I currently have multiple subnets, and adding every single host I'd need a split tunnel is impractical. By allowing CIDR notation on the configs, we could allow 10.0.3.0/24 and have a whole slice of the network bypass the VPN.

As a plus, adding a per-network switch possibility would avoid my 10.0.1.1 (for instance) to be allowed without a VPN on public WiFi, for instance (which ties nicely to the "trusted networks" feature request)