PROCESS-NAME rules: routing by program instead of domain

Some programs talk to a pile of random IP addresses that no domain rule can catch. Matching on the process name is far simpler:

rules:
  - PROCESS-NAME,Telegram.exe,Proxy
  - PROCESS-NAME,steam.exe,DIRECT
  - PROCESS-NAME,curl.exe,Proxy

Syntax notes

• On Windows include the .exe suffix. Matching is case-insensitive, but it is safest to copy the name exactly as Task Manager's Details tab shows it;
• It matches the file name only, never the path. Two programs with the same name cannot be told apart — use PROCESS-PATH with a full path when you need that;
• Ordering works as usual: put these rules above GEOIP and MATCH or they will never be reached.

Why a rule sometimes does not match

Process matching relies on the core resolving which local process owns a connection. Traffic a program sends itself is fine, but anything relayed shows up as belonging to the relay instead. Three situations account for most misses: programs inside WSL2 or a virtual machine (the owner becomes the virtual adapter), some UWP apps (which go through a system proxy service), and traffic already forwarded by another proxy tool.

Unsure about the name

Open the Connections page, find a connection the program created and read the Process column — that is the name the core sees, so copy it verbatim. This also settles the "is it really that program sending the traffic" question; often what you assume is the browser turns out to be one of its helper processes.