Kerio Split

Cross-platform split tunneling companion for Kerio Control VPN.

Kerio’s official client often installs full-tunnel routes (0.0.0.0/1 + 128.0.0.0/1). Kerio Split waits for a real tunnel, then replaces that with only the routes you configure — so LAN and the rest of the internet stay local.

What it is	Route companion after the official VPN client is up
What it is not	A Kerio protocol client (why)
Platforms	macOS · Linux · Windows
License	MIT

---

Platforms at a glance

Platform	Deliverable	Maturity	Notes
macOS	Native SwiftUI app + menu bar	Stable	Connect All / Disconnect All via official Kerio client; passwordless route helper
Linux	Portable CLI (ip route)	Early preview	Works against real ip; needs more testing with live Kerio (kerio-kvc)
Windows	Portable CLI package	Early preview	Shared CLI + dry-run today; WinAPI route engine still stubbed

Same config shape on every OS: config/config.example.json.

macOS also offers Outbound (built-in sing-box or external V2Box/Clash), Kerio pin/ignore, and route guard so a second VPN does not steal corporate CIDRs.

We need your help on Linux & Windows. Those builds are not battle-tested enough yet. If you try a release archive, please open a feedback issue — OS version, what you ran, and what worked or broke.

---

Download

Get the latest build from Releases.

File	Use on
KerioSplit.pkg / KerioSplit.dmg	macOS (Apple Silicon)
KerioSplit-Uninstall.pkg	macOS removal
keriosplit-*-linux.tar.gz	Linux
keriosplit-*-windows.zip	Windows

---

macOS

Native app for macOS 13+ (arm64).

1. Install the .pkg (unsigned builds: right-click → Open)
2. Launch Kerio Split → Install route helper (one admin password)
3. Connect All — starts Kerio, waits for the tunnel, applies split
4. Manage routes under VPN Routes / Bypass / Settings

Runtime config:

~/Library/Application Support/KerioSplit/Config/config.json

Build from source:

make release-macos
open dist/KerioSplit.pkg

Details: platforms/macos

---

Linux

CLI that applies/restores split routes with iproute2 after Kerio (or another tunnel) is up.

Preview status: CI runs unit dry-run + a Docker ip route smoke test. Real Kerio on bare metal/VM still needs community validation.

# from a release archive
tar -xzf keriosplit-*-linux.tar.gz && cd keriosplit-*-linux
./bin/keriosplit ping
sudo ./bin/keriosplit apply -v
sudo ./bin/keriosplit restore
./bin/keriosplit status

From this repo:

make release-linux
make test-linux-docker   # fake tunnel smoke, no Kerio binary

Requirements: Python 3.9+, ip (iproute2), root for apply/restore.
Docs: platforms/linux/README.md · testing notes: docs/ports.md

---

Windows

CLI package aimed at the same workflow as Linux. The route engine is still a stub; shared config parsing and --platform dry-run work today.

Preview status: not enough real Windows + Kerio testing yet — please report anything you try.

REM from a release zip
set PYTHONPATH=%CD%\lib
python -m keriosplit ping --platform dry-run

From this repo:

make release-windows

Docs: platforms/windows/README.md

---

Shared core

All platforms share one Python core for config + engine contract + dry-run:

core/keriosplit/          config, CLI, dry-run engine
platforms/macos/          SwiftUI app + helper packaging
platforms/linux/          iproute2 adapter + Docker smoke
platforms/windows/        Windows adapter (stub → WinAPI)
config/                   example config.json

make test-core
PYTHONPATH=core:platforms/linux:platforms/windows \
  python3 -m keriosplit status --platform dry-run

Architecture: docs/architecture.md

---

How it works

Official Kerio client (or IPsec / OpenVPN)
        ↓  tunnel is up
Kerio Split engine
        ↓  remove full-tunnel hijack (optional)
        ↓  add VPN + bypass CIDRs from config
Done — only your networks go through the VPN

---

Contributing

• Branches: main (stable / releases), develop (integration)
• macOS packaging and Linux/Windows CLI: see CONTRIBUTING.md
• Port feedback template: Issues
• Security: SECURITY.md

make help
make release-all    # macOS pkg/DMG + Linux tar.gz + Windows zip

---

License

MIT © Ehsan Akbari

Kerio® is a trademark of its owners. This project is not affiliated with GFI / Kerio.