What happens when you assign an app

No packet drivers of our own, no virtual adapters, no proxy in the middle. Dual Internet uses the two mechanisms Windows already exposes for this — the IP forwarding table and the Windows Filtering Platform — and puts a rule engine and a safety net around them. Here is the whole path, including where it stops.

The pipeline

One connection, six stages

This runs for every new outbound connection on the machine. Existing connections are left alone — a rule change applies to what opens next, not to sockets already established.

01

A process asks for a socket

An application calls connect(). Before Windows commits to a path, the filtering platform hands the pending connection to the registered filter at the ALE authorise-connect layer, along with the owning process ID.

02

The process ID is resolved to an identity

A process ID on its own is not much use for matching, so it is resolved to a full image path and cached. The cache is populated by a WMI watcher on process start rather than by polling, so the lookup at connect time is a dictionary hit and not an enumeration of the process table.

03

Rules are evaluated in priority order

The engine walks the active profile's rules from lowest priority number upward, testing each condition set against the process identity, the remote address, the protocol and port, the classifier's traffic tag and the current time. First match wins, evaluation stops. If nothing matches, the connection is released untouched and Windows routes it by interface metric as usual.

04

The connection is bound to the chosen adapter

Binding happens one of two ways depending on the rule. Destination-shaped rules are satisfied by a scoped entry in the IPv4 or IPv6 forwarding table pointing at the target adapter's gateway and interface index. Process-shaped and port-shaped rules are satisfied at the filtering layer, where the connection is redirected to the target interface directly — because the forwarding table has no concept of which process asked.

05

Counters attribute the traffic back

Independently of enforcement, the monitor samples per-interface counters through the same IP Helper interfaces Windows uses for its own statistics, then derives throughput from the deltas between samples. That is what the Activity section draws, at whatever interval you set.

06

State is reconciled continuously

Adapters come and go, DHCP leases change, Wi-Fi reconnects with a new address. An address-change notification triggers a reconciliation pass that recomputes every affected route rather than leaving a stale gateway behind. This is the step that hand-written route add entries do not have, and the reason they rot.

Under the hood

Two mechanisms, chosen per rule

Neither approach covers everything on its own. The engine picks whichever one can express the rule you wrote, and tells you which it used.

IP Helper

The interface metric

Every adapter carries a metric — a cost Windows uses to decide which one wins when more than one could carry a connection. Raising it makes the whole system treat that adapter as a last resort. That is what “isolate” does, and it is reversible: the original value is journalled before it changes.

Good at: pushing general system traffic away from a line you want kept clear. Cheap and stable.
Cannot express: “only for Chrome”. The metric is a property of the adapter, not of a process, which is why it is a blunt instrument used alongside the real mechanism rather than instead of it.

WFP

Windows Filtering Platform

Filters registered at FWPM_LAYER_ALE_AUTH_CONNECT_V4 and its v6 twin see each pending connection together with the process that owns it, and can permit or block it. This is the layer firewalls use. From usermode it cannot redirect a connection — that needs a kernel callout driver — which is exactly why an assignment is enforced by blocking the application everywhere else.

Good at: per-process decisions, because the filter sees which executable is asking and blocking is a first-class outcome here.
Costs: filters are per-session objects that need cleaning up, and they are evaluated alongside every other filter on the box, so weights and sublayers matter.

Which mechanism serves each rule type
What you asked for Mechanism Applies to Survives reboot
Application on a chosen adapter WFP block filters New connections only Re-applied when you press Apply, or on launch if you enable it
Deprioritise a whole adapter interface metric All system traffic Restored on exit, or from the journal on next launch

Safety net

Nothing is modified without a way back

The routing table is machine-wide state. Getting it wrong takes a network down, so the write path is deliberately conservative.

  • Snapshot before the first write. The full table is serialised to disk with a session marker before anything is added.
  • Validate before apply. The target adapter must exist, be up and have a usable gateway. A rule pointing at a missing adapter is reported, not attempted.
  • Restore on exit and on crash. Clean shutdown restores the snapshot. If the process dies, the next launch finds the orphaned marker and offers to roll back before doing anything else.
  • Uninstall runs the same restore. Removing the application removes its routes and filters. No leftovers.
DualInternet log — shutdown

Honest limits

What this approach cannot do

Worth reading before you buy. These are properties of the mechanism, not bugs, and no amount of work on our side removes them.

Existing connections do not move

A socket that is already established stays on the interface it was created on. Applying a rule to a running download will not divert it — restart the transfer, or the application, for the rule to take effect.

Traffic through a broker belongs to the broker

If an application delegates its networking to a shared service, the connection is owned by that service's process, not the application's. Store downloads, some update mechanisms and anything routed via svchost land under the host process — so a rule naming the visible executable will not catch them. Use a destination rule instead.

One connection cannot use two adapters at once

This is per-connection routing, not link aggregation. A single download does not get faster by having two lines available; it goes down one of them. Aggregation requires cooperation at the far end (MPTCP, or a bonding service) and is out of scope. What you gain is that the other line stays free for everything else.

Elevation is required, and cannot be worked around

Writing the forwarding table and registering filters are privileged operations with no unprivileged equivalent. Monitoring, speed tests and adapter listing work unelevated; routing does not. The application says which features are unavailable rather than failing quietly.

More edge cases in the FAQ and the troubleshooting guide.

See it on your own machine

The quick start takes about a minute: install, pick an application, pick an adapter. The 30-day trial is enough to confirm the mechanism works on your hardware.

Download for Windows Read the quick start