'Block connections without a VPN' and local network

Turtlecute

Hi everyone,
Sometimes I need to access my local network (192.168.1.0/24) to communicate with other devices. I use the "Exclude private IP" toggle in WireGuard, which adds the following AllowedIPs configuration:

0.0.0.0/5, 8.0.0.0/7, 11.0.0.0/8, 12.0.0.0/6, 16.0.0.0/4, 32.0.0.0/3, 64.0.0.0/2, 128.0.0.0/3, 160.0.0.0/5, 168.0.0.0/6, 172.0.0.0/12, 172.32.0.0/11, 172.64.0.0/10, 172.128.0.0/9, 173.0.0.0/8, 174.0.0.0/7, 176.0.0.0/4, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4, 10.0.0.1/32

However, I cannot access my local network unless I disable the "Allow connection without VPN" toggle. I've also tried using the automatic options in some popular VPN apps to reach the local network while connected to the VPN, but I face the same issue.

Is there a way to keep these settings active to prevent IP leaks while still being able to access the local network?

DeletedUser87

Turtlecute I don't understand, if you exclude private IPs, how are you supposed to connect to private IPs? 192.168/16 would need to be in allowed IPs for it to work.

mrket

DeletedUser87 This is wrong, Allowed IPs specifies IPs that WireGuard should tunnel connections to (connections to other IPs don't use WireGuard).
AFAICT, "Block connections without VPN" blocks connecting to any IP not specified in Allowed IPs.

DeletedUser87

mrket This is wrong, Allowed IPs specifies IPs that WireGuard should tunnel connections to (connections to other IPs don't use WireGuard).

well of course? How are you gonna reach your local VPN when you don't enable private range CIDRs and block connections without VPN at the same time?

Turtlecute

mrket so there are no way to connect to local network if i've that settings enabled? Because one strange thing is that with always on VPN and block out of VPN enabled i can't see my local network but apps such has localsend in my local network can see me! So there's some kind of leak for sure ..

DeletedUser87

Turtlecute how did you set up your WireGuard instance? I have no issues connecting to any IPs.

Turtlecute

DeletedUser87 Also the local ones? Do you have both always on VPN and block connection without VPN active?

My wireguard tunnel goes on a VPS not in my home router.

DeletedUser87

Turtlecute ohhh, okay - that changes everything. Obviously it would tunnel into the 192.168.x CIDR of the VPS in that case. As far as I am aware, you wouldn't be able to block connections without VPN and simultaneously connect to your local subnet. That's basically the whole point of "block connections without VPN". I assume the reason other devices on your network can see your tunneled device is because of broadcasting.
My WireGuard runs on my firewall (OPNSense) at home, so naturally I set it up to access private IP ranges.

trilogy6202

Turtlecute As @DeletedUser87 said, "block connection without VPN" and reaching lan ips are mutually exclusive unless of course if your "server" are on your lan.

Turtlecute

DeletedUser87 AFAIK Block vpn should block everything but some devices in the local network CAN SEE my phone with wireguard and allowIP configured on allow local network... So there is a leak i think..

With my home PC with local send i can see my phone with block connections outside vpn

trilogy6202

Turtlecute "Block connection without VPN" doesn't prevent other devices on your lan to see the device when you are connected to the lan. Again, as @DeletedUser87 said because of bloadcasting. It should however block all connections between the device and other devices on the lan.

DeletedUser87

Turtlecute that's not a leak. Technically, you can't route all traffic through a VPN. The VPN can be configured to block connections to other LAN devices, but not LAN itself. If you wanted to achieve that, you would need to set up VLANs on your LAN and put the device on a separate (tagged) subnet, so that only devices in that VLAN can communicate.

Turtlecute

trilogy6202 Ok so one last thing, thanks for your help, but if i have Block outside vpn on and a tunnel active i can't see the local network but the local network can see me AND comunicate with me, for example i can send through localsend app a file from my PC to my phone while it can't see the local network 🤔

DeletedUser87

Turtlecute because localsend tells you:

How It Works
LocalSend uses a secure communication protocol that allows devices to communicate with each other using a REST API. All data is sent securely over HTTPS, and the TLS/SSL certificate is generated on the fly on each device, ensuring maximum security.

This is all done through multicast. You can read here how it works in detail.