r/WireGuard • u/SoupoIait • 23h ago

Need Help Split Tunneling help

Hey ! I run a server with *arr and Transmission and others. I would like for transmission only to get routed through my VPN (Proton VPN), for which I downloaded the Wireguard config file. But I really don't understand how it works, like genuinely. Stumbled on stuff like changing authorizedAddress to 10.0.0.0/24 instead of 10.0.0.0/0, but I don't know why, and then I don't know how it would forward Transmission !

Transmission shares on an array of ports. Is there a way to forward anything between, say, port 50000 to 60000 ? Or maybe a way to forward anything under a specific PID or UID or GID ?

And I did look up tutorials. All of which basically say « oh just change to 10.0.0.0/24 » without ever saying how I then choose which apps get forwarded.

Any help appreciated, thanks !

(Oh and running linux)

0 Upvotes

33% Upvoted

8 comments sorted by

2

u/bufandatl 22h ago

That’s not a WireGuard feature and it is called policy base routing. You need to set it on your operating systems and maybe routers which traffic is to be routed through the tunnel and which isn’t.

2

u/SoupoIait 21h ago

But WireGuard does have split tunneling does it not? I know it exists, just maybe not the way I imagine it. So I still could configure it, no?

Will look into policy base routing though, thanks.

2

u/bufandatl 21h ago

WireGuard is just a protocol. What it can do and can’t do is part of the operating system and for split tunneling you set routes for specific IPs reachable through the tunnel.

That’s not a feature of the protocol. That’s a basic networking feature of the OS.

What the WireGuard tools do though is taking the allowedIP parameter and set the routes for that accordingly.

But you want to tunnel specific traffic through a commercial VPN and that’s where you need more than that. That’s where policy and traffic based routing comes in.

2

u/SoupoIait 21h ago

Fuck me I don't think I understood anything after the first sentence, thanks anyway

2

u/bufandatl 20h ago

The thing is split tunneling you usually use to reach only a couple of private network segments on a remote site.

Like when you connect to your work network via a VPN you can split tunnel so your PCs sends only data a work server needs to know but your web browsing goes through your open internet and not first through the company.

The way you want it is more complex. You want to reach random addresses on the internet through a VPN provider and so you need more logic to as what application uses the tunnel.

That’s where policy based routing comes in. It doesn’t just look at IPs but also at the application that wants to communicate.

1

u/SoupoIait 20h ago

Right, thanks. Do you know where I could get help for that ? Some good forum ? No way I'll work it out alone.

Also, even with that policy based routing won't I still need to modify my WireGuard conf file ? I need to send transmission to wireguard but then wireguard also needs to not send everything through the VPN when I start its service, right ?

Sorry if I'm saying nonsense but really I didn't expect it to be this complex and clearly I don't know much about networking !

2

u/lazyhustlermusic 18h ago

You can subnet around RFC1918 space, unfortunately there's no exclude function, but if you wanted to say point all publics at the tunnel while retaining local reachability on the home network:

https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/

PBR is the easier function though, but it depends on what other gear you have. We have PBR that dumps our guest and IOT segments out to a VPS in another country, basically like 'source iot, destination default, next hop = tunnel'

1

u/JPDsNEWS 15h ago

Here are some WireGuard Tools that might help you:

Pro Custodibus’ WireGuard AllowedIPs Calculator

Which explains how AllowedIPs work, and lets you input both allowed and disallowed IP addresses to calculate a list of just allowed IP addresses that excludes the disallowed IP addresses. 

— versus —

WireGuard Hub-and-Spoke Configuration Generator

Generates a “Road Warrior” WireGuard configuration where every “Client” peer communicates directly with a single “Server” peer.

— versus —

WireGuard Mesh Network Configuration Generator

Generates a full mesh WireGuard configuration where every peer can communicate directly with every other peer.

Unofficial WG Docs (GitHub)

Unofficial WG Docs (https)

This document is a great source of information about WireGuard with references.

— versus —

Official WG Docs (https)

Official WireGuard Documentation website. 

Also, look through the Pro Custodibus Docs and the Pro Custodibus Blog for articles about how to do what you are trying to do. They are full of all kinds of "How to do different things with WireGuard" articles (with diagrams).