NM WG: Fix allow LAN handling with split tunneling #637

jwijenbergh commented 2025年04月30日 13:45:49 +02:00

In the more strict allow LAN handling since 4.4.99.0, we made sure that VPN interface IP ranges
were never taken from the main routing table by first checking the non-default routes
of the WG routing table. But as in split tunneling all routes are in the WireGuard routing
table, this can lead to LAN being blocked as well if the AllowedIPs contains these private IP
ranges. Additionally, this can lead to ProxyGuard not working if the AllowedIPs contains the
ProxyGuard server peer IP address.

This fix makes sure that the WG routing table is only checked first for packets going to the VPN
interface IPs. We make sure to only do this when the VPN interface IP addresses are contained in
one of the LAN whitelist. As we do not want to check the WG routing table first for non-LAN IPs.

In the more strict allow LAN handling since 4.4.99.0, we made sure that VPN interface IP ranges were never taken from the main routing table by first checking the non-default routes of the WG routing table. But as in split tunneling *all* routes are in the WireGuard routing table, this can lead to LAN being blocked as well if the AllowedIPs contains these private IP ranges. Additionally, this can lead to ProxyGuard not working if the AllowedIPs contains the ProxyGuard server peer IP address. This fix makes sure that the WG routing table is only checked first for packets going to the VPN interface IPs. We make sure to only do this when the VPN interface IP addresses are contained in one of the LAN whitelist. As we do not want to check the WG routing table first for non-LAN IPs.

jwijenbergh commented 2025年04月30日 13:46:34 +02:00

Fixes: #635

Fixes: #635