Timus agent breaks Multipass NAT networking on macOS (forces ip.forwarding=0)

Summary:

Multipass on macOS uses the native vmnet framework and Apple's Internet Sharing pf anchor for NAT, which requires net.inet.ip.forwarding=1 on the host. The Timus agent forces this value to 0, breaking Multipass connectivity. This occurs whenever Timus is installed — both when the tunnel is connected and when it is disconnected.

Confirmed behavior:

• The Timus agent sets net.inet.ip.forwarding=0 at boot and resets it on any tunnel state change, including disconnect. Manual correction via sysctl is overwritten by the agent.
• With Timus disconnected and forwarding manually set to 1, Multipass NAT works normally. This is the only working state, and it has to be re-applied after every reboot or tunnel change.
• With Timus connected, Multipass VMs have no internet connectivity even when forwarding is manually set to 1. NATted traffic from the bridge subnet (192.168.252.0/24) does not egress to the internet.

Current workaround and why it's inadequate:

The only working alternative is Multipass bridged mode, which gives each VM a direct LAN IP and bypasses the macOS NAT stack. This adds a second interface to every VM, requires manual route-metric configuration inside the VM, must be redone when switching uplinks (Wi-Fi vs Ethernet), and requires recreating existing VMs. Standard NAT mode is strongly preferred.

Requested changes:

1. Stop forcing net.inet.ip.forwarding=0, or expose a policy toggle to allow it. Nothing in WireGuard requires this value to be 0. This single change restores Multipass functionality whenever the tunnel is disconnected.
2. Allow NATted traffic from local hypervisor bridge subnets to egress locally while the tunnel is connected. This could be done via source-based split-tunnel rules (the current rules match on destination only) or by excluding vmnet-type bridge interfaces from tunnel routing.
3. Document Trusted Networks as a supported configuration for this use case, if it can be used to bypass the tunnel on known networks.

This would let macOS users run Multipass in standard NAT mode with Timus active. Multipass is a common tool for developers and IT staff running Ubuntu workloads on macOS.