Hostname based reverse split tunnel with wildcard support

A device comprising:

• at least one processor configured to execute a driver to:
• receive a first packet of an application that includes a hostname of a destination;
• receive, from an agent, a real IP address and a spoofed IP address corresponding to the hostname, when the hostname matches one of a plurality of hostnames to exclude packet traffic from a virtual private network (VPN) tunnel of the agent;
• receive, from the agent, a domain name service (DNS) response that includes the spoofed IP address;
• send the DNS response to the application to cause the application to include the spoofed IP address in a second packet for the destination;
• receive, from the application via an operating system, a third packet that includes second hostname of a second destination;
• and
• receive, from the agent, a second DNS response that includes a second real IP address corresponding to the second hostname, when the second hostname fails to match any of the plurality of hostnames;
• and
• send the second DNS response to cause the application to include the second real IP address corresponding to the second hostname, in a fourth packet.

A non-transitory computer-readable medium storing instructions that, when executed by at least one processor of a service, cause the at least one processor to:

• receive a first packet of an application that includes a hostname of a destination;
• receive, from an agent, a real IP address and a spoofed IP address corresponding to the hostname, when the hostname matches one of a plurality of hostnames to exclude packet traffic from a virtual private network (VPN) tunnel of the agent;
• receive, from the agent, a domain name service (DNS) response that includes the spoofed IP address;
• send the DNS response to the application to cause the application to include the spoofed IP address in a second packet for the destination;
• receive, from the application via an operating system, a third packet that includes second hostname of a second destination;
• and
• receive, from the agent, a second DNS response that includes a second real IP address corresponding to the second hostname, when the second hostname fails to match any of the plurality of hostnames;
• and
• send the second DNS response to cause the application to include the second real IP address corresponding to the second hostname, in a fourth packet.