Question about WireGuard + iOS

[BillShillingsby 0]

Hello!

I am using the official WireGuard iOS app and a default WireGuard airvpn config to one of the servers.   I’d like to route ALL traffic through the vpn, but im finding that with the vpn connected most internet traffic is routed, but local resources (router interface, nas, etc) are still connectable.

is this expected behavior in iOS or is there something I can change from the defaults to facilitate this?

[benfitita 39]

This only depends on the value of "Allowed IPs" field in the profile. What's your value?

[BillShillingsby 0]

Thank you for the response benfitita.

This is the default value that is unchanged

::/0, 0.0.0.0/0 Edited ... by BillShillingsby

[benfitita 39]

Does https://ipleak.net tell you that you that you're connected to an AirVPN server? Are you using a vanilla config file downloaded from the Config Generator?

[BillShillingsby 0]

Yep!     That website shows the server I picked in the initial config.  

yes, completely vanilla config.   Single server picked and config generated.   

web traffic goes through the tunnel and shows as such on my firewall.    However local requests for things on my network pass data, even on devices that aren’t exposed to the internet.     I’m just wondering how this is possible or if this is normal iPhone behavior.   

thanks for the help!

[Staff 10014]

On 11/20/2024 at 1:44 PM, BillShillingsby said:

web traffic goes through the tunnel and shows as such on my firewall.    However local requests for things on my network pass data, even on devices that aren’t exposed to the internet.     I’m just wondering how this is possible or if this is normal iPhone behavior.  

Hello!

According to several reports available on the www, a few years ago this did not happen on iOS. The problem was typically the opposite, i.e. how to reach the local network while a WireGuard connection is active.

A plausible explanation is that more recent iOS [VPN API] versions keep a route to the default gateway with a longer prefix for the local network. The route with the longer prefix (for example /24 instead of /0) always takes the precedence on nowadays systems. Please see also: https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/

However, we could not find this behavior documented. Does any reader have a link to some official documentation by Apple about all of the above?

Kind regards