This has been discussed before but nothing ever got fixed:
In my opinion, you should not be able to click Apply with “Enable VPN Policy” > “Do not use VPN for the following” > All MAC address" as this is totally contradictory. Surely, by default, at least one address should have to be listed.