WireGuard as gateway; excluding private IPs

[Yeri Tiete]

This is a personal project after hitting a wall for the Nth time with the
GFW. Where oVPN gets RST or otherwise blocked, it seems WG is still able to
by-pass the firewall.

I was playing around with a couple of devices; routing everything through
WG except for LAN, plus have my devices auto connect no matter where I am.

I can select to exclude private IPs and it'll update 0.0.0.0/0 to include
only public IPs. This seems to be working fine on Android: WG connects,
there's a handshake, traffic gets routed through WG gateway, and I am still
able to connect to my local network devices.

On OSX and iOS on the other hand, once I select *exclude private IPs* the
handshake fails and WG doesn't connect. No traffic gets routed and my
devices can't connect until I turn off WG.

On the other hand -- if I don't select *exclude private IPs,* on iOS and
OSX I can still access LAN IPs just fine -- but on Android that doesn't
work.

In all cases the official app is used.

Any clue why there's a difference? The server address is a public IP.

That being said I seem to be able to make it work -- it's just that the
behaviour is different.

One more thing:

Android doesn't have a feature to connect on-demand the same way iOS and
OSX do. Is this a limitation of Android? Ie I can select it to be
always-on, but the options are not as granular as iOS where I can define to
be on for Cell, WiFi and define the SSIDs.

Thanks,
Yeri Tiete | Corp Ops Engineer | yeri at google.com | +65 9225 0750
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20190608/73c2ff20/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4839 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20190608/73c2ff20/attachment-0001.p7s>