Add support for setting proxy settings (NETunnelNetworkSettings.proxySettings) in wireguard-apple

Segev Finer segev at swimm.io
Tue Nov 19 09:33:40 UTC 2024


When using NEPacketTunnelProvider, you can also specify proxy
settings, those are used by programs that query for the system proxy
settings while connected to the WireGuard VPN, for example,
Chromium/Chrome uses that (scutil --proxy shows the settings AFAIK),
there is currently no way to set those settings in wireguard-apple,
and the GUI for setting them, as available in builtin VPN providers in
macOS is not available for the WireGuard VPN interface in the macOS
GUI, so you are stuck with the default proxy settings, where some
networks do require proxy settings, be it enabling auto-discovery, PAC
URL, HTTP proxy URL, etc. like the default proxy settings GUI in macOS
allows to set. You can currently still use wireguard-tools/wg-quick
which still uses, what I think is an undocumented interface?, to
create a tun device, which doesn't affect those settings, but that's
not as convenient or nice as using wireguard-apple.

Another thing that I noticed is that wireguard-apple seems to always
use the default internet gateway, ignoring routing rules that say
otherwise which prevent using it nested, or with other custom network
interfaces, it would be nice to be able to control the outgoing
interface in wireguard-apple. wireguard-tools/wg-quick adds a route
that uses the default gateway which you can simply remove or modify
manually if needed (Though a setting would be nicer of course), but
wireguard-apple seems to somehow go through the default interface and
ignores the routing rules.


More information about the WireGuard mailing list