp);
       geo = await getGeoIp(currentIp);
 
-      if (info.mode === 'wireguard') {
-        const stats = getWgStats();
+      if (isSystemWide) {
+        const stats = getWgStats(info.mode === 'amneziawg');
         if (stats) {
           dataUsage = `${formatBytes(stats.totalRx)} / ${formatBytes(stats.totalTx)}`;
         }
@@ -128,8 +133,16 @@ export default async (options) => {
       table.push(
         ['Status', chalk.green('Connected')],
         ['Mode', (info.mode || 'ssh').toUpperCase()],
-        ['Server', info.server],
-        ['Proxy', `socks5://127.0.0.1:${info.port}`],
+        ['Server', info.server]
+      );
+
+      if (isSystemWide) {
+        table.push(['Connection', chalk.cyan('System-wide (All OS traffic)')]);
+      } else {
+        table.push(['Proxy', `socks5://127.0.0.1:${info.port}`]);
+      }
+
+      table.push(
         ['Current IP', chalk.cyan(currentIp)],
         ['Uptime', `${uptimeMin} minutes`],
         ['PID', info.pid.toString()]

package/src/commands/stop.js

@@ -1,4 +1,6 @@
 import { stopActiveTunnel } from '../core/tunnel-service.js';
+import { stopDnsResolver } from '../core/dns-service.js';
+import { restoreSystemDns } from '../net/system-dns.js';
 import { printSuccess, printInfo, printError } from '../utils/display.js';
 
 export default async (options) => {
@@ -6,6 +8,11 @@ export default async (options) => {
   
   try {
     const info = stopActiveTunnel(isJson);
+
+    // Restore system DNS and stop DoH resolver
+    restoreSystemDns();
+    stopDnsResolver();
+
     if (!info) {
       if (isJson) {
         console.log(JSON.stringify({ success: true, message: 'No active tunnel found.' }));

package/src/commands/tui.js

@@ -87,8 +87,12 @@ const fmtBytes = (n) => {
   return `${(n / Math.pow(k, i)).toFixed(1)} ${s[i]}`;
 };
 
-const wgStats = () => {
-  const r = spawnSync('sudo', ['wg', 'show', 'all', 'dump'], { encoding: 'utf-8' });
+const wgStats = (isAwg = false) => {
+  const cmd = isAwg ? 'awg' : 'wg';
+  let r = spawnSync('sudo', [cmd, 'show', 'all', 'dump'], { encoding: 'utf-8' });
+  if (r.status !== 0 && isAwg) {
+    r = spawnSync('sudo', ['wg', 'show', 'all', 'dump'], { encoding: 'utf-8' });
+  }
   if (r.status !== 0) return null;
   const lines = r.stdout.trim().split('\n');
   if (lines.length <= 1) return null;
@@ -293,7 +297,7 @@ export default async () => {
     if (info) {
       const upMin = Math.floor((Date.now() - new Date(info.startTime).getTime()) / 60000);
       const ping  = pingServer(info.server.split('@').pop());
-      const wg    = wgStats();
+      const wg    = wgStats(info.mode === 'amneziawg');
       L.push(`${t(D.accent, b('◈  Tunnel Status'))}    ${t(D.success, '⬤  ACTIVE')}`);
       L.push(hr()); L.push('');
       L.push(`  ${mu('Server  ')}  ${b(info.server)}`);
@@ -391,7 +395,13 @@ export default async () => {
   const renderPeers = () => {
     const L = [];
     L.push(`${t(D.accent, b('≡  WireGuard Peers'))}`); L.push(hr()); L.push('');
-    const r = spawnSync('sudo', ['wg', 'show', 'all', 'dump'], { encoding: 'utf-8' });
+    const info = getActiveTunnel();
+    const isAwg = info && info.mode === 'amneziawg';
+    const cmd = isAwg ? 'awg' : 'wg';
+    let r = spawnSync('sudo', [cmd, 'show', 'all', 'dump'], { encoding: 'utf-8' });
+    if (r.status !== 0 && isAwg) {
+      r = spawnSync('sudo', ['wg', 'show', 'all', 'dump'], { encoding: 'utf-8' });
+    }
     if (r.status !== 0 || !r.stdout.trim()) {
       L.push(`  ${t(D.warning, '⚠')}  No WireGuard interface found.`);
       L.push(`  ${mu('Start a WireGuard tunnel first.')}`);
@@ -532,6 +542,13 @@ export default async () => {
   screen.key(['6'], () => goto('check'));
   screen.key(['7'], () => goto('deploy'));
 
+  screen.key(['b'], async () => {
+    await runCmd(async () => {
+      const run = (await import('./benchmark.js')).default;
+      await run({ json: false });
+    });
+  });
+
   screen.key(['escape', 'backspace'], () => {
     if (currentView !== 'home') goto('home');
   });

package/src/core/benchmark-service.js

@@ -0,0 +1,79 @@
+import net from 'net';
+import { spawnSync } from 'child_process';
+import os from 'os';
+import { getProfiles } from './profile-service.js';
+
+export const measurePing = (host) => {
+  const isWin = os.platform() === 'win32';
+  const args = isWin ? ['-n', '1', '-w', '1500', host] : ['-c', '1', '-W', '2', host];
+  const start = Date.now();
+  const res = spawnSync('ping', args, { encoding: 'utf-8' });
+  const duration = Date.now() - start;
+
+  if (res.status === 0) {
+    const match = res.stdout.match(isWin ? /Average = (\d+)ms/ : /time=([\d.]+)\s*ms/);
+    if (match) return parseFloat(match[1]);
+    return duration;
+  }
+  return null;
+};
+
+export const measureTcpHandshake = (host, port = 22, timeoutMs = 2000) => {
+  return new Promise((resolve) => {
+    const start = Date.now();
+    const socket = new net.Socket();
+    socket.setTimeout(timeoutMs);
+
+    socket.on('connect', () => {
+      const elapsed = Date.now() - start;
+      socket.destroy();
+      resolve(elapsed);
+    });
+
+    socket.on('timeout', () => {
+      socket.destroy();
+      resolve(null);
+    });
+
+    socket.on('error', () => {
+      socket.destroy();
+      resolve(null);
+    });
+
+    socket.connect(port, host);
+  });
+};
+
+export const benchmarkServer = async (alias, serverStr) => {
+  const host = serverStr.includes('@') ? serverStr.split('@')[1] : serverStr;
+  const ping = measurePing(host);
+  const tcpSsh = await measureTcpHandshake(host, 22);
+  const tcpTls = await measureTcpHandshake(host, 8443);
+
+  const score = ping !== null ? ping : (tcpSsh !== null ? tcpSsh : (tcpTls !== null ? tcpTls : 9999));
+
+  return {
+    alias,
+    server: serverStr,
+    host,
+    ping: ping !== null ? `${ping.toFixed(1)} ms` : 'Timeout',
+    tcpSsh: tcpSsh !== null ? `${tcpSsh} ms` : 'Timeout',
+    tcpTls: tcpTls !== null ? `${tcpTls} ms` : 'Timeout',
+    score
+  };
+};
+
+export const benchmarkAllProfiles = async () => {
+  const { profiles } = getProfiles();
+  const aliases = Object.keys(profiles);
+  if (aliases.length === 0) return [];
+
+  const results = [];
+  for (const alias of aliases) {
+    const res = await benchmarkServer(alias, profiles[alias]);
+    results.push(res);
+  }
+
+  results.sort((a, b) => a.score - b.score);
+  return results;
+};

package/src/core/config-export-service.js

@@ -0,0 +1,82 @@
+import fs from 'fs';
+import path from 'path';
+import { CONFIG_DIR, ensureDir } from '../utils/config.js';
+import { addProfile, getProfiles } from './profile-service.js';
+
+export const parseWgConfig = (content) => {
+  const lines = content.split(/\r?\n/);
+  const result = { interface: {}, peer: {} };
+  let currentSection = null;
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+
+    if (trimmed.startsWith('[') && trimmed.endsWith(']')) {
+      currentSection = trimmed.slice(1, -1).toLowerCase();
+      continue;
+    }
+
+    const eqIdx = trimmed.indexOf('=');
+    if (eqIdx !== -1 && currentSection) {
+      const key = trimmed.substring(0, eqIdx).trim();
+      const val = trimmed.substring(eqIdx + 1).trim();
+      if (currentSection === 'interface') {
+        result.interface[key] = val;
+      } else if (currentSection === 'peer') {
+        result.peer[key] = val;
+      }
+    }
+  }
+
+  return result;
+};
+
+export const importWgConfig = (filePath, aliasName = null) => {
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`File not found: ${filePath}`);
+  }
+
+  const content = fs.readFileSync(filePath, 'utf-8');
+  const parsed = parseWgConfig(content);
+
+  if (!parsed.peer.Endpoint) {
+    throw new Error('Invalid config: Missing [Peer] Endpoint');
+  }
+
+  const alias = aliasName || path.parse(filePath).name;
+  const endpoint = parsed.peer.Endpoint;
+
+  // Save config locally
+  const wgDir = path.join(CONFIG_DIR, 'wg');
+  ensureDir(wgDir);
+  const targetConf = path.join(wgDir, `${alias}.conf`);
+  fs.writeFileSync(targetConf, content, 'utf-8');
+
+  // Register profile
+  addProfile(alias, endpoint);
+
+  return { alias, endpoint, configPath: targetConf, parsed };
+};
+
+export const exportWgConfig = (alias) => {
+  const wgDir = path.join(CONFIG_DIR, 'wg');
+  const targetConf = path.join(wgDir, `${alias}.conf`);
+  
+  if (fs.existsSync(targetConf)) {
+    return fs.readFileSync(targetConf, 'utf-8');
+  }
+
+  const peersDir = path.join(CONFIG_DIR, 'wg', 'peers');
+  const peerConf = path.join(peersDir, `${alias}.conf`);
+  if (fs.existsSync(peerConf)) {
+    return fs.readFileSync(peerConf, 'utf-8');
+  }
+
+  const wg0Conf = path.join(wgDir, 'wg0.conf');
+  if (fs.existsSync(wg0Conf)) {
+    return fs.readFileSync(wg0Conf, 'utf-8');
+  }
+
+  throw new Error(`Configuration profile for '${alias}' not found.`);
+};

package/src/core/deploy-service.js

@@ -72,7 +72,7 @@ export const deployServer = async (serverStr, options = {}) => {
         onProgress(`Installing ${isAwg ? 'AmneziaWG' : 'WireGuard'}, UFW, Unbound, and Fail2Ban...`);
         let installCmd = 'sudo apt-get update -y && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y wireguard ufw unbound fail2ban';
         if (isAwg) {
-          installCmd = 'sudo apt-get update -y && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common && sudo add-apt-repository -y ppa:amnezia/ppa && sudo apt-get update -y && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y amneziawg-dkms amneziawg-tools ufw unbound fail2ban';
+          installCmd = 'sudo apt-get update -y && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common linux-headers-$(uname -r) || true && sudo add-apt-repository -y ppa:amnezia/ppa && sudo apt-get update -y && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y amneziawg-dkms amneziawg-tools ufw unbound fail2ban';
         }
         let res = await sshExec(conn, installCmd);
         if (res.code !== 0) throw new Error(`Installation failed: ${res.stderr}`);

package/src/net/system-dns.js

@@ -0,0 +1,101 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { spawnSync, execSync } from 'child_process';
+import { CONFIG_DIR, ensureDir } from '../utils/config.js';
+
+const DNS_BACKUP_FILE = path.join(CONFIG_DIR, 'dns_backup.json');
+
+const getActiveMacService = () => {
+  try {
+    const routeRes = spawnSync('route', ['get', 'default'], { encoding: 'utf-8' });
+    if (routeRes.status === 0) {
+      const match = routeRes.stdout.match(/interface:\s*(\w+)/);
+      if (match) {
+        const iface = match[1];
+        const servicesRes = spawnSync('networksetup', ['-listallhardwareports'], { encoding: 'utf-8' });
+        if (servicesRes.status === 0) {
+          const lines = servicesRes.stdout.split('\n');
+          for (let i = 0; i < lines.length; i++) {
+            if (lines[i].includes(`Device: ${iface}`)) {
+              const prevLine = lines[i - 1] || '';
+              const matchService = prevLine.match(/Hardware Port:\s*(.+)/);
+              if (matchService) return matchService[1].trim();
+            }
+          }
+        }
+      }
+    }
+  } catch (err) {}
+  return 'Wi-Fi';
+};
+
+export const backupSystemDns = () => {
+  ensureDir();
+  if (fs.existsSync(DNS_BACKUP_FILE)) return;
+
+  const platform = os.platform();
+  const backup = { platform, timestamp: new Date().toISOString() };
+
+  try {
+    if (platform === 'darwin') {
+      const service = getActiveMacService();
+      backup.service = service;
+      const res = spawnSync('networksetup', ['-getdnsservers', service], { encoding: 'utf-8' });
+      if (res.status === 0 && !res.stdout.includes('There aren\'t any DNS Servers')) {
+        backup.dns = res.stdout.trim().split('\n').filter(Boolean);
+      } else {
+        backup.dns = ['Empty'];
+      }
+    } else if (platform === 'linux') {
+      if (fs.existsSync('/etc/resolv.conf')) {
+        backup.resolvConf = fs.readFileSync('/etc/resolv.conf', 'utf-8');
+      }
+    }
+    fs.writeFileSync(DNS_BACKUP_FILE, JSON.stringify(backup, null, 2), 'utf-8');
+  } catch (err) {}
+};
+
+export const setSystemDns = (dnsServers = ['127.0.0.1']) => {
+  backupSystemDns();
+  const platform = os.platform();
+
+  try {
+    if (platform === 'darwin') {
+      const service = getActiveMacService();
+      spawnSync('networksetup', ['-setdnsservers', service, ...dnsServers], { stdio: 'ignore' });
+    } else if (platform === 'linux') {
+      const content = dnsServers.map(s => `nameserver ${s}`).join('\n') + '\n';
+      execSync(`echo "${content.trim()}" | sudo tee /etc/resolv.conf > /dev/null`, { stdio: 'ignore' });
+    }
+    return true;
+  } catch (err) {
+    return false;
+  }
+};
+
+export const restoreSystemDns = () => {
+  if (!fs.existsSync(DNS_BACKUP_FILE)) return false;
+
+  try {
+    const backup = JSON.parse(fs.readFileSync(DNS_BACKUP_FILE, 'utf-8'));
+    const platform = os.platform();
+
+    if (platform === 'darwin') {
+      const service = backup.service || getActiveMacService();
+      if (backup.dns && backup.dns.length > 0 && backup.dns[0] !== 'Empty') {
+        spawnSync('networksetup', ['-setdnsservers', service, ...backup.dns], { stdio: 'ignore' });
+      } else {
+        spawnSync('networksetup', ['-setdnsservers', service, 'Empty'], { stdio: 'ignore' });
+      }
+    } else if (platform === 'linux') {
+      if (backup.resolvConf) {
+        execSync(`cat << 'EOF' | sudo tee /etc/resolv.conf > /dev/null\n${backup.resolvConf}\nEOF`, { stdio: 'ignore' });
+      }
+    }
+    fs.unlinkSync(DNS_BACKUP_FILE);
+    return true;
+  } catch (err) {
+    return false;
+  }
+};

package/src/utils/bypass.js

@@ -0,0 +1,79 @@
+import { store } from './config.js';
+import dns from 'dns';
+import { promisify } from 'util';
+import { spawnSync } from 'child_process';
+import os from 'os';
+
+const resolve4 = promisify(dns.resolve4);
+
+export const getBypassRules = () => {
+  return store.get('bypassRules', []);
+};
+
+export const addBypassRule = (target) => {
+  const rules = getBypassRules();
+  if (rules.includes(target)) {
+    throw new Error(`Bypass rule for '${target}' already exists.`);
+  }
+  rules.push(target);
+  store.set('bypassRules', rules);
+  return rules;
+};
+
+export const removeBypassRule = (target) => {
+  let rules = getBypassRules();
+  if (!rules.includes(target)) {
+    throw new Error(`Bypass rule '${target}' not found.`);
+  }
+  rules = rules.filter(r => r !== target);
+  store.set('bypassRules', rules);
+  return rules;
+};
+
+const resolveTargetIps = async (target) => {
+  const isIp = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\/\d{1,2})?$/.test(target);
+  if (isIp) return [target];
+
+  try {
+    const ips = await resolve4(target);
+    return ips;
+  } catch (err) {
+    return [];
+  }
+};
+
+export const applyBypassRules = async () => {
+  const rules = getBypassRules();
+  if (rules.length === 0) return;
+
+  const platform = os.platform();
+  
+  // Find default gateway
+  let gateway = null;
+  try {
+    if (platform === 'darwin') {
+      const res = spawnSync('route', ['-n', 'get', 'default'], { encoding: 'utf-8' });
+      const match = res.stdout.match(/gateway:\s*([\d.]+)/);
+      if (match) gateway = match[1];
+    } else if (platform === 'linux') {
+      const res = spawnSync('ip', ['route', 'show', 'default'], { encoding: 'utf-8' });
+      const match = res.stdout.match(/via\s*([\d.]+)/);
+      if (match) gateway = match[1];
+    }
+  } catch (e) {}
+
+  if (!gateway) return;
+
+  for (const rule of rules) {
+    const ips = await resolveTargetIps(rule);
+    for (const ip of ips) {
+      try {
+        if (platform === 'darwin') {
+          spawnSync('sudo', ['route', '-n', 'add', '-host', ip, gateway], { stdio: 'ignore' });
+        } else if (platform === 'linux') {
+          spawnSync('sudo', ['ip', 'route', 'add', ip, 'via', gateway], { stdio: 'ignore' });
+        }
+      } catch (e) {}
+    }
+  }
+};