You can have per-application IP routing if you run applications within individual Linux containers. E.g.: sudo pflask --netif=macvlan:enp4s0:net0 tmux Then

You can have per-application IP routing if you run applications within individual Linux containers. E.g.: sudo pflask --netif=macvlan:enp4s0:net0 tmux Then inside tmux run a VPN client and the sensitive application.