Frequently asked questions

Two or more network paths, yes — but not two separate ISP contracts. Common pairs are home broadband plus a phone hotspot, Wi-Fi plus a USB LTE modem, Ethernet plus a VPN adapter, or two NICs on different subnets. Anything Windows lists as an adapter with its own gateway can be a routing target.

With one adapter you still get per-application bandwidth monitoring, speed tests and diagnostics, but there is nowhere to route traffic to, so the routing features stay idle.

No. There is no tunnel, no server of ours in the path, and no encryption added to your traffic. Dual Internet decides which of your own network adapters each connection leaves through. Your traffic goes to the same places by the same protocols; only the exit interface changes.

It works alongside a VPN — a VPN adapter is just another routing target, which is what makes split tunnelling possible.

Not in the sense of making one download faster — a single connection uses a single adapter, so its ceiling is that line's speed. What changes is contention: moving the download off the line your game or call is using stops it stealing that bandwidth and adding queueing delay.

In aggregate a machine with two lines can move more data at once. Individually, each transfer is limited to whichever line it was routed to.

No, and be sceptical of anything that claims otherwise on a plain Windows box. Splitting one TCP connection across two paths requires cooperation from the far end — MPTCP, or a bonding service that reassembles the streams somewhere upstream. Without that, packets arriving from two different source addresses look like two different conversations and get dropped.

What per-connection routing gives you instead is parallelism across different transfers, which is what actually helps in practice.

Routing stops and the app asks for a licence key. Your rules and profiles are kept rather than deleted, and any enforcement still in place is cleared, so nothing is left blocking traffic with no running app to explain it. Activating restores everything as it was.

During the 30 days nothing is held back and nothing is limited by count. The app does not nag from day one either — a banner appears in the last week, and the exact count is in Licence & about whenever you want to check.

About a minute for the first rule: install, pick an application from the list, pick an adapter. No network configuration, no reboot, nothing to change on your router. The quick start walks through it including how to verify the traffic actually moved.

No. A rule is one application and one connection, both picked from lists the app builds for you — there is nothing to type and no network notation to learn. There is no “advanced mode” hiding a harder interface either; what you see is all of it.

No, and none is planned. The whole implementation is built on the Windows Filtering Platform and the Windows IP Helper API. On Linux the equivalent is policy routing with ip rule and cgroup or mark-based classification, which is a genuinely different product rather than a port.

Rules apply to connections opened after the rule exists. Sockets that are already established stay on the interface they were created on — there is no way to move a live TCP connection to a different source address without breaking it. Restart the application and the new connections will follow the rule.

You can create them, but do not: a rule is one executable held on one adapter, and two rules naming the same executable with different adapters describe contradictory intentions. Applying the second replaces the first — the app clears the stale filters from the earlier assignment before installing the new ones, so the application ends up confined to whichever adapter you applied last rather than blocked on both.

Rules carry a priority field, but in this release it is stored and exported rather than used to arbitrate between overlapping rules.

Nothing. It is released untouched and Windows routes it by interface metric exactly as it would with the application uninstalled. There is no implicit default rule and no catch-all unless you write one.

Neither, in this release. Rules name an application, not a destination. If you want one application’s traffic on a particular line, that works today; if you want everything going to one domain on a particular line regardless of which application sent it, that is not something this version can express.

Destination routing is on the roadmap. It needs a different mechanism from the one enforcement uses now — the filters this app installs match on the executable, which is why per-application assignment is what shipped first.

Yes. Adobe*.exe matches by name, and paths support * within a segment and ** across segments, so C:\Games\**\*.exe covers a whole library. Matching on the full path is the safer choice when several unrelated programs share a common executable name.

No. A filter matches the executable path you named, so a child process running a different executable is not covered by its parent’s rule — a launcher that spawns the actual game needs a rule for the game as well.

Where the child is the same executable (a browser spawning a process per tab) the rule does apply, because the path is the same. If an application is not behaving as expected, check the Processes list for what is really running.

It can, but the process that owns the connection may not be the one you expect. When an application delegates networking to a shared host — a background transfer service, an update mechanism, anything running under svchost — the socket belongs to the host, so a rule naming the visible executable does not match.

The Processes list shows what is actually running, which is usually enough to spot the case. There is no way around it in this release: with no destination routing, a connection owned by a shared host process cannot be attributed back to the application that asked for it.

Yes. Filters are registered at both the IPv4 and IPv6 connect layers, so an application confined to an adapter is confined for both families — there is no gap where IPv6 traffic slips out on another line. Removal covers both equally.

Rule evaluation is a short walk over an in-memory list with a cached process identity, so a few hundred rules is not a measurable cost per connection. The practical limit is comprehension, not performance: past about thirty rules in one profile it becomes hard to reason about precedence, and splitting into profiles is usually the better answer.

Yes — that is the normal case. Any number of rules can point at the same adapter, and adapters are not exclusive. Eight or more can be active simultaneously with rules distributed across them however you like.

No. Inbound connections arrive on whichever interface the remote end sent them to, and that is decided by DNS and your router, not by anything on this machine. Dual Internet controls outbound path selection. A server that must be reachable on a specific line needs port forwarding on that line's router.

No. There is no traffic classifier in this release, and nothing inspects your traffic — no payload inspection, and no record of which sites were visited.

In practice naming the application gets you most of the way there, because the programs that generate bulk transfers are usually the ones you would classify anyway: put the download client or the game launcher on the line you want the volume to use.

Any adapter that is up, has an address, and has its own default gateway. That covers Ethernet, Wi-Fi, USB tethering, LTE and 5G modems, most VPN adapters, and virtual adapters that route rather than bridge.

Excluded: loopback, adapters with no gateway, and anything currently down. The Adapters list shows every adapter it found either way, and one that cannot carry traffic says why in plain words — for example “no DHCP lease (link-local only)” — rather than being silently hidden.

Yes, either over USB tethering or as a Wi-Fi network — both present as a normal adapter with a gateway. USB is generally the better choice because it does not compete with your other Wi-Fi for radio time, and it is more stable under load.

Set a speed-test payload cap before testing a hotspot, and check the metered flag is set so bulk rules know to avoid it.

Only with two Wi-Fi adapters. A single radio associates with one network at a time — that is a hardware constraint, not a software one. Add a USB Wi-Fi adapter and you have two independent radios, each with its own gateway, and both become routing targets.

It works, but it rarely achieves anything. Two adapters on the same subnet share the same gateway and therefore the same upstream path, so routing between them changes the interface without changing the route. You need genuinely separate paths — usually separate subnets with separate gateways — for this to do useful work.

Usually. Most clients create a virtual adapter with its own gateway, which becomes a normal routing target — that is how split tunnelling works here even when the client does not offer it.

Two things to watch. Some corporate clients enforce full-tunnel policy and will re-assert their own configuration, in which case theirs wins; and a VPN client with its own leak protection may treat a connection leaving via another interface as a leak and shut the tunnel. Test before relying on it, and check your acceptable use policy on a managed device.

An address-change notification triggers a reconciliation pass that recomputes every affected route against the new gateway. This is the step hand-written route add entries lack, and the reason they break silently after a DHCP renewal or a Wi-Fi reconnect.

No — a rule names one adapter, and there is no fallback field. Adapter grouping is on the roadmap. For now, if the metered line changes (a different hotspot, say), edit the rule to point at the new adapter, or keep a profile per setup and switch between them in one click.

No. The app reports the measurements themselves — download, upload and latency from a speed test, plus live throughput — and leaves the judgement to you. There is no composite 0–100 score, and nothing automated reads one, because nothing in this release moves traffic on its own.

Whether a line is good enough depends on what you are putting on it: a figure that suits a bulk download is not the one that suits a call.

Under 1.5% CPU at idle on an i5-12400 with two active adapters, 1-second polling and 40 rules, and roughly 60–90 MB of working set for the service with the window closed. The window itself adds more while it is open and charting.

Those are our figures on our hardware; yours will differ with rule count and polling interval. The dominant cost is the counter sampling, so raising the polling interval is the effective lever if you are chasing headroom.

Not to packets in flight. The decision happens once, at connect time, and costs a cached dictionary lookup plus a walk over the rule list — microseconds, on the connection setup path only. After that the kernel forwards packets with no involvement from us, because there is no proxy or tunnel in the path.

What can change latency is the routing itself: if you send traffic down a slower line, it is slower. That is the decision, not overhead.

No. Packets are not copied into user space, inspected or re-encapsulated; the forwarding path is the kernel's own. A routed connection reaches the same line rate an unrouted one would on that adapter.

Yes, while you want the rules enforced. There is no background service: the filters belong to the running application, so when it exits Windows discards them and routing returns to normal. That is deliberate — nothing keeps blocking traffic once the thing that can explain it is gone.

You do not need the window open, though. Set closing to minimise to the tray and the app keeps running with rules enforced and the scheduler ticking. Turn on “Start with Windows” and it is there from sign-in.

Marginally. Sampling adapter counters is the only periodic work, and enforcement itself costs nothing once the filters are in place — the kernel does that work whether or not this app is looking.

Two settings reduce it further, both honest about being manual: raise the sampling interval (1–60 seconds, in Settings), and leave “Pause monitoring when hidden” on so sampling stops entirely while the window is in the tray. There is no automatic power-mode backoff in this release.

A few megabytes per month at default retention, in one SQLite file. Samples are rolled up as they age — per-second for the last hour, per-minute for the last week, per-hour beyond that — so the file grows slowly rather than linearly. Retention is configurable, and setting it to zero disables history entirely.

Accurate enough to compare a line against itself over time and against its sibling, which is what it exists for. It is multi-stream and bound to one adapter, so it does measure that line rather than the machine's aggregate.

It is not a substitute for a formal measurement against a well-provisioned nearby server — your result depends on the endpoint you configure, and on whatever else is using the line at the time. Do not read too much into a single run.

Different attribution windows and different sampling. Per-process byte counts are derived by mapping sockets to owners and sampling deltas, so a connection that opens and closes entirely between two samples is attributed approximately. Adapter-level totals come straight from the interface counters and are exact.

Expect single-digit percentage differences on per-process figures and treat them as proportional rather than forensic.

No telemetry, no analytics, no account. Profiles, rules and preferences live in a local SQLite file and a settings file in your own user profile. There are exactly two kinds of outbound request: a speed test, when you press the button, and a licence check when you activate a key or when it periodically re-validates one.

There is no update check and no crash reporting. Both are enumerated in the privacy policy.

Modifying the IPv4 and IPv6 forwarding tables and registering Windows Filtering Platform filters are privileged operations with no unprivileged equivalent. The application is manifested to request elevation once at launch rather than prompting repeatedly.

Monitoring-only use — bandwidth charts, speed tests, adapter listing — works without elevation, and the application states which features are unavailable rather than failing silently.

It sees connection metadata, because that is what routing decisions are made from: the process, the remote address and port, the protocol, and byte counts. It does not read payloads, terminate TLS, or install a certificate. There is no packet capture and no content inspection anywhere in the product.

Destination rules do mean resolved hostnames appear in the local database and, if you enable it, the audit log. Both are on your machine and neither is transmitted.

Enforcement is additive and reversible. The filters belong to the running process, so ending it makes Windows discard them. Before an adapter’s interface metric is changed the original value is journalled to disk, and if the app is killed rather than closed the next launch reads that journal and restores the adapter before doing anything else.

The manual escape hatch is Remove all in Rules, which clears every filter and restores every metric immediately. Failing that, closing the app is enough. Nothing is blocked unless a rule you created says so, and no rule ever blocks an application on the adapter you assigned it to.

Yes — Authenticode on the MSI and on every executable inside it, and SHA-256 checksums published on the download page alongside a detached signature over the checksum file. Verify with Get-AuthenticodeSignature before installing.

SmartScreen may still warn for the first few days after a release, because reputation accrues per build. Confirm the signature reads Valid and the signer matches.

No. It registers filters with the Windows Filtering Platform from user mode, which is the same documented mechanism firewalls and VPN clients use, and requires no driver of our own. Uninstalling deregisters them; nothing persists in the kernel.

Yes, and it is worth being clear about it. Filters act on the process that owns the socket, so anything that gets another process to do its networking — a shared host service, an injected thread in a different process — is attributed to that process instead. This is a traffic management tool, not a containment boundary.

If your requirement is enforcement against hostile software rather than organisation of cooperative software, you want a firewall policy, and probably network-level segmentation.

It loses connectivity, and is not moved anywhere else. The filters holding it to the failed adapter stay in place, so its new connections have nowhere to go — it does not quietly start using your other line.

For a leak-conscious setup that is the behaviour you want, and it is the default because it is the only behaviour available: enforcement works by blocking, so there is no fallback to configure and no kill switch to arm. Applications you never wrote a rule for are unaffected. The app raises a notification naming the adapter, because otherwise the only symptom is one program that cannot connect.

Under %LocalAppData%\DualInternet: the SQLite database, your settings file, the rolling logs and the isolation journal. Anyone who can read your user profile can read them, and the logs record which applications you route over which adapters — which describes your setup, so treat them accordingly when sharing.

The database and logs are readable by administrators on the machine. If that matters in your environment, set history retention to zero and leave audit logging off.

Email the address on the security page rather than opening anything public. You will get an acknowledgement within two business days, an assessment within five, and credit in the changelog if you want it.

Your key unlocks every version released in the twelve months after purchase, and those versions keep working forever with every Pro feature intact. Not renewing means no new versions — it does not disable anything, revert you to Free, or start showing prompts.

Renewal is optional and discounted. Buying one extends the window from where it expired rather than from the date you paid, so renewing late loses nothing.

Thirty days from purchase, no questions asked, no explanation required. Email support from the address you bought with; the refund goes to the original payment method and the key is deactivated at the same time.

We would rather you used the full 30-day trial first and never needed this, which is why the trial holds nothing back.

Activation records a machine fingerprint against your key. Three active machines at a time, and you can free a slot instantly with Deactivate in Licence & about.

Reinstalling Windows on the same machine reuses its existing slot. If a machine is gone and you cannot deactivate it, email support with the key — no waiting period, no charge, no limit on how often.

A salted hash of a few stable machine identifiers. The hash is what is transmitted and stored, not the identifiers themselves, and it cannot be reversed to tell us anything about your hardware. It exists solely to count machines against the limit.

Activation sends that hash, your key and the application version. Nothing else.

Only once, at activation. After that the licence is validated locally against a signed payload, so the application works indefinitely offline. There is no periodic phone-home and no grace period to run out.

For machines that will never have internet access, Enterprise includes an offline activation exchange — you generate a request file, we return a signed response.

A Pro licence covers three machines used by one person, wherever they are — a desktop, a laptop and a spare is the intended shape. What it does not cover is three different people, or deployment across an organisation; that is what Enterprise seats are for.

Yes — 50% off Pro for students with an institutional email, registered non-profits, and maintainers of open-source projects. Email support with something that shows you qualify and you will get a code. No forms.

Yes. What you paid for Pro is credited in full against the first year of Enterprise seats regardless of when you bought it, and your existing profiles export straight into the fleet configuration.

Every purchase gets a VAT or GST invoice as a PDF automatically, with your company details if you entered them at checkout. Purchase orders and bank transfer on 30-day terms are available for Enterprise; single Pro licences are card only, because the invoicing overhead exceeds the licence price.

A Pro licence does not lapse — only the update window closes, and everything keeps running. An Enterprise subscription that ends does revert the machine to free-tier limits: your rules and profiles are kept in the database rather than deleted, and the ones beyond the free limits become inactive until a licence is applied again.

Windows 10 version 1809 (build 17763) and newer, and Windows 11. Both x64 and ARM64. There is no 32-bit build. Windows 8.1 and earlier are not supported and will not be — the filtering APIs used here are not available in a usable form there.

Server 2019 and 2022 work in practice and several people run them that way, but they are not in the test matrix, so treat them as unsupported-but-functional. If you hit something specific to Server, report it and we will look — we just do not promise it in advance.

Not functionally. Multiple products can register filters at the same layer, and they are evaluated by weight — a firewall's block decision always beats a routing decision, which is the correct precedence.

What does happen occasionally is a scanner quarantining the service because registering filters looks like something suspicious. If the service will not start, check its log for a registration error and add the installation directory to the scanner's exclusions.

Yes, provided the guest sees two adapters with separate gateways. That means two bridged or two NAT adapters backed by different host paths — two virtual NICs sharing one host interface give the guest two names for the same path, which routes but achieves nothing.

Traffic from a WSL distribution or a Linux container leaves through the virtual switch and is attributed to the host's networking process, not to the program inside the guest. So a process rule naming something inside WSL will not match — but a destination rule still routes that traffic correctly, and you can route the whole guest by naming the host-side process.

Not in 1.0. Routing is machine-wide state, so rules and the active profile apply to every session on the box, and any administrator can change them. Per-user rule sets would need a per-session policy model that does not exist yet.

Yes. Uninstalling restores the routing table from the snapshot, deregisters every filter, removes the service, and takes the CLI off your PATH. The database and logs are left in place deliberately so a reinstall keeps your profiles — the uninstaller offers to delete them, and they are a single directory you can remove by hand.

First: did you press Apply? A rule that exists is not yet a rule that is enforced, and the Rules list says which state each one is in — Enforced or Inactive.

If it says enforced, restart the application you are routing. Filters apply to connections opened after they exist, so a program that was already running keeps its existing ones until they are re-established.

Usually the traffic does not belong to the executable you named. Some applications delegate networking to a shared host process, so the connection belongs to that host and a rule naming the visible program does not match it. The Processes list shows what is actually running.

Also check the connection is new: an existing one keeps the adapter it started on. The log folder (openable from Licence & about) records exactly which filters were installed and on which adapters.

Open Adapters: every adapter it found is listed, and one that cannot carry traffic says why in plain words rather than being hidden. Usually it is no gateway, no assigned address (a link-local 169.254.x.x means no DHCP lease), or a status other than up.

The app deliberately refuses to assign an application to an adapter that is not routable, because doing so would take that application offline the moment the rule applied.

This is expected, and it is deliberate. Filters belong to the running process, so a reboot clears them — and rules are reloaded disabled, because a rule that was enforced last session is not enforced now and showing it as active would be a lie.

To have them come back automatically, turn on Start with Windows and Re-apply rules on launch in Settings. The second one is off by default because it changes how your machine routes traffic before you have looked at it.

This is DNS rather than routing: the traffic may be on the right adapter while the name was resolved through the other line’s resolver. This application does not configure DNS — each adapter keeps whatever resolver Windows gave it — so it cannot fix this for you.

Set the resolver on the adapter itself in Windows network settings, or lower the other adapter’s priority. Resolve-DnsName name -Server <resolver> in PowerShell tells you what each resolver actually answers.

That is the designed behaviour, not a fault. There is no automatic failover: an application confined to an adapter stays confined to it, so if that adapter goes down the application loses connectivity rather than moving to another line.

You have two options while the line is down: disable that rule (its own switch, in Rules) to release the application, or point it at a working adapter and press Apply. Keeping a second profile for the fallback arrangement makes it a one-click change.

If UAC is disabled entirely or policy blocks elevation prompts, the launch will fail rather than silently run without privileges. Start it from an already-elevated context, or re-enable UAC.

There is no monitoring-only mode. Elevation is required, not optional — without it the app tells you so and closes, rather than opening a window whose controls would all fail. On a machine where you cannot elevate, this application cannot do its job.

Close the app. That is the whole recovery path: the filters belong to the process, so Windows discards them when it exits, and adapter metrics are restored on the way out. If it was killed instead, launch it again — it reads the journal and restores any adapter left isolated before doing anything else.

If you cannot launch it at all, an adapter left at metric 9999 can be handed back to Windows with Set-NetIPInterface -InterfaceIndex <n> -AutomaticMetric Enabled from an elevated PowerShell prompt. UNINSTALL.md in the install folder has the full procedure.

Then press Copy diagnostics in Licence & about and send us that text — it names your adapters, rules, enforcement state and licence status, and you can read it before sending.

Email support with a diagnostic report attached, the Windows build number, and what you expected to happen versus what did. Pro gets a response within two business days, Enterprise within one. Free-tier questions are answered too, just without a target.