Configure WireGuard AllowedIPs to exclude 0.0.0.0/0 and specify only the Fritzbox LAN subnet to enable split tunneling on Debian 12.