Welcome to the r/WireGuard subreddit!

Hi,

I'm looking for a way to allow connections to computers in a LAN while a Wireguard tunnel is active.

I know this is probably extremely easy but, unironically, I can't find an actual guide on how to do it. I'm using the default "wireguard-tools" which I installed using

sudo dnf install wireguard-tools

And then something called Wireguird to set up the tunnels. The OS is Fedora Workstation 43.

For the tunnel and keys I signed up for the Proton VPN service which has its own guide on how to set it up with Wireguard.

My problem is whenever the tunnel is active I can only access the internet, and the rest of the LAN is cut off, for example I'm not able to connect to a file server, use LAN Messenger, or see things like scanners or printers.

Is there a way to do both at once? problem is my internet is extremely slow and it takes its sweet time to open even the least bloated websites, and hours to download a file IF it's stable and the download isn't cut.

I read I need a special router to do that, that can't be truth, right? there's no way to get "high end" routers in my country and all I have is an ancient ISP modem wired to a probably equally older Cisco router.

Thanks.

Hello,

I am looking for beta testers for a project I have been working on that allows you to steer network traffic on Windows while running multiple network interfaces. For example, you can run the official WireGuard, Tailscale, OpenVPN etc. clients in parallel and Rouler will allow you to decide which app or app + IP goes though which network interface. As long as your VPN client sets up a network interface, Rouler can steer traffic through it. So your setup may look like this:

Chrome -> WireGuard VPN

Firefox 10.0.0.0/20 -> Tailscale

CS2 -> OpenVPN

Everything Else -> Ethernet

If you have a use case for this sort of setup and are comfortable with VPN configs, route tables, IP's and subnets, please take a look at https://rouler.io for further details and a beta key.

If you have any questions please contact me through the websites email or reply here.

Thank you

Hallo, ich hab jetzt viel rum gesucht aber nicht mein Problem und demnach auch nicht Lösung gefunden. Vllt kann mir hier jemand helfen.

Fehlerbild:
Sobald ich mich innerhalb eines WLAN (Hochschul-WLAN oder das meiner Unterkunft) befinde und mich mit meinem Heimatnetzwerk (Fritzbox-Gegenstelle) verbinden will, kommt die Meldung "DNS-Hostname kann nicht aufgelöst werden.

Sowohl mein Notebook, Smartphone und Tablet, haben verschiedene WG-Peers. Die meisten haben eine direkte IP-Adresszuweisung sodass keine DNS auflösung nötig ist. Der Peer der zu mir nach Hause in die Fritzbox geht muss allerdings über DynDNS aufgelöst werden.

Die Auflösung Mittels DynDNS funktioniert auch einwandfrei und nslookup abfragen geben auch immer direkt die richtigen Adressen zurück. Wenn mein Handy oder andere oben genannten Geräte im mobilen Netzwerk hängen, dann wird die WG-Verbindung ebenfalls ohne Probleme hergestellt.

Befinde ich mich aber jetzt in einem WLAN und versuche den WG-Peer mit der DynDNS-Adresse aufzubauen, dann kommt wieder der Fehler ausgegeben. Nehme ich zum testen einen anderen Peer mit direkter IP Zuweisung, wird dieser Tunnel wieder Problemlos etabliert. Es hakt also an der Namensauflösung.

Hab schon versucht an den DNS, Allowed IP´s etc. rumspielen aber ich komme nicht hinter, wo das Problem liegt, weswegen ich in öffentlichen WLAN Umgebungen keine VPN Verbindung aufbauen kann.

Hat da jemand das gleiche schonmal gehabt und Lösungen gefunden?

I have a TV at my daughters, its wireless and she has internet via wireless (ATT Home), and I have Startlink with wifi in home.

I would like her to be able to access my network to use plex, netflix, etc from my network.

My confusion comes in that her device would need to connect to a router via wifi, and then connect to her internet via wifi. The vpn server at my house would connect via wireless as well.

I was thinking 2 of these?

ax1500 travel router

https://www.amazon.com/AX1500-Portable-Travel-Router-Dual-Band/dp/B0GLP6QL6R/ref=sr_1_11?crid=39KF4T3QSGCTS&dib=eyJ2IjoiMSJ9.MFGCy_vso6nmjxgaaRCHIj5LbFQP7c082rgIRRYGawXw2znWYrozsW14fgvNMGMXjM35Cdyi_6dnHuDBwXLOqq9AcR43JEgQPfWFqBoOdKHlxWiqqoA5kDVi_YIhrmfLi51CckPwh_JyosuZb9lX5pS_nM9-bswqzGoenqT5owQgRdYf_RMxAYx7TwsSSw8QKnW8i8G0tUIaFAyQ3WX261SEBYv-G3CQPoRC8n5xXXs.3wU1oZ2iisuiVWeRtMQ_64MtGB75XureUUqNG-DTemY&dib_tag=se&keywords=wireguard&qid=1792186849&sprefix=wireguar%2Caps%2C207&sr=8-11

or two of these

gl-inet-gl-ar300m16

https://www.amazon.com/GL-iNet-GL-AR300M16-Pre-installed-Performance-Programmable/dp/B0777L5YN6/ref=sr_1_12?crid=39KF4T3QSGCTS&dib=eyJ2IjoiMSJ9.MFGCy_vso6nmjxgaaRCHIj5LbFQP7c082rgIRRYGawXw2znWYrozsW14fgvNMGMXjM35Cdyi_6dnHuDBwXLOqq9AcR43JEgQPfWFqBoOdKHlxWiqqoA5kDVi_YIhrmfLi51CckPwh_JyosuZb9lX5pS_nM9-bswqzGoenqT5owQgRdYf_RMxAYx7TwsSSw8QKnW8i8G0tUIaFAyQ3WX261SEBYv-G3CQPoRC8n5xXXs.3wU1oZ2iisuiVWeRtMQ_64MtGB75XureUUqNG-DTemY&dib_tag=se&keywords=wireguard&qid=1792186849&sprefix=wireguar%2Caps%2C207&sr=8-12

Edit: for some reason I changed the mobile hotspot info on my phone from "Phone MAC" to "randomized MAC". When I reverted the change it started working again...

I have a Wireguard VPN server set up on my Ubiquiti UDM-Pro. I have several clients generated that have all worked flawlessly until a few weeks ago. My laptop on Win11 just stopped working. I just checked my Android app and it's connected and working (UDM dashboard shows 1 client connected and I can access LAN resources from the phone).

I noticed one weird thing... In my troubleshooting, I removed the client entry on the UDM Pro for the tunnel for my laptop and deleted the tunnel on my WG Windows app. I re-created the client tunnel on the UDM pro, downloaded the config, saved, and applied changes on the VPN options page. When I click back into the VPN setup page, the client entry for the tunnel for my phone (correctly) doesn't allow the config file to be downloaded again. But weirdly, I can click back into the client config for the laptop tunnel, and the QR code and download link for the config file is still available... This seems like a very good lead on the problem. Any thoughts?

https://github.com/wg-ez/wg-ez

(Sorry for my english as a french guy)

Hi everyone, I’m the developer of wg-ez, a lightweight WireGuard manager with a modern Web UI, written in Rust.

I decided to build wg-ez because i liked the "almost" simplicity of wg-easy but the UI felt dated + a full Node.js wasting my ram for a dashboard that i open once every two months felt like a waste of RAM in that period. I also wanted zero-effort networking: wg-ez automatically checks if your container can route IPv4 and IPv6 with zero manual config to have a better experience out of the box than wg-easy.

Few important points:

• ~1-2MB of RAM usage: Written in Rust with zero JS runtime overhead.
• Modern Web UI: A clean, fast, and responsive interface to manage peers.
• Smart IPv4/IPv6 auto-detection: Tests container routing automatically and uses IPv6 if available, or seamlessly falls back to IPv4 with zero configuration.
• Instant client provisioning: Generate configuration and QR code with only ipv4 or ipv6 or ipv4+v6 based on the server network.
• Per client Firewall to avoid your family and friends doing some stupid stuff with your network

I’d love to get feedback on how it runs on your setups.

Happy to answer questions here if you have or implement some feature you request if they are pertinent!

I had port 51821 open because I thought I had to open UDP and TCP to make my VPN work.

Apparently, that was a bad idea because I had that shit on my wireguard interface (I use wg-easy)

Was that the main source ? The only services I expose directly to the web (with reverse proxy of course) are jellyfin, jellyseer and termix (with strong password) and a geographic bloc.

Edit : Ok, TCP 51821 is my admin webpage and there is probably a vuln to bypass the admin password. I thought I had to open it, spoiler I didn't.

Equipment:

SB5100 cable modem --> Google wifi (1st gen) --> Managed switch -->Raspberry pi 3b+ (wireguard) --> remote desktop to win 11 boxes.

Config:

I installed wireguard on a pi 3b+ about 3 weeks ago where I work since a port sniffer found the open ports I was using to remote into a few win 11 boxes (I know, bad me. I'm not a pro!). I used pivpn and everything worked out of the box except for remote desktop. After searching around, I decided to go with split tunnel where I configured AllowedIPs = 10.x.x.x/24, 192.168.x.1/24 on the peer side and bam, full access without port forwarding and I can ssh directly into the two RPIs I have running on the work network (could not do this with full tunnel, came back with port 22 error).

Problem or area of confusion:

Prior to going with split tunnel, if I used whatismyIP, it would come back as the work IP address. OK, life is good. Now, with split tunnel, it comes back as my home IP address which seems normal since as I understand it, browsing is routed locally. But here's the thing, I'm running pihole on a second pi 3b+ at work and I have domain blocking (facebook, reddit :), instagram, etc.) so when I'm connected at home, those domains are block. I'm also running pihole at home but when I navigate to the admin page, it takes me to the pihole running on my work network. I can ping win 11 boxes, printers, etc. on work network so it seems like my traffic is being routed through the vpn yet I thought split tunnel kept browsing local.

Question:

Where is my traffic being routed? Is it flowing through the tunnel and I'm secure or is routed through my home network despite acting like I'm on the work network? From what I understand of split tunnel, it should be routed through my home network but that would not explain why I'm connecting to pihole running on my work network. It doesn't matter when I'm home as it's a secure network but when I'm on a public wifi network, I'd like to understand if I'm protected or exposed. Did I accidently configure wireguard to work as I had hoped and I'm routing all traffic through the VPN tunnel? Or am I way off and don't understand what's going on because I'm not a pro?!? Thanks.

i have standard WireGuard for test and configured on router. if i have gateway 10.10.10.10/27 and i need to exclude one of the 30 IPs from using the vpn for example 10.10.10.19, now if i set the allowed IPs 0.0.0.0/5 or the default, what list of my private IPs i should add in the allowed IPs to let all 29 private IPs of the private lan to use the WireGuard and exclude one of them not to do 10.10.10.19 or bypass. .
Please if i missed or have some mistakes in my post, sorry for that, you can tell me what to and how to fix it.

Thank you

Hi everyone, I’m the developer of WireTunnels, a native macOS app written in Swift for managing WireGuard configurations from the menu bar.

I shared the first version here a few months ago and have continued maintaining it. I’ve just released version 1.0.6, so I wanted to share what’s changed since that initial post.

The app supports:

• Multiple WireGuard tunnels connected simultaneously.
• Split DNS, so selected internal domains use a tunnel’s DNS while other queries use the normal resolver.
• Wi-Fi SSID rules for connecting and disconnecting tunnels.
• Shared tunnels for different user accounts on the same Mac.
• Apple Shortcuts actions for connecting, disconnecting and checking tunnel status.
• And much more

It’s free and open source under Apache 2.0, requires macOS 14+, and doesn’t require an account. It works with your existing WireGuard configurations; you provide your own server or endpoints.

Source, installation details and releases:
https://github.com/FMDigitech/WireTunnels

I’d particularly like feedback from people accessing separate home, work or lab networks on a Mac. Multiple tunnels still need compatible routes, so I’m interested in hearing about your actual setups and any issues you encounter.

Happy to answer questions here!

i used https://lanrat.github.io/wireguard-warp-generator/ to generate a cloudflare warp .conf file but it doesnt work i also tried to use vpnbook to get a .conf file but the same error happenes : 2026-10-10 21:02:33.494: [TUN] [AM_TIRED] Handshake for peer 5 (162.159.192.1:2408) did not complete after 5 seconds, retrying (try 2)

So I recently got ProtonVPN. I've been looking at options to integrate it for my entire home network

One of the issues i'm seeing with a lot of wifi routers is that once wireguard is turned on the wifi and lan speeds drop. It seems that this happens because for some reason hardware acceleration is disabled on a lot of routers when wireguard is active

I'm sure that you guys could recommend some affordable routers that won't have a major performance hit. I would like tj stay under $150

The other option i'm considering is using an older pc i'm running it as a VPN server... though it's been many years since i've done anything like this. And i'm not quite sure where to start.

Looking for suggestions please

So I recently got ProtonVPN. I've been looking at options to integrate it for my entire home network

One of the issues i'm seeing with a lot of wifi routers is that once wireguard is turned on the wifi and lan speeds drop. It seems that this happens because for some reason hardware acceleration is disabled on a lot of routers when wireguard is active

I'm sure that you guys could recommend some affordable routers that won't have a major performance hit. I would like tj stay under $150

The other option i'm considering is using an older pc i'm running it as a VPN server... though it's been many years since i've done anything like this. And i'm not quite sure where to start.

Looking for suggestions, please.

Also my isp maxes out at 150 mb/s... based on that, I don't have very huge requirements for router or vpn Server

Hi, I been working on project, a small open-source self-hosted web panel for installing and managing VPN services on a single Ubuntu server.

GitHub: https://github.com/yulcaribe/vpnengine

It currently supports:

• WireGuard
• OpenVPN
• IKEv2/IPsec with MSCHAPv2
• User/device management
• Start / stop / restart / remove controls -Automatic HTTPS using a Let's Encrypt IP certificate when possible

The installer only installs the management panel. VPN's are installed separately from the web admin panel.

I tested on Ubuntu 24 and 26.

Edit,: Added Debian 12 and 13.

curl -fsSL https://raw.githubusercontent.com/yulcaribe/vpnengine/main/install.sh | sudo bash

The project is still new, so I’m mainly looking for people willing to test it on different VPS providers and setups.

I would appreciate for feedbacks.

Othe distributions are planned.

Repo, with screenshots: https://github.com/lanceranara13/homewarp

What problem it solves

I host game servers for friends on a box at home. My options for letting them in were to forward ports and hand out my home IP, which does not work at all behind CGNAT, or to bolt a tunnel onto a panel and maintain both. Homewarp is a game server panel that includes the tunnel. The home machine dials out to a small VPS over WireGuard, the VPS forwards the game ports back, and players only ever see the VPS's address. Nothing changes on the router.

Why not an existing FOSS tool

• Pterodactyl and Pelican are good panels, and Homewarp reads their eggs, but they leave ingress to you.
• Pangolin does the tunnel well but is HTTP-first and is not a game panel, so you end up running two products.
• frp, rathole and playit.gg are tunnels only, and the game server usually sees the tunnel's address instead of the player's, which breaks IP bans and rate limits unless the game speaks PROXY protocol. Most do not.
• A hand-rolled WireGuard plus nftables setup does all of this, and is what I ran before. Homewarp is that setup automated: one command on the VPS, keys rotated, rules rebuilt after a reboot at either end.

Why it is relevant here

The parts I think this sub will care about are the network ones:

• Kernel WireGuard and nftables DNAT do the forwarding. Packets never pass through a userspace proxy, so every protocol keeps the real client IP.
• The VPS is a dumb forwarder. It can reach the forwarded game ports at home and nothing else, and it stores no worlds or credentials. Replacing it is one command.
• Each game server runs in a container that is non-root, has no capabilities, a read-only root, memory and process limits, and is firewalled off from every private range, so a compromised game server cannot reach the router, the NAS or the panel.
• More than one VPS can be connected, each with its own tunnel, and each server is routed through the one you choose.
• Releases are signed and the installers verify the signature before running anything.

Requirements: Linux on x86-64 or ARM64 with Docker and the Compose plugin at home. The VPS is optional and needs a public IPv4 and nftables. 1 vCPU and 512 MB is enough.

Limits

Still early. One home machine only, Linux only, and the Minecraft extras (sleep when empty, mod installs) are Java only. AGPL-3.0, no paid tier.

I would like criticism of the tunnel and isolation design in particular. The security model is written up in PLAN.md in the repo.

I've noticed a near 100% miss rate for OD Tunnels starting around the time that iOS 27 went live for the general population. The tunnel itself works fine but the actual trigger for it seems gunked up in some way. It lists itself as active when out and about but no traffic is going over the wire; once it's toggled off and back on it works as expected.

Has anyone else been seeing this sort of behavior?