iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes. A router can send only selected devices, VLANs, or destination networks through a WireGuard tunnel while ordinary traffic continues through the WAN. The reliable design is to separate two decisions: WireGuard’s AllowedIPs identifies which peer may carry a network, while the router’s normal routes and policy rules decide which packets are sent to the WireGuard interface. On OpenWrt, that means controlling both allowed_ips and route_allowed_ips, then adding source- or destination-based policy rules. On pfSense, a LAN rule can match a selected host and choose the WireGuard gateway. Simply adding 0.0.0.0/0 to a peer and installing it in the main routing table is what commonly sends an entire LAN through the VPN.
What router split tunneling with WireGuard actually does
Split tunneling means that only traffic matching a defined selector enters the VPN. The selector can be a source device, a VLAN, a destination subnet, or a firewall policy. Packets that do not match continue through the router’s ordinary WAN gateway.
WireGuard does not replace the router’s routing system. Its cryptokey-routing layer associates each peer with a list of tunnel IP prefixes. The operating system still needs a route or policy rule that directs a packet to the WireGuard interface. This distinction explains most split-tunnel successes and failures.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Source-based split tunnel: selected clients use the tunnel, while other LAN clients use WAN.
- Destination-based split tunnel: only traffic for selected remote networks uses WireGuard.
- VLAN-based split tunnel: an entire VLAN follows the tunnel policy.
- Internet-gateway split tunnel: a selected source receives a VPN default route, while the rest of the network keeps the WAN default.
How AllowedIPs, routes, and policy rules interact
AllowedIPs has two WireGuard roles
WireGuard’s project describes cryptokey routing as associating public keys with the tunnel IP addresses allowed inside the tunnel. For outbound traffic, the destination is matched against a peer’s AllowedIPs, selecting that peer. For inbound traffic, the source address is checked against the same list, providing source validation.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
On OpenWrt, the peer field called allowed_ips describes the prefixes that peer is allowed to use inside the tunnel. A prefix can describe a remote subnet, a tunnel address, or a default route. The OpenWrt documentation notes that an allowed IP can be a /32 when it describes an individual IP rather than a subnet.
AllowedIPs is therefore not, by itself, a complete per-device policy. The router must also have a route or policy rule that places the selected packet on the WireGuard interface.
What route_allowed_ips controls on OpenWrt
OpenWrt’s route_allowed_ips setting controls whether the system automatically creates routes for the prefixes listed in allowed_ips. It is a route-installation choice, not a replacement for source or destination policy.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →For destination split tunneling, keep the normal WAN default route and install only the required remote prefixes through WireGuard. For source-based Internet access, a peer may need 0.0.0.0/0 and, for IPv6, ::/0, but a policy selector must still decide which LAN traffic is allowed to use that gateway. If a default prefix is automatically installed in the main table, the router or the whole LAN can move toward the tunnel instead of only the intended clients.
Why 0.0.0.0/0 can capture the whole network
0.0.0.0/0 matches every IPv4 destination. If OpenWrt installs that prefix as the main-table default, ordinary traffic has no more-specific WAN route to win, so the router may send all clients through WireGuard. The IPv6 equivalent is ::/0.
A full-tunnel peer and a split-tunnel policy are compatible, but they must be kept separate. The peer can advertise a default route for the policy table while the main table retains WAN. A source rule, VLAN rule, or firewall gateway rule then sends only the intended traffic to that policy table.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Choose the selector before creating routes
| Goal | Selector | Route design | Important check |
|---|---|---|---|
| Reach selected remote networks | Destination prefixes | Keep the WAN default and install only those prefixes through WireGuard | Make sure return routes exist on the remote side |
| Send selected devices to a VPN Internet gateway | Source client addresses or an alias | Use a policy table or gateway rule containing the VPN default | Do not install the default in the main table for all LAN clients |
| Send a dedicated network through the tunnel | VLAN or subnet source | Apply the policy to that VLAN while leaving other interfaces on WAN | Place the specific rule above broad allow rules |
| Combine device and destination restrictions | Source plus destination | Use ordered policy rules and only the required peer prefixes | Check which rule wins when a packet matches more than one policy |
Requirements and planning checklist
Before changing routes, confirm that the router firmware or firewall appliance provides all of the following:
Free tools Windows power users keep installed
One-click scans. No signup required.
- WireGuard interface and peer support.
- Policy routing, gateway rules, or an equivalent way to match source devices, VLANs, or destinations.
- Firewall zones or interface rules that permit forwarding into the tunnel.
- Outbound NAT when the remote side requires the router to masquerade LAN addresses.
- Deliberate IPv6 support if clients use IPv6.
Record the tunnel address, peer endpoint, DNS plan, remote prefixes, and whether the peer is a private-network gateway or an Internet gateway. Decide whether the tunnel should carry only particular destinations or whether selected sources should use a VPN default. This decision determines whether you need specific routes, policy tables, or both.
OpenWrt: configure a selective WireGuard tunnel
1. Create the interface and peer
- Create a WireGuard interface and enter the tunnel addressing and peer credentials supplied by the remote operator.
- Enter the peer endpoint and the appropriate
allowed_ips. Use remote network prefixes for a destination-only tunnel. Use a default prefix only when this peer is intended to act as an Internet gateway for a separately selected source policy. - Decide whether
route_allowed_ipsshould automatically install routes. Automatic installation is convenient for specific remote prefixes, but it can be dangerous when the list contains0.0.0.0/0or::/0.
2. Put the interface in a firewall zone
Assign the WireGuard interface to a firewall zone and add forwarding from the selected LAN source or VLAN to that zone. A tunnel can show a successful handshake while forwarding is still blocked, so treat interface creation and firewall permission as separate tasks.
3. Build the routing policy
For destination split tunneling, leave the WAN default route in place and install only the remote prefixes through WireGuard. For per-device or per-VLAN routing, create policy rules that match the selected source and direct it to the table containing the WireGuard routes. Keep excluded clients on the ordinary WAN table.
Put the most specific policy above broad allow rules. A rule for one selected source should be evaluated before a rule covering an entire LAN. If the policy uses a VPN default, ensure the default exists only in the policy context used by selected sources.
4. Configure NAT where it is required
Permit forwarding from the selected source to the WireGuard zone and add outbound NAT if the remote network expects packets to originate from the tunnel or router address. Whether NAT is needed depends on the return routing available at the remote end; NAT cannot substitute for a missing return route when the remote network is expected to route the original client addresses.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
5. Protect the peer endpoint route
The WireGuard endpoint itself must remain reachable through WAN. If the endpoint’s own packets are caught by a new VPN default, the handshake can loop into the tunnel and fail. Use an explicit WAN route for the endpoint or a fwmark-and-alternate-table design that keeps handshake traffic outside the tunnel. WireGuard’s network-namespace documentation describes this marking and alternate-table pattern as a way to avoid endpoint loops.
6. Handle DNS and IPv6 intentionally
Choose DNS servers that match the policy. If a selected client uses the tunnel for Internet traffic but its DNS queries continue to an ISP resolver over WAN, the DNS path can reveal the ordinary connection. Route DNS requests consistently with the chosen source policy.
Configure IPv6 separately. IPv4 rules do not automatically cover IPv6. A full IPv6 tunnel may require ::/0, while a destination-only design needs the relevant IPv6 remote prefixes and corresponding policy rules. Test both address families rather than assuming that working IPv4 proves a complete split tunnel.
7. Verify in LuCI and from clients
OpenWrt recommends checking the WireGuard handshake in LuCI and verifying paths with traceroute and traceroute6. Test one selected client and one excluded client separately. Confirm the selected client reaches the intended remote network or public address through the tunnel, while the excluded client still uses WAN.
pfSense: route selected hosts through WireGuard
1. Create and assign the WireGuard interface
Create the WireGuard tunnel and peer, then assign the WireGuard interface so it has its own firewall rule tab. Assignment is important because it gives you interface-specific policy and return-path behavior rather than treating the tunnel as an unclassified interface.
2. Add routes or gateway policy
Use static routes for destination-only access to remote networks. For per-device Internet split tunneling, create or select the WireGuard gateway and use policy routing on the LAN rules page. The clearest pattern is a LAN rule matching the selected host address and choosing the WireGuard gateway.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Place that host-specific rule above broad LAN allow rules. Hosts that do not match continue to the normal default gateway. If automatic gateway selection is left to the firewall, pfSense warns that it can select the WireGuard interface as the firewall’s default unintentionally, so inspect the gateway choice rather than assuming the interface is only used by the selected rule.
3. Resolve multiple-peer ambiguity
If several peers share one WireGuard tunnel, their AllowedIPs must distinguish which peer receives each network. Overlapping or overly broad prefixes can make peer selection ambiguous. Give each peer only the networks it is allowed to carry.
4. Apply firewall and NAT behavior
Add the required rules on the assigned WireGuard interface as well as on LAN. pfSense documents that rules on assigned interfaces provide reply-to behavior for return traffic. It also documents automatic outbound NAT for traffic leaving assigned WireGuard interfaces. Verify the resulting rule and NAT behavior when the remote side expects translated addresses or when replies could otherwise leave through WAN.
5. Keep the endpoint on WAN
As with OpenWrt, protect the route to the WireGuard endpoint. A policy default that catches the endpoint can prevent the tunnel from maintaining its own handshake. Use an explicit WAN path or an equivalent marked-routing design before testing client traffic.
6. Test both matching and non-matching hosts
From the selected host, check the public address, DNS behavior, and the route to the intended destination. Repeat from an excluded host. Use traceroute and traceroute6 where applicable, inspect handshake times, and review firewall counters to confirm that the expected rule—not a broad default rule—is carrying the traffic.
Recommended Free Tools
OpenWrt and pfSense compared for split tunneling
| Capability | OpenWrt | pfSense |
|---|---|---|
| Per-device selection | Policy-routing rules can match source devices, VLANs, or destinations | A LAN firewall rule can match a selected host and choose the WireGuard gateway |
| AllowedIPs and route installation | allowed_ips describes peer prefixes; route_allowed_ips controls automatic route creation |
Peer AllowedIPs must disambiguate networks when multiple peers share a tunnel; static routes and policy routing select paths |
| Firewall integration | WireGuard interface is placed in a firewall zone with forwarding rules | Assigning the interface creates a dedicated firewall rule tab |
| Return-path behavior | Requires deliberate routes and policy handling | Assigned-interface rules provide documented reply-to behavior |
| NAT behavior | Configure outbound NAT when the remote side requires it | Automatic outbound NAT applies to traffic leaving assigned WireGuard interfaces |
| Verification | LuCI handshake checks plus traceroute and traceroute6 |
Firewall counters, gateway selection, handshake status, and path testing |
Verification: prove that the split tunnel is selective
- Check the handshake. Confirm that the peer’s latest handshake updates. A handshake proves cryptographic connectivity, not that LAN forwarding or return routing works.
- Test a selected client. Access the intended remote network or Internet destination and record the public address, route, and DNS resolver used.
- Test an excluded client. Repeat the same checks from a client outside the policy. It should retain the WAN path.
- Test IPv4 and IPv6 separately. Run
traceroutefor IPv4 andtraceroute6for IPv6. A successful IPv4 result does not establish that IPv6 is tunneled or blocked correctly. - Inspect firewall and NAT counters. Confirm that packets increment the intended LAN-to-WireGuard rule and that return traffic is accepted on the expected interface.
- Check the endpoint path. Verify that handshake packets still use WAN and are not being redirected by the VPN default.
Troubleshooting common failures
The whole LAN uses the VPN
Look for an unintended 0.0.0.0/0 or ::/0 route in the main table. Then inspect policy-rule order. A broad rule or an automatically installed default can override the intended per-device selector. Move the default into a policy table or remove automatic route installation and add only the required policy routes.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
The tunnel handshakes but traffic fails
Check the peer’s AllowedIPs, firewall forwarding, return routes, and NAT. The handshake only confirms that peers can authenticate and exchange encrypted packets. It does not prove that the remote network knows how to return client traffic or that the LAN-to-tunnel rule permits forwarding.
Replies leave through the wrong interface
Inspect the return-path policy. On pfSense, assign the WireGuard interface and use its interface rules so documented reply-to behavior can keep replies symmetric. On other systems, provide equivalent policy routing and explicit return routes.
IPv4 works but IPv6 leaks or fails
Configure IPv6 AllowedIPs and policy rules deliberately. Add the required remote IPv6 prefixes for destination split tunneling or ::/0 in the selected full-tunnel policy. Do not infer IPv6 behavior from an IPv4-only configuration.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe router loses access to the peer endpoint
Restore an explicit WAN route to the endpoint or implement fwmark-based endpoint protection with an alternate routing table. The endpoint must not be routed through the tunnel it is needed to establish.
DNS reveals the ISP path
Review which resolver the client uses and which policy carries its DNS packets. Select DNS servers and route DNS requests consistently with the tunnel decision. A client can have its application traffic in WireGuard while DNS still follows WAN if DNS is left outside the policy.
One of several peers receives the wrong network
Compare the peers’ AllowedIPs and remove overlapping or overly broad prefixes. WireGuard uses those prefixes to select an outbound peer, so each remote network must be uniquely attributable when multiple peers share the tunnel.
Limits and trade-offs
WireGuard is UDP-only
The WireGuard project explicitly does not support tunneling over TCP and does not focus on traffic obfuscation. It is therefore a UDP VPN protocol. Networks that block or heavily restrict UDP need an additional transport or obfuscation layer, evaluated separately from WireGuard itself.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
NAT keepalive can matter
PersistentKeepalive can maintain a NAT mapping for an otherwise idle peer. WireGuard’s quick-start guidance describes 25 seconds as a sensible value for many NAT or firewall situations where a peer must receive traffic after idle time. It is a connectivity aid, not a substitute for correct routes, firewall rules, or return paths.
Policy precision increases operational complexity
Per-device split tunneling offers control but adds rule ordering, DNS decisions, IPv6 handling, endpoint protection, and return-path checks. A destination-only tunnel is usually simpler because it needs only the remote prefixes. A selected-source Internet gateway is more flexible but requires the most careful separation between the main WAN table and the VPN policy table.
Quick Recap
Practical design rules
- Start with the narrowest selector that meets the requirement: specific destinations before a full Internet default, and selected sources before an entire LAN.
- Treat
AllowedIPsas peer cryptokey routing and source validation; treat operating-system routes and policy rules as traffic selection. - On OpenWrt, decide explicitly whether
route_allowed_ipsshould install routes, especially when a peer contains a default prefix. - On pfSense, use a host-specific LAN gateway rule for per-device routing and check that automatic gateway selection has not changed the firewall’s own default.
- Keep the WireGuard endpoint on WAN, permit forwarding only where needed, and configure NAT and DNS according to the remote network’s expectations.
- Validate selected and excluded clients independently over both IPv4 and IPv6.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
