http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion/en/blog/2022/6/10/possible-dns-leak-fixed-in-our-windows-app
All other destinations should be blocked, both inside and outside the tunnel. The exception is of course if Custom DNS is being used, then the configured custom resolver is the only one that should be allowed. However, there was an issue with the firewall rules in our split tunneling driver that caused these security guarantees to not be fully upheld.