VPN Works 0.9.0 lets a Guard plugin put a byte budget on a connection it allows. The kernel counts every byte, cuts the connection when the budget runs out and records why, and refuses new connections once a budget is spent. The built-in Budget plugin is a list of the hosts a program may reach, each with how much it may send, receive and open.
In the recorded session, a stand-in agent’s 5 MB upload to a host with 256 KiB up was cut at exactly 262,144 bytes. Its retry and a host it wasn’t given were refused, and Ledger sealed the cut. Names a Guard refuses no longer reach DNS either. vpnw exit serve now takes clients in and out without a restart, closing a removed client’s open connections.
Two rounds of independent review found six problems, all fixed with tests. The release post has the details. Open source, with releases for Linux and macOS.