Yeah, that balance between full tunnel and split is tricky, especially with NordLayer's client in my experience. I'm also setting this up for my team.
>What's the most reliable way to define the apps or IP ranges?
I agree with the IP/CIDR folks. We started with domains and it broke constantly. I grabbed the AWS and GitHub IP ranges from their official JSON endpoints with a simple Python script. The inconsistency you see might be because of DNS, not the rules themselves. On Windows, the VPN client sometimes overrides your local DNS settings completely, which kills local network stuff.
For maintaining it, I'd just run that script weekly and have it post a diff to a Slack channel. For 8 people, that's low effort and keeps everyone in the loop when AWS adds a new region.
The ROI calculation you're asking about is exactly where we landed too. We tracked every "the build's broken because a new CI IP wasn't tunneled" ticket for a quarter. The engineering time spent troubleshooting absolutely dwarfed the two days it took to write a script that fetches and pushes the lists.
>Scripting fetches from providers is more accurate, but you're trading engineering time for operational security.
I'd frame it as trading a small, upfront engineering time for a *massive* reduction in ongoing troubleshooting time and team-wide disruption. That initial script cost is fixed, while the manual error cost compounds with every new hire, new tool, or cloud region.
One caveat on the "simple script" approach: you have to bake in idempotency and dry-run modes from day one. The first time you accidentally push an empty list because of a parsing bug, you'll wish you had a safety check that diffs against the last known good state before making any live changes.