Split Tunnel.

[tranquivox69 27]

Ok, what I did...

I modified the last version of your script like this:
 

#!/bin/bash

PORT=$1
if [ "$PORT" = "" ]; then PORT=3128; fi

# helper function
token () {
N=$1
shift
eval echo \$${N}
}

echo
echo === scanning routing table to set VPN gateway variables ...

# determine VPN gateway IPv4 address and interface name
ip -4 route show
ROUTE4=`ip -4 route show 0.0.0.0/1`
#echo ROUTE4=$ROUTE4
GATEWAY_IF=`token 3 $ROUTE4`
echo GATEWAY_IF=$GATEWAY_IF

# determine VPN local IPv4 address
ip -4 addr show dev $GATEWAY_IF
ADDR4=`ip -4 addr show dev $GATEWAY_IF | grep global`
GATEWAY_LOCAL4=`token 2 $ADDR4`
GATEWAY_LOCAL4=${GATEWAY_LOCAL4%%/*}
echo GATEWAY_LOCAL4=$GATEWAY_LOCAL4
ip -6 addr show dev $GATEWAY_IF
# determine VPN local IPv6 address
ADDR6=`ip -6 addr show dev $GATEWAY_IF | grep global`
GATEWAY_LOCAL6=`token 2 $ADDR6`
GATEWAY_LOCAL6=${GATEWAY_LOCAL6%%/*}
echo GATEWAY_LOCAL6=$GATEWAY_LOCAL6

NAME=squid_vpn_${PORT}

mkdir -p ~/Documents/VPNscripts/squid_service/tmp > /dev/null

cat <<EOF >~/Documents/VPNscripts/squid_service/tmp/${NAME}.conf
tcp_outgoing_address $GATEWAY_LOCAL4
tcp_outgoing_address $GATEWAY_LOCAL6
udp_outgoing_address $GATEWAY_LOCAL4
udp_outgoing_address $GATEWAY_LOCAL6
# quad9 DNS
dns_nameservers 9.9.9.9 149.112.112.112 2620:fe::fe 2620:fe::9
# Cloudflare DNS
#dns_nameservers 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001
# Google DNS
#dns_nameservers 8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844
http_port 127.0.0.1:${PORT}
pid_filename $HOME/Documents/VPNscripts/squid_service/tmp/${NAME}.pid
acl localnet src 127.0.0.1
http_access allow localnet
shutdown_lifetime 1 seconds
buffered_logs off
cache deny all
access_log none
cache_store_log none
cache_log /dev/null
netdb_filename none
via off
forwarded_for delete
EOF

echo
echo === contents of squid configuration file ...

cat ~/Documents/VPNscripts/squid_service/tmp/${NAME}.conf

echo
echo === starting squid ...

pushd ~/Documents/VPNscripts/squid_service/tmp > /dev/null
SQUID_BIN=/usr/sbin/squid
echo SQUID_RUN=$SQUID_BIN
$SQUID_BIN -f ~/Documents/VPNscripts/squid_service/tmp/${NAME}.conf -N -k kill
$SQUID_BIN -f ~/Documents/VPNscripts/squid_service/tmp/${NAME}.conf -N -n SQUID${PORT}
popd > /dev/null

echo
echo === ... squid has stopped

Adding options to avoid logging, not even in background.

I call this script at the end of vpn_gateway_route, so once the VPN is up the proxy starts. I remmed out the first instruction to kill squid because (see here) I put that at the end of vpn_gateway_show (hardcoded, as variables are not available, in any case I have no intention of changing the port, no big deal).

In Eddie I have three Events configured.

Session Start - launches vpn_gateway_hide
VPN Up - launches vpn_gateway_ route (which ends by calling the proxy script above, activating squid proxy)
Session End - launches vpn_gateway_show (which ends by killing the squid process)

In process monitor I see squid starting once the VPN is up and closing once the VPN is down. Together with the proxy extension on Firefox this is now pretty much seamless.

I couldn't have done anything without your help, nothing at all... so I remain immensely grateful. Thanks!

One thing that I'm pretty sure about is that this configuration leaks DNS requests somehow.

If I don't set any DNS at all in Eddie (DNS Switch mode disabled) I see my home router DNS there.
If I set DNS in Eddie (Automatic switch mode, while adding quad9 DNS addresses), I see in IPleak a mix of DNS addresses from my country and from the VPN's exit point country. Not my home router DNS (which I set to Cloudflare to avoid confusion in the analysis).

Thought it was worth mentioning.

But again: thank you!

[NaDre 157]

On 4/12/2023 at 5:35 AM, tranquivox69 said:

...

One thing that I'm pretty sure about is that this configuration leaks DNS requests somehow.

If I don't set any DNS at all in Eddie (DNS Switch mode disabled) I see my home router DNS there.
If I set DNS in Eddie (Automatic switch mode, while adding quad9 DNS addresses), I see in IPleak a mix of DNS addresses from my country and from the VPN's exit point country. Not my home router DNS (which I set to Cloudflare to avoid confusion in the analysis).

Thought it was worth mentioning.

But again: thank you!

EDIT: I know now that this leak is coming from Firefox. Not SQUID. If you set "DNS over HTTPS" to "https://dns.google/dns-query" while everything else points somewhere else, then the "leak" is to Google. So Firefox is doing DNS look ups without relying on SQUID.

Yeah. I think the binding to the specified UDP outgoing address, which is used for DNS, is not fully respected by the DNS module in squid. At some point it makes a DNS look up request in the usual way which will use the default DNS server.

I didn't want to put you off. I don't see this as a big issue. Particularly if you set the default DNS for your system to Cloudflare, Google or Quad9. That is actually why I suggested it.

If I feel energetic sometime I will chase it down. But then I would have to compile squid myself. I doubt I would ever convince the development team to incorporate some fix I offered.

I will look at the scripts to see if I can make the scanning for addresses more bullet-proof. I don't like that these work with Eddie but not openvpn or wq-quick. I would like to believe they will work with any VPN client/wrapper.
 

[tranquivox69 27]

1 hour ago, NaDre said:

I didn't want to put you off. I don't see this as a big issue. Particularly if you set the default DNS for your system to Cloudflare, Google or Quad9. That is actually why I suggested it.

Oh, don't worry! It's in my nature to try to understand things, so I investigate and report. That doesn't have to lead to any action. Considering the huge amount of time you've dedicated to help me... I feel the least I can do is test stuff thoroughly. I have to say I'm quite proud of the current solution I have, which wouldn't have been possible without your huge help and coding.

Looking at the code, the thing that stopped me from getting the gateways in an automated way was solved through %%/*
Is that a regular expression or something similar?

Next step, I'll try by myself, is seeing whether I can do something similar when using Wireguard protocol from Eddie. But that's not "urgent" (nothing was but still...).

Edit: also thanks for Quad9, which I wasn't familiar with. Seems ideal for VPN use.

[NaDre 157]

1 hour ago, tranquivox69 said:

...
Looking at the code, the thing that stopped me from getting the gateways in an automated way was solved through %%/*
Is that a regular expression or something similar?
...

Yes. String manipulation. Drops "/" and anything following it from the end of the string. squid did not like having the subnet mask.

It is a bash-ism. A bash extension from what a POSIX compliant shell needs to provide. Do "man bash". For background scripts I usually try to use "/bin/sh" rather than "/bin/bash". Bash is huge. All kinds of bells and whistles. But I could not remember how to do that string trick in "/bin/sh".

I will probably look at how to use "/bin/sh" in that script too.
 

[NaDre 157]

44 minutes ago, NaDre said:

...

It is a bash-ism.
...

Oops. I lied. %% is not a bash-ism. But "pushd" used in that script is. So I will change that in order to use "/bin/sh".
 

[tranquivox69 27]

22 hours ago, tranquivox69 said:

I remmed out the first instruction to kill squid because I put that at the end of vpn_gateway_show

A partial mistake. The instruction needs to stay there, because, if Eddie has  to switch server, things get messed up for the proxy. It stays there but, at the same time, I leave it at the end of vpn_gateway_show, so as not to leave a useless process if I close the VPN. I modified that post and linked to this one for explanation.

[tranquivox69 27]

16 hours ago, NaDre said:

Drops "/" and anything following it from the end of the string. squid did not like having the subnet mask.

Yeah, I got that squid did not want that there... I simply did not know how to manipulate the string 😕

Edit: also... a day has passed, finally a good night of sleep and... god, these few days, your huge help, brought me back to the days when the internet was an incredible and wonderful place. It can still be and you showed me that. Thanks for that too.

[NaDre 157]

3 hours ago, tranquivox69 said:

... brought me back to the days when the internet was an incredible and wonderful place. ...

Hacking can be a good hobby. Just don't try doing it for a living. It won't be as much fun.
 

[tranquivox69 27]

On 4/12/2023 at 5:42 PM, tranquivox69 said:

Next step, I'll try by myself, is seeing whether I can do something similar when using Wireguard protocol from Eddie. But that's not "urgent" (nothing was but still...).

Ended up not even trying Wireguard, as with the current OpenVPN based setup my gigabit bandwidth gets saturated anyway.
I'm astonished at the speed improvement brought by Linux when compared to Windows. Even more so considering I'm using a far less powerful processor.

[tranquivox69 27]

On 4/13/2023 at 3:43 PM, NaDre said:

Hacking can be a good hobby. Just don't try doing it for a living. It won't be as much fun.
 

Hi NaDre. I've discovered that I need to open my torrent client port on Linux Mint firewall to be connectable. Is this expected behavior? I was led to believe that that was a Windows only thing.

If I disable the events-based scripts, the port is seen as open for IPv4 but not for IPv6. If I have the scripts active (and the port open in the firewall), both IPv4 and IPv6 report the port as open and client as connectable.

This is how Eddie is configured for networking:



And this is the port forwarding configuration, here on AirVPN website:


 

[NaDre 157]

2 hours ago, tranquivox69 said:

Hi NaDre. I've discovered that I need to open my torrent client port on Linux Mint firewall to be connectable. Is this expected behavior? I was led to believe that that was a Windows only thing.

If I disable the events-based scripts, the port is seen as open for IPv4 but not for IPv6. If I have the scripts active (and the port open in the firewall), both IPv4 and IPv6 report the port as open and client as connectable.

...

If you have UFW ("Uncomplicated Firewall") installed, then I think you will need to do something. It seems to set up an elaborate set of netfilter/nftables rules that block things by default.

It seems that many distros install UFW by default now. Same when you set up a VPS. I just remove it. I am familiar with Netfilter/iptables/nftables. I just do what I feel I need for myself. But then I am probably a dinosaur.

I am not sure what you mean by "event-based scripts". If you mean that you did not set up the source-address routing, then I am not surprised things did not work. All of my experience says this is needed.
 

[tranquivox69 27]

18 minutes ago, NaDre said:

If you have UFW ("Uncomplicated Firewall") installed, then I think you will need to do something. It seems to set up an elaborate set of netfilter/nftables rules that block things by default.

It seems that many distros install UFW by default now. Same when you set up a VPS. I just remove it. I am familiar with Netfilter/iptables/nftables. I just do what I feel I need for myself. But then I am probably a dinosaur.

On Mint I found GUFW installed by default and I use that https://costales.github.io/projects/gufw/. And unless I misunderstand things, yeah, it's a GUI for UFW.
 

20 minutes ago, NaDre said:

I am not sure what you mean by "event-based scripts". If you mean that you did not set up the source-address routing, then I am not surprised things did not work. All of my experience says this is needed.

No, no, I am using the source-address routing scripts. I wrote event-based because they are set up like this:

[NaDre 157]

58 minutes ago, tranquivox69 said:

...
No, no, I am using the source-address routing scripts. I wrote event-based because they are set up like this:
...

3 hours ago, tranquivox69 said:

...
If I disable the events-based scripts, the port is seen as open for IPv4 but not for IPv6. If I have the scripts active (and the port open in the firewall), both IPv4 and IPv6 report the port as open and client as connectable.
...

So you meant that when you try just using the VPN as the default gateway, then IPv6 seems not to be forwarded? You could temporarily disable UFW and try again. Just to see if UFW is still doing something strange.
 

[tranquivox69 27]

4 hours ago, NaDre said:

So you meant that when you try just using the VPN as the default gateway, then IPv6 seems not to be forwarded? You could temporarily disable UFW and try again. Just to see if UFW is still doing something strange

What happens is:

Using the scripts
If I don't open the relevant port in the firewall, the torrent client is not connectable. The port appears closed to the outside, checked with AirVPN tool here on the website.
If I open the relevant port in the firewall, the torrent client is connectable and the port is open on both IPv4 and IPv6.

Not using the scripts
If I don't open the relevant port in the firewall, the torrent client is connectable and the port appears open for IPv4 but closed for IPv6

I guess the question is: do I risk anything by opening the port on UFW? To note: on Windows I had always needed to open the port on the Windows Firewall, when using similar scripts for routing.

[NaDre 157]

9 minutes ago, tranquivox69 said:

...

I guess the question is: do I risk anything by opening the port on UFW? To note: on Windows I had always needed to open the port on the Windows Firewall, when using similar scripts for routing.

In Windows you could restrict access to the port to qBittorrent itself. In Linux the port will accessible by any program that listens on that port. So perhaps a little more risky. But you do want to be connectable. I think the risk is pretty tiny. There are ways to see everything that is listening - "sudo ss -lutp" on the  command line for example. Get rid of anything you don't really need.
 

[tranquivox69 27]

On 6/23/2023 at 9:51 PM, NaDre said:

In Windows you could restrict access to the port to qBittorrent itself. In Linux the port will accessible by any program that listens on that port. So perhaps a little more risky. But you do want to be connectable. I think the risk is pretty tiny. There are ways to see everything that is listening - "sudo ss -lutp" on the  command line for example. Get rid of anything you don't really need.
 

I'm not sure if I get what you mean correctly but listening on qBittorrent's port I see only qBittorrent, using the command you suggested. Which I suppose it's how it's supposed to be.

[JohnDoe1941 0]

Need help, new to airvpn, I was with mullvad before and split tunneling on windows was easy, Now with airvpn, I need to exclude steam completely from the VPN, also need to exclude TruckersMP (its a multiplayer mod for a game, when it detects I use a VPN, they kick me out because they think I try to ban evade) the problem is, there's no ways to know their IP addresses because they want to avoid DDOS so the exact IP of the game servers are kept a secret, we only know they are located in europe for most of them.

[tranquivox69 27]

On 4/12/2023 at 4:32 PM, NaDre said:

EDIT: I know now that this leak is coming from Firefox. Not SQUID. If you set "DNS over HTTPS" to "https://dns.google/dns-query" while everything else points somewhere else, then the "leak" is to Google. So Firefox is doing DNS look ups without relying on SQUID.

Yeah. I think the binding to the specified UDP outgoing address, which is used for DNS, is not fully respected by the DNS module in squid. At some point it makes a DNS look up request in the usual way which will use the default DNS server.

I didn't want to put you off. I don't see this as a big issue. Particularly if you set the default DNS for your system to Cloudflare, Google or Quad9. That is actually why I suggested it.

If I feel energetic sometime I will chase it down. But then I would have to compile squid myself. I doubt I would ever convince the development team to incorporate some fix I offered.

I will look at the scripts to see if I can make the scanning for addresses more bullet-proof. I don't like that these work with Eddie but not openvpn or wq-quick. I would like to believe they will work with any VPN client/wrapper.
 

Hi Nadre. Spent some time investigating these DNS leaks. As far as I can tell, setting network.trr.mode to 3 in Firefox seems to solve the issue. I set up Quad9 as DNS through network.trr.uri and I only see Quad9 addresses in DNS calls, none from my actual country.

[legitacc1234 5]

On 7/5/2023 at 6:32 PM, JohnDoe1941 said:

Need help, new to airvpn, I was with mullvad before and split tunneling on windows was easy, Now with airvpn, I need to exclude steam completely from the VPN, also need to exclude TruckersMP (its a multiplayer mod for a game, when it detects I use a VPN, they kick me out because they think I try to ban evade) the problem is, there's no ways to know their IP addresses because they want to avoid DDOS so the exact IP of the game servers are kept a secret, we only know they are located in europe for most of them.

https://github.com/TunnlTo 

[tranquivox69 27]

After reading our old conversation, it seems this error was due to squid not being running... but I could ignore that and everything was working... I will keep the old post below but I definitely need to gather more info before posting, because without the Eddie events automation I'm managing to make it work, or so it seems... I'll update things as I learn.

UPDATE: It seems solved. I had to modify the sudoers file compared to what it was before the upgrade. Before the scripts had problems with the sudo commands in them.
For reference, in case anybody has the same problem, I put this in sudoers (using sudo visudo):

tranquivox ALL=(ALL) NOPASSWD: /bin/ip

And then I had to change all "sudo ip" commands in the scripts with "sudo /bin/ip". This way they execute without asking a password (which is not even possible to input in the non interactive environment of Eddie's Events).

Took the time to do this with the new versions of the scripts. Don't know what changed in them but I'm glad to see that the lenghty discussion led to that nice page. You're a star!

OLD POST FOLLOWS

Hi@NaDre

I have upgrade from Mint 21.3 to Mint 22 and now the proxy script refuses to work...

I am getting
 

=== starting squid ...
SQUID_RUN=/usr/sbin/squid
2024/08/21 14:22:13| Processing Configuration File: /home/tranquivox/Documents/VPNscripts/squid_service/tmp/squid_vpn_3128.conf (depth 0)
2024/08/21 14:22:13| WARNING: HTTP requires the use of Via
2024/08/21 14:22:13| Current Directory is /home/tranquivox/Documents/VPNscripts/squid_service/tmp
2024/08/21 14:22:13| FATAL: failed to open /home/tranquivox/Documents/VPNscripts/squid_service/tmp/squid_vpn_3128.pid: (2) No such file or directory
    exception location: File.cc(191) open

Problem is... the squid_vpn_3128.pid file created by the script is absolutely there.

When running eddie-cli, I have the following output:
 

/usr/bin/eddie-ui -cli
. 2024.08.21 15:24:25 - Eddie version: 2.21.8 / linux_x64, System: Linux, Name: Linux Mint, Version: 22 (Wilma), Mono/.Net: 6.8.0.105 (Debian 6.8.0.105+dfsg-3.6ubuntu2 Sun Mar 31 02:55:28 UTC 2024); Framework: v4.0.30319
. 2024.08.21 15:24:25 - Command line arguments (3): path.resources="/usr/share/eddie-ui" path.exec="/usr/bin/eddie-ui" cli="True"
. 2024.08.21 15:24:26 - Reading options from /home/tranquivox/.config/eddie/default.profile
. 2024.08.21 15:24:27 - OpenVPN - Version: 2.6.9 - OpenSSL 3.0.13 30 Jan 2024, LZO 2.10 (/usr/sbin/openvpn)
. 2024.08.21 15:24:27 - SSH - Version: OpenSSH_9.6p1 Ubuntu-3ubuntu13.4, OpenSSL 3.0.13 30 Jan 2024 (/usr/bin/ssh)
. 2024.08.21 15:24:27 - SSL - Version: Initializing (/usr/bin/stunnel4)
. 2024.08.21 15:24:27 - curl - Version: 8.5.0 (/usr/bin/curl)
I 2024.08.21 15:24:27 - Press 'X' to Cancel, 'N' to connect/reconnect to the best available server.
I 2024.08.21 15:24:27 - Use -connect to start connection when application starts
I 2024.08.21 15:24:27 - Ready
I 2024.08.21 15:24:27 - Checking login ...
! 2024.08.21 15:24:27 - Logged in.
. 2024.08.21 15:24:28 - Collect information about AirVPN completed
nI 2024.08.21 15:24:31 - Server switch requested from keyboard.
I 2024.08.21 15:24:31 - Session starting.
I 2024.08.21 15:24:31 - Running event session.start
=== adding routing table entries to hide VPN ...

=== IPv4 routing table before ...
default via 192.168.178.1 dev enp88s0 proto dhcp src 192.168.178.46 metric 100
192.168.178.0/24 dev enp88s0 proto kernel scope link src 192.168.178.46 metric 100

=== IPv6 routing table before ...
2a07:7e81:3d59::/64 dev enp88s0 proto ra metric 100 pref medium
2a07:7e81:3d59::/48 via fe80::b2f2:8ff:fe9e:174c dev enp88s0 proto ra metric 100 pref medium
fe80::/64 dev enp88s0 proto kernel metric 1024 pref medium
default via fe80::b2f2:8ff:fe9e:174c dev enp88s0 proto ra metric 100 pref medium

=== scanning routing table to set gateway variables ...

=== IPv4 gateway ...
GATEWAY_IP4=192.168.178.1
GATEWAY_IF4=enp88s0

=== IPv6 gateway ...
GATEWAY_IP6=fe80::b2f2:8ff:fe9e:174c
GATEWAY_IF6=enp88s0

=== adding entries to IPv4 routing table ...
I 2024.08.21 15:24:31 - Checking authorization ...
[sudo] password for tranquivox: ! 2024.08.21 15:24:32 - Connecting to Alzirr (Netherlands, Alblasserdam)
. 2024.08.21 15:24:32 - Routes, add 213.152.187.207/32 for interface "enp88s0".
. 2024.08.21 15:24:32 - Routes, add 213.152.187.207/32 for interface "enp88s0", already exists.
. 2024.08.21 15:24:32 - WireGuard > Setup start
. 2024.08.21 15:24:32 - WireGuard > Setup complete
. 2024.08.21 15:24:32 - WireGuard > Setup interface
. 2024.08.21 15:24:33 - WireGuard > Received first handshake
. 2024.08.21 15:24:33 - DNS of the system updated to VPN DNS (Rename method: /etc/resolv.conf generated)
. 2024.08.21 15:24:33 - Routes, add 0.0.0.0/1 for interface "Eddie".
. 2024.08.21 15:24:33 - Routes, add 128.0.0.0/1 for interface "Eddie".
. 2024.08.21 15:24:33 - Routes, add ::/1 for interface "Eddie".
. 2024.08.21 15:24:33 - Routes, add 8000::/1 for interface "Eddie".
. 2024.08.21 15:24:33 - Routes, add 213.152.187.205/32 for interface "Eddie".
. 2024.08.21 15:24:33 - Routes, add 2a00:1678:1337:7a20:5bfe:98a:a67c:3dd3/128 for interface "Eddie".
. 2024.08.21 15:24:33 - Flushing DNS
I 2024.08.21 15:24:34 - Checking route IPv4
I 2024.08.21 15:24:34 - Checking route IPv6
I 2024.08.21 15:24:34 - Running event vpn.up
! 2024.08.21 15:24:34 - Connected.

=== scanning routing table to set VPN gateway variables ...
0.0.0.0/1 dev Eddie scope link
default via 192.168.178.1 dev enp88s0 proto dhcp src 192.168.178.46 metric 100
128.0.0.0/1 dev Eddie scope link
192.168.178.0/24 dev enp88s0 proto kernel scope link src 192.168.178.46 metric 100
213.152.187.205 dev Eddie scope link
213.152.187.207 via 192.168.178.1 dev enp88s0
GATEWAY_IF=Eddie
9: Eddie: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 10.162.255.170/32 scope global Eddie
       valid_lft forever preferred_lft forever
GATEWAY_LOCAL4=10.162.255.170/32
9: Eddie: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet6 fd7d:76ee:e68f:a993:7378:9c3b:9a92:a114/128 scope global
       valid_lft forever preferred_lft forever
GATEWAY_LOCAL6=fd7d:76ee:e68f:a993:7378:9c3b:9a92:a114/128

=== deleting IPV4 route table 9999 ...
! 2024.08.21 15:24:34 - Disconnecting
. 2024.08.21 15:24:35 - WireGuard > Stop request received
. 2024.08.21 15:24:35 - WireGuard > Stopping
. 2024.08.21 15:24:35 - WireGuard > Completed
. 2024.08.21 15:24:35 - Routes, delete 0.0.0.0/1 for interface "Eddie", not exists.
. 2024.08.21 15:24:35 - Routes, delete 128.0.0.0/1 for interface "Eddie", not exists.
. 2024.08.21 15:24:35 - Routes, delete ::/1 for interface "Eddie", not exists.
. 2024.08.21 15:24:35 - Routes, delete 8000::/1 for interface "Eddie", not exists.
. 2024.08.21 15:24:35 - Routes, delete 213.152.187.207/32 for interface "enp88s0".
. 2024.08.21 15:24:35 - Routes, delete 213.152.187.205/32 for interface "Eddie", not exists.
. 2024.08.21 15:24:35 - Routes, delete 2a00:1678:1337:7a20:5bfe:98a:a67c:3dd3/128 for interface "Eddie", not exists.
. 2024.08.21 15:24:36 - Routes, delete 213.152.187.207/32 for interface "enp88s0", not exists.
. 2024.08.21 15:24:36 - DNS of the system restored to original settings (Rename method)
. 2024.08.21 15:24:36 - Connection terminated.
I 2024.08.21 15:24:36 - Checking authorization ...
! 2024.08.21 15:24:36 - Connecting to Alzirr (Netherlands, Alblasserdam)
. 2024.08.21 15:24:36 - Routes, add 213.152.187.207/32 for interface "enp88s0".
. 2024.08.21 15:24:36 - Routes, add 213.152.187.207/32 for interface "enp88s0", already exists.
. 2024.08.21 15:24:36 - WireGuard > Setup start
. 2024.08.21 15:24:36 - WireGuard > Setup complete
. 2024.08.21 15:24:36 - WireGuard > Setup interface
. 2024.08.21 15:24:37 - WireGuard > Received first handshake
. 2024.08.21 15:24:37 - DNS of the system updated to VPN DNS (Rename method: /etc/resolv.conf generated)
. 2024.08.21 15:24:37 - Routes, add 0.0.0.0/1 for interface "Eddie".
. 2024.08.21 15:24:37 - Routes, add 128.0.0.0/1 for interface "Eddie".
. 2024.08.21 15:24:38 - Routes, add ::/1 for interface "Eddie".
. 2024.08.21 15:24:38 - Routes, add 8000::/1 for interface "Eddie".
. 2024.08.21 15:24:38 - Routes, add 213.152.187.205/32 for interface "Eddie".
. 2024.08.21 15:24:38 - Routes, add 2a00:1678:1337:7a20:5bfe:98a:a67c:3dd3/128 for interface "Eddie".
. 2024.08.21 15:24:38 - Flushing DNS
I 2024.08.21 15:24:38 - Checking route IPv4
I 2024.08.21 15:24:38 - Checking route IPv6
I 2024.08.21 15:24:38 - Running event vpn.up
! 2024.08.21 15:24:38 - Connected.

=== scanning routing table to set VPN gateway variables ...
0.0.0.0/1 dev Eddie scope link
default via 192.168.178.1 dev enp88s0 proto dhcp src 192.168.178.46 metric 100
128.0.0.0/1 dev Eddie scope link
192.168.178.0/24 dev enp88s0 proto kernel scope link src 192.168.178.46 metric 100
213.152.187.205 dev Eddie scope link
213.152.187.207 via 192.168.178.1 dev enp88s0
GATEWAY_IF=Eddie
10: Eddie: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 10.162.255.170/32 scope global Eddie
       valid_lft forever preferred_lft forever
GATEWAY_LOCAL4=10.162.255.170/32
10: Eddie: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet6 fd7d:76ee:e68f:a993:7378:9c3b:9a92:a114/128 scope global
       valid_lft forever preferred_lft forever
GATEWAY_LOCAL6=fd7d:76ee:e68f:a993:7378:9c3b:9a92:a114/128

=== deleting IPV4 route table 9999 ...

I don't know if there's any way for me to further debug this. I have spent two hours thinking about it, with no luck (surely due to my abysmal skills).

It would be so, so nice if Eddie included routing for specific programs somehow. 😞