This guide will describe the steps required to enable split tunneling with WireGuard using Firezone so only traffic to defined IP ranges will be routed through the VPN server.
Allowed IPs field found on the
/settings/default page determines the IP ranges for which the client will route network traffic. Modifications to this field will apply only to new WireGuard tunnel configurations generated by Firezone.
The default value is
0.0.0.0/0, ::/0, which routes all network traffic from the client to the VPN server.
Some examples of values in this field are:
0.0.0.0/0, ::/0- all network traffic will be routed to the VPN server.
192.0.2.3/32- only traffic to a single IP address will be routed to the VPN server.
126.96.36.199/22- only traffic to IPs in the
188.8.131.52 - 184.108.40.206range will be routed to the VPN server. In this example, the CIDR range for the
ap-northeast-2AWS region was used.
Note: When deciding where to route a packet, Firezone chooses the egress interface corresponding to the most specific route first.
To update existing user devices with the new split tunnel configuration, users will need to regenerate the configuration files and add them to their native WireGuard client.
See, add device for instructions.