WG Client Split-Tunnel not working? (AllowedIPs != 0.0.0.0)?

kennethrc · 2022-08-20T17:32:47.352Z

On my AX-1800 I have the same WG tunnel defined in two different ways, identical except for the “AllowedPs” beng 0.0.0.0 for the “Full” version, and only my personal WG server’s subnet (192.168.124.0/24) for the “Local” version. In both config files the DNS is set up to my personal WG server’s DNS server (192.168.124.1, which is routed to CloudFlare via DoH).

If I use the “Full” version, everything works as expected. If I use the “Local” version, I can pass traffic thru OK to the personal WG server’s subnet, with outside traffic (apparently) going thru the default route set up by the WAN, but DNS doesn’t work; I can’t resolve queries.

In the “Full” version, I can go to dnsleaktest.com and see that all DNS is routed (via the tunnel) to CloudFlare, as expected.

What I guess is happening is the AXT is trying to use the default route to contact the DNS server, and not using the routing table (? guess?) and seeing that the .124.1 address should be routed to the WG tunnel at 124.0/24 .

Any suggestions?

kennethrc · 2022-08-20T17:52:59.745Z

kennethrc:

with outside traffic (apparently) going thru the default route set up by the WAN

… huh. I just tested this- it turns out that NO non-AllowedIPs traffic passes. I’m getting DNS OK, I just can’t get to them.

So now I guess the issue is WG Client Split Tunnels don’t work? (I swear this used to work before, though. I’m currently on 4.0.2-release 1, but it was also failing on the previous version)

kennethrc · 2022-08-20T17:59:31.632Z

FWIW, using the “Local” config file on my Linux laptop does as expected; only traffic in “AllowedIPs” goes thru the tunnel, everything else goes out thru the WAN’s “native” connection.

alzhao · 2022-08-22T09:40:38.147Z

Can you confirm if you used local DNS server? Just just a split tunnel problem without DNS involved?

alzhao · 2022-08-22T09:42:51.673Z

BTW, in the vpn polices, what did you use?

You should use “auto detect”.

kennethrc · 2022-08-22T09:58:51.279Z

alzhao:

Just just a split tunnel problem without DNS involved?

As far as I can tell, yeah, it’s a split-tunnel issue.

alzhao:

vpn polices, what did you use?

I’m back at home now, so I’ll check this setting sometime tomorrow, but I never touched the “VPN Policies” section. What’s the default there?

alzhao · 2022-08-22T10:00:47.368Z

kennethrc:

What’s the default there?

Default is “Global Proxy” which will forward all traffic to vpn. It will omit settings from the vpn config.

kennethrc · 2022-08-22T10:25:01.017Z

alzhao:

You should use “auto detect” [in the VPN Policies].

Well, I’d decided to slap it all together here at home and test it, and that did it- Thanks!

I figured you guys wouldn’t have had Split Tunnel not work; good to see it was User Error

admon · 2024-09-02T06:03:39.525Z

A post was split to a new topic: GL-MT3000 - DNS Split tunnel does not work

admon · 2024-09-02T06:03:48.223Z