<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div style="direction: ltr;">I haven’t tested that allowedIPs approach actually. I’ll take a look at that python wrapper, thanks. </div><div style="direction: ltr;">I don’t know much about iptables and routing. I think learning it sufficiently will take quite some time? Or are there some tutorials around?</div><div style="direction: ltr;">I also actually use WireGuard with macOS (though I occasionally use it on Linux, too).</div><div dir="ltr"><br>On Aug 25, 2019, at 11:47 PM, Derrick Lyndon Pallas <<a href="mailto:derrick@pallas.us">derrick@pallas.us</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><meta http-equiv="content-type" content="text/html; charset=utf-8"><div>Why wouldn't this happen as an iptables rule?</div><div><br></div>If some AllowedIPs trick is working for you and you're using Python and the kernel version of Wireguard, check out [1], which will allow you to programmatically set up the interface.<div><br></div><div>FWIW, I'm not sure adding complication to AllowedIPs is the right approach, but adding it to a tool seems reasonable. Maybe it also makes sense to allow an IPset, but I'm haven't thought it through. My gut says routing prior to Wireguard is probably what you're looking for.<div><br></div><div>[1] <a href="https://github.com/ArgosyLabs/wgnlpy">https://github.com/ArgosyLabs/wgnlpy</a><br><br><div id="AppleMailSignature" dir="ltr">~Derrick • iPhone</div><div dir="ltr"><br>On Aug 22, 2019, at 12:10 PM, Aryn Starr <<a href="mailto:whereislelouch@icloud.com">whereislelouch@icloud.com</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><span>I live in Iran, and here the internet censorship is fierce. I need to route almost all of my traffic through the VPN, but some domestic sites are not accessible from the US. Also, since ISPs apply different censoring rules, sometimes my own servers are not reachable via the VPN (because the server’s ISP blocks the VPN, while my local ISP does not.)</span><br><span>The best current solution I’ve seen is</span><br><span>```</span><br><span>$ python3</span><br><span></span><br><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><span>import ipaddress</span><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><span>n1 = ipaddress.ip_network('106.203.202.0/23')</span><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><span>n2 = ipaddress.ip_network('106.203.203.13/32')</span><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><span>l = list(n1.address_exclude(n2))</span><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><span>print(l)</span><br></blockquote></blockquote></blockquote><span></span><br><span>```</span><br><span>Which is terrible.</span><br><span>_______________________________________________</span><br><span>WireGuard mailing list</span><br><span><a href="mailto:WireGuard@lists.zx2c4.com">WireGuard@lists.zx2c4.com</a></span><br><span><a href="https://lists.zx2c4.com/mailman/listinfo/wireguard">https://lists.zx2c4.com/mailman/listinfo/wireguard</a></span><br></div></blockquote></div></div></div></blockquote></body></html>