Issues with excluding private IPs

[Oliver Benning]

My setup (may be unrelated):

I have a public endpoint hosted on Digital Ocean, which I connect to simply through its external IP address as the endpoint. It was setup using Streisand.

The endpoint itself acts as a DNS resolver within the tunnel for ad blocking purposes, so the WireGuard profile uses the endpoint's internal IP address in the DNS field. This setup has been documented online.

The issue (on both Mac and iPhone clients):
I would like to exclude private IPs from the tunnel to connect to internal resources. Connection works fine with AllowedIPs=0.0.0.0/0, it does not work when using the "Exclude private IPs option".

Log just shows:
[NET] peer(5m6B…jmno) - Sending handshake initiation
[NET] peer(5m6B…jmno) - Failed to send handshake initiation write udp4 0.0.0.0:63865->[EXTERNAL-IP]:51820: sendto: network is unreachable

I also have tried using a set of CDR blocks such that the droplet's external ip is excluded from the range and that did not work either. If I have a misconception about the configuration or there is something I should try please let me know.

Recommendation
This may have a been recommended below but I would highly suggest a list of IPs to subtract from the tunnel. My ideal scenario would be:


AllowedIPs = 0.0.0.0/0

ExceptedIPs = 192.168.1.0/24


Cheers,
Oliver

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20190815/1566bd9a/attachment.html>