Dynamically updating network routes

An endpoint device comprising one or more processors implemented in circuitry and configured to:

• allocate a range of IP addresses to use for fully qualified domain name (FQDN)-based tunnel splitting;
• send a DNS query to a DNS server;
• receive a DNS response from the DNS server;
• modify a first IP address in the DNS response to one of the allocated IP addresses;
• associate the first IP address and the one of the allocated IP addresses in a data table, wherein the associating the first IP address and the one of the allocated IP addresses includes storing a mapping between the first IP address and the one of the allocated IP addresses in a memory including the data table;
• in response to receiving, from a user application executing on the endpoint device, a first TCP packet with a destination address that corresponds to the one of the allocated IP addresses:
• change the destination address in the first TCP packet to be the first IP address;
• and
• after changing the destination address in the first TCP packet to be the first IP address, send the first TCP packet along a network route toward the destination address via a VPN tunnel.

A computer-readable storage medium comprising instructions that, when executed, cause a processor of an endpoint device and executing a virtual private network (VPN) client to:

• allocate a range of IP addresses to use for fully qualified domain name (FQDN)-based tunnel splitting;
• send a DNS query to a DNS server;
• receive a DNS response from the DNS server;
• modify a first IP address in the DNS response to one of the allocated IP addresses;
• associate the first IP address and the one of the allocated IP addresses in a data table, wherein associating the first IP address and the allocated IP addresses includes storing a mapping between the first IP address and the one of the allocated IP addresses in a memory including the data table;
• in response to receiving, from a user application executing on the endpoint device, a first TCP packet with a destination address that corresponds to the one of the allocated IP addresses:
• change the destination address in the first TCP packet to be the first IP address;
• and
• after changing the destination address in the first TCP packet to be the first IP address, send the first TCP packet along a network route toward the destination address via a VPN tunnel.