reply to my Netflix case, think I found a similar topic about this issue: VPN Policy and Android (TV) and Netflix - #2 by alzhao
looks like you have to exclude more domains besides netflix.com to make it work bypassing the tunnel. Pff quite a hassle. Maybe an idea if GL-inet can work out on some best practices topics or overview or something.