What is the recommended way to switch between full and split tunnels using WireGuard?

[kris-anderson]

I am currently using WireGuard to connect to my home network. Each of my devices needs it's own IP address assigned to it it, and I have 4 devices currently:

• iPhone
• iPad
• MacBook Work
• MacBook Personal

Within the WireGuard configuration, you need to specify the allowed IPs. For my split tunnel, I'll add something like 192.168.0.0/16. For my full tunnel, I'll add 0.0.0.0/0.

In order to do that though, I need 2 profiles for each of my devices, which means I now have 8 profiles in Passepartout synced between all my devices.

There's a Routing module in Passepartout, and from my testing, it looks like I can get down to 4 profiles, one for each device, by making use of this module. I can have WireGuard setup to use 192.168.0.0/16 for the allowed IPs, and in the Routing module, I can add 0.0.0.0/0. When I enable the Routing module, I seem to be full tunnel. With this setup, I only need 1 profile per device, and I can toggle the Routing module on or off depending on if I want split or full tunnel.

I believe my understanding above is correct, but please correct me if any of that isn't true. :)

All that being said, is one of those methods preferred over another? Is there another method I haven't discovered that would be even better for switching between full and split tunnel?

[keeshux]

Yes, this is the intended way and I'm happy that it works for you. Is there a way/process that you would find more convenient to do the switch? E.g. if you do the manual switch based on some condition that is predictable/automatable.

[kris-anderson]

Awesome, thank you so much for confirming. I'm going to go ahead and condense my profiles down to 4 for the time being, and add that routing module to each of them for when I want full tunnel.

As for my use case, here's how I use my VPN.

1. When I'm at home connected to my WiFi network, I use the On-demand module to keep Passepartout in-active. When I leave my home WiFi network, it then activates Passepartout with my split-tunnel to give me access to my home network, as well as using my home as my DNS server since I have network wide protection using pfSense pfBlockerNG. This works perfect already.
2. When I connect to a WiFi network that isn't my own, I'd like to enable full-tunnel to my home network. I'd want all of my traffic to be encrypted if I'm using a WiFi network I don't own.
3. When I travel outside the country, I'd like to enable full-tunnel to my home network.

For case 2 and 3 above, I can solve that manually by enabling the routing module. It's rare that I connect to WiFi that isn't mine, or travel internationally, so this works well for me :).

I'm not sure if # 3 could be automated. # 2 could probably be automated though. It could live in the On-demand module. The current policy applies to the VPN, but maybe there could be a second policy that applies to the Routing module? I could set that to excluding, add my WiFi networks, and also exclude it on mobile networks. I think that would therefor mean that:

1. If I'm on my home WiFi network, Passepartout is in-active
2. If I'm not on any WiFi network but I'm on a mobile network, Passepartout is active with routing disabled, therefore keeping me on my split-tunnel.
3. If I'm on someone else's WiFi network, Passepartout is active with routing enabled, activating my full-tunnel connection.

That would be perfect for my iPhone usage. That could even work for macOS. Although it could also be helpful to have a toggle option for the Routing module in the menu bar of Passepartout. Currently I have no way of knowing if I'm split or full tunnel via the menu bar.

Thank you so much for all the work you do to both make and keep this app maintained :)! It's a wonderful WireGuard VPN client.

[keeshux]

Currently, the operating system uses on-demand rules to automate profiles (de)activation externally. If the tunnel can read the kind of network it's connected to, then the rules can also be used to (de)activate a module based on the shape of the current network.

For example, imagine your profile made of 3 modules:

• OpenVPN
• Routing
• OnDemand

If the on-demand module is offered a way to be module-specific, then the rules may be set at the module level, e.g.:

• OpenVPN → All networks
• Routing → Excluding / Mobile + Wi-Fi (known SSIDs)

Before establishing a connection, the tunnel would read the network state and only activate the "Routing" module if connected to an unknown Wi-Fi.