Wireguard, how *not* to route all traffic through the VPN and also forward ports?

[Alonzo 0]

Hi,

I'm trying to setup wireguard in a way that only applications i set to use the wg's interface will route its traffic through the VPN, with port forwarding enabled. I was under the impression that something like the following should work, but it doesn't:
 

[Interface]
Address = 10.184.118.49
PrivateKey = [redacted]
MTU = 1320
DNS = 9.9.9.9

[Peer]
PublicKey = [redacted]
PresharedKey = [redacted]
Endpoint = ip:port
AllowedIPs = 10.184.118.0/24
PersistentKeepalive = 15

If I set the AllowedIPs to 0.0.0.0/0 then I can port forward, but all my traffic is routed over the VPN, and I don't want that. Is something like this possible with AirVPN?


Thank you,
Alonzo

[xPOGMANx 0]

Hi @Alonzo,
I am facing the same issue, have you found a solution to this?

[Staff 10081]

On 4/7/2024 at 2:16 PM, Alonzo said:

I'm trying to setup wireguard in a way that only applications i set to use the wg's interface will route its traffic through the VPN, with port forwarding enabled.

Hello!

This is currently possible on Android (with Eddie Android edition), Windows (with WireSock) and (only reversed, i.e. you can specify apps whose traffic must flow outside the tunnel) on Linux with the AirVPN Suite 2.0.0 beta version.

Kind regards
 

[NaDre 159]

On 4/7/2024 at 6:16 AM, Alonzo said:

...
I'm trying to setup wireguard in a way that only applications i set to use the wg's interface will route its traffic through the VPN, with port forwarding enabled. ...
Is something like this possible with AirVPN?

...
 

I imagine the application you want to use the VPN is a torrent client? Then one of these might help:

https://github.com/tool-maker/VPN_just_for_torrents/wiki/Running-OpenVPN-on-Windows-without-VPN-as-Default-Gateway

https://github.com/tool-maker/VPN_just_for_torrents/wiki/Running-Non-Specific-VPN-on-Linux-without-VPN-as-Default-Gateway

This method works for any VPN. You don't need the wrapper program from the VPN provider to do it for you. There is some D.I.Y. involved. Copy and paste scripts.

Others use containers or virtual machines to run the torrent client. There are lots of posts here about that.
 

[xPOGMANx 0]

Thanks!
I also found this interesting blog post that makes use of systemd units to run process in dedicated network namespaces: https://blog.thea.codes/nordvpn-wireguard-namespaces/
As long as you can run you process as a daemon, that should work I guess

[Staff 10081]

2 hours ago, xPOGMANx said:

As long as you can run you process as a daemon, that should work I guess

Hello!

For general information, with the AirVPN Suite 2 you can work with namespaces and split traffic even if you have a system not based on systemd (SysV-like init and systemd based systems are both supported). You don't need to run a process as a service. Also note that systemd services/units are not daemons, for clarity. You don't even need to modify or setup anything in your system.

Just keep in mind that you have a "reverse" traffic splitting, i.e. Bluetit prepares a namespace whose traffic flows outside the VPN tunnel, tunnels to the VPN everything running on the default namespace. You can start any application inside the new namespace (out of the VPN tunnel) simply by typing cuckoo --run application

Kind regards