AllowedIPs directive in the client configuration file to exclude the default route (0.0.0.0/0) and ensuring that the system’s network manager or routing table does not override this behavior with a global gateway setting.
Understanding the Routing Problem
When you establish a WireGuard connection, the most common mistake is setting AllowedIPs = 0.0.0.0/0. This directive tells the operating system to send all internet traffic through the encrypted tunnel to the VPN server. For a Fritzbox 7530 acting as a VPN server, this means your web browsing, streaming, and general internet activity are routed through your home network’s IP address. While this provides privacy, it often results in slower speeds due to the distance from the remote server and can break access to local services if not configured correctly.
The goal is to create a "split tunnel" where only traffic destined for your home LAN (e.g., accessing media servers, printers, or local admin panels at 192.168.178.x) goes through the WireGuard tunnel, while all other traffic uses your local ISP connection directly.
Configuring the WireGuard Client on Debian 12
Debian 12 typically uses wireguard-tools or systemd-networkd to manage connections. You need to edit the configuration file for your specific peer, usually located in /etc/wireguard/wg0.conf or within the /etc/wireguard/interfaces/ directory depending on your setup.
Locate the [Peer] section for your Fritzbox 7530 server. The critical change involves the AllowedIPs line. Instead of the default route, specify only the subnet used by your Fritzbox router. Most Fritzboxes use the 192.168.178.0/24 subnet by default.
[Interface]
PrivateKey = your_client_private_key
Address = 10.0.0.2/32
[Peer]
PublicKey = fritzbox_public_key
Endpoint = your_fritzbox_dynamic_dns_or_ip:51820
AllowedIPs = 192.168.178.0/24
PersistentKeepalive = 25By setting AllowedIPs = 192.168.178.0/24, you instruct the kernel’s networking stack to only encapsulate packets destined for addresses within that range. Any packet destined for Google, YouTube, or any other external site will bypass the WireGuard interface and go through your default Ethernet or Wi-Fi gateway.
Verifying Route Table Behavior
After updating the configuration, restart the WireGuard service using sudo systemctl restart [email protected] (assuming your interface is named wg0). To verify that the split tunnel is working, open a terminal and run ip route show.
You should see two relevant lines:
- A default route pointing to your local gateway (e.g.,
default via 192.168.1.1 dev eth0). - A specific route for the Fritzbox LAN pointing to the WireGuard interface (e.g.,
192.168.178.0/24 dev wg0 proto kernel scope link src 10.0.0.2).
If you see default via 10.0.0.1 dev wg0, then all traffic is still going through the VPN. Remove the 0.0.0.0/0 entry from AllowedIPs and ensure no static routes are forcing the default path.
Handling DNS Resolution
Even with correct routing, DNS queries might leak or resolve incorrectly if your system is configured to use the VPN’s DNS server for everything. In Debian 12, if you are using NetworkManager, check the connection settings for the WireGuard profile. Ensure that "IPv4 Method" is set to "Automatic (DHCP)" or "Automatic (DHCP) addresses only," but critically, uncheck "Use this connection only for resources on its network" if you want full local internet access, or conversely, ensure that the DNS servers listed under the WireGuard profile are only applied when the interface is active for local resolution.
For advanced users using systemd-resolved, you may need to configure per-link DNS settings to ensure that local domains resolve via the Fritzbox while external domains use your ISP’s resolvers. However, for most standard setups, simply restricting AllowedIPs prevents the OS from treating the VPN as the primary gateway for DNS lookups unless explicitly configured otherwise.
Troubleshooting Common Issues
If you find that you cannot access the internet after applying these changes, check your firewall rules. Debian’s ufw or iptables might be blocking outgoing traffic on non-standard ports. Ensure that UDP port 51820 is allowed for outbound connections. Additionally, some ISPs or corporate networks may block WireGuard traffic; if so, consider using multipath-tcp or configuring the Fritzbox to use a different port.
Another common issue arises if you have multiple network interfaces. Ensure that the metric of your primary Ethernet/Wi-Fi interface is lower than that of the WireGuard interface. A lower metric indicates higher priority. You can adjust this in /etc/network/interfaces or via NetworkManager GUI settings.
For more detailed troubleshooting on connectivity issues, refer to our guide on Wireguard Issue on Home WiFi - Troubleshooting Guide. If you encounter problems with the server side configuration, such as duplicate installations, check Wireguard Server Installed Multiple Times.
Frequently Asked Questions
Why is my internet speed slow even with AllowedIPs restricted?
Slow speeds are rarely caused by the AllowedIPs restriction itself, as local traffic bypasses the tunnel. Instead, check if background applications are still using the old VPN connection or if your ISP is throttling certain types of traffic. Ensure that your local DNS resolver is responding quickly, as DNS latency can mimic bandwidth issues.
Can I route only specific websites through the VPN?
No, WireGuard operates at the network layer (Layer 3), meaning it routes based on IP addresses, not domain names. To route specific websites through the VPN, you would need to use a proxy application like Proxifier on your Debian machine, which operates at the application layer.
How do I add another subnet to the AllowedIPs list?
You can add multiple subnets by separating them with commas. For example, if you have a secondary network at 192.168.2.0/24, set AllowedIPs = 192.168.178.0/24, 192.168.2.0/24. This ensures traffic to both networks is tunneled while all other traffic remains local.
Does this configuration work with IPv6?
Yes, but you must also configure IPv6 routing. If your Fritzbox uses IPv6, add an Address line for IPv6 in the [Interface] section and include the corresponding IPv6 subnet in AllowedIPs (e.g., fd00::/64). Without this, IPv6 traffic may leak out of the tunnel or fail to reach local IPv6 resources.
What happens if the Fritzbox IP changes?
The AllowedIPs define the destination subnet, not the server’s public IP. As long as the Fritzbox continues to use the same private subnet (192.168.178.0/24) internally, the routing rules remain valid regardless of dynamic DNS changes or public IP updates on the WAN side.