@NilsS Thanks for your message. I tried out adding a route manually like you described (Advanced Options in VPN Client configuration) and now my system feels more deterministic again; I could check "Don't pull routes" and "Don't add routes" and it still works. Now I can tweak rules. Thank you!