Recommended Free Tools
Yes. A router can send only chosen devices, VLANs, destinations, or firewall-policy matches through a WireGuard tunnel while leaving all other traffic on the normal WAN connection. WireGuard supplies cryptokey routing through AllowedIPs; the router’s route tables, policy rules, firewall forwarding, and NAT determine which packets actually use the tunnel. The most common mistake is enabling 0.0.0.0/0 (and, for IPv6, ::/0) as an automatically installed route, which can turn a selective policy into a whole-network VPN.
What router split tunneling means
Split tunneling is a routing policy, not a separate WireGuard mode. Your router has at least two possible exits: the ordinary WAN gateway and a WireGuard interface. A split-tunnel rule sends only traffic that matches a defined selector through WireGuard. Everything else keeps using WAN.
As an Amazon Associate I earn from qualifying purchases.
The selector can be based on the packet’s source, destination, or both. Common designs include:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Per-device routing: one host address, a group of host addresses, or an entire VLAN uses WireGuard; the rest of the LAN uses WAN.
- Per-destination routing: traffic for selected private networks or services uses WireGuard, regardless of which local device generated it.
- Combined policy: a particular device can reach selected destinations through WireGuard while its other traffic stays on WAN.
This separation matters because a tunnel can be healthy while the wrong packets enter it. A successful handshake proves that cryptographic connectivity exists; it does not prove that your policy selected the intended clients, that replies return through the same path, or that DNS and IPv6 follow the same decision.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
What the router, not WireGuard, decides
WireGuard associates peer public keys with tunnel addresses and permitted prefixes. The operating system then installs routes and applies policy rules. On a router, firewall zones, gateway selection, NAT, and return-path behavior complete the decision. Changing AllowedIPs alone does not create a reliable per-device split tunnel if the router’s route table still points every packet at WAN, nor does it safely create one if a default route has been inserted into the main table.
How AllowedIPs works in a split tunnel
WireGuard’s official design describes AllowedIPs as “Cryptokey Routing”: a public key is associated with tunnel IP addresses that are allowed inside the tunnel. The field has two related jobs:
- Outbound peer selection: when the router sends a packet, the destination prefix is matched against a peer’s
AllowedIPsto select that peer. - Inbound source validation: packets arriving from a peer are checked against the source prefixes that peer is allowed to claim.
Router interfaces add another layer. On OpenWrt, the peer’s allowed_ips describes prefixes the peer may use inside the tunnel, while route_allowed_ips controls whether OpenWrt automatically creates routes for those prefixes. That switch controls route installation; it is not a substitute for a source-device or destination policy.
Why 0.0.0.0/0 can capture the whole network
0.0.0.0/0 matches every IPv4 destination. It is appropriate when a peer is intended to act as an Internet gateway, but it is dangerous when the router automatically installs that prefix in the main routing table. The new default can win over the normal WAN default, sending traffic from the router itself and potentially the entire LAN toward WireGuard.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
IPv6 has the same issue with ::/0. Treat IPv4 and IPv6 as separate routing plans: an IPv4-only policy does not automatically prevent IPv6 traffic from using WAN, failing, or leaking outside the intended tunnel.
Selective prefixes versus an Internet-gateway peer
| Design | AllowedIPs approach | Route and policy requirement |
|---|---|---|
| Selected remote networks | Put only those remote prefixes in the peer’s AllowedIPs. |
Install routes for those prefixes, or direct matching traffic with policy rules, while retaining the WAN default. |
| One tunnel address or host | A single address can be represented as a /32; OpenWrt documentation notes that this describes an IP rather than a subnet. |
Use a route or policy rule that targets that address and leaves unrelated destinations on WAN. |
| Internet gateway for selected clients | Use 0.0.0.0/0, and add ::/0 only when IPv6 is deliberately included. |
Keep the default route out of the main table when necessary, then use source-based policy rules, aliases, VLAN rules, or equivalent selectors to send only chosen LAN traffic to the WireGuard gateway. |
Plan the design before changing the router
Write down the intended traffic classes first. This prevents an accidental default route from becoming your policy.
Confirm firmware capabilities
- WireGuard client support, including peer key and endpoint configuration.
- Policy routing or gateway rules that can match source devices, VLANs, or destinations.
- Firewall zones or assigned-interface rules for forwarding into the tunnel.
- Outbound NAT controls, because some remote networks require translated source addresses.
- IPv6 route and firewall support if any clients use IPv6.
- Tools for checking handshakes, routes, firewall counters, and traceroute paths.
Record the tunnel parameters
Before creating rules, collect the tunnel address, peer public key, endpoint hostname or address, endpoint port, DNS plan, and the remote prefixes. Decide whether the peer is a private-network gateway or an Internet gateway. The distinction determines whether a narrow prefix list or a default prefix belongs in AllowedIPs.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchChoose one selector and make its priority explicit
For a per-device design, use fixed client addresses, a DHCP reservation, an address alias, or a VLAN so the selector remains stable. For a destination design, list the remote prefixes and place those routes above broader rules. If your firewall evaluates rules from top to bottom, put the specific WireGuard policy before a general LAN-to-WAN allow rule. Otherwise the broad rule may accept the packet before the tunnel rule is considered.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Plan the return path
Forward traffic can enter WireGuard successfully and still fail when replies return through WAN. The remote side must have a route back to the client network, or the router must perform outbound NAT where that side expects translated traffic. On firewalls that support assigned-interface reply behavior, use the interface-specific rules so return packets are tied to the selected gateway rather than being automatically sent elsewhere.
Protect the peer endpoint route
The WireGuard handshake itself must reach the peer through WAN. If a default route or broad policy sends the endpoint address into the tunnel it is trying to establish, the connection can loop or disappear when the tunnel changes state. Keep an explicit WAN route for the endpoint, or use a fwmark and alternate-table design like the method described in WireGuard’s networking documentation. Test this before relying on the tunnel for remote administration.
Configure selective routing on OpenWrt
OpenWrt’s documented client procedure creates a WireGuard interface, adds a peer, places the interface in a firewall zone, and then verifies the handshake and path. The exact menu names vary by release, but the logical sequence is consistent.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Create the WireGuard interface. Enter the local tunnel address and private key supplied for the router. Do not reuse a key pair on another peer.
- Add the peer. Enter the peer public key, endpoint, and the intended
allowed_ips. For a private-network design, use only the remote prefixes that peer should carry. For an Internet-gateway design, the peer may need0.0.0.0/0and, if IPv6 is included,::/0. - Choose route installation deliberately.
route_allowed_ipsdetermines whether OpenWrt automatically adds routes for the peer prefixes. Leave the normal WAN default in place for a split tunnel. If you use a default prefix for an Internet gateway, avoid allowing that prefix to replace the main-table default unless every router and LAN packet is meant to use the VPN. Use policy-routing rules or a separate routing table for selected sources instead. - Assign the interface to a firewall zone. Permit forwarding from the selected LAN, VLAN, or source zone to the WireGuard zone. Do not grant broad forwarding merely to make the first test pass; start with the intended source and destination scope.
- Add the selector. For per-device routing, match the reserved client address or alias. For a VLAN design, match the VLAN interface. For destination routing, match the remote prefixes. Keep this selector above general forwarding rules and ensure the selected traffic uses the WireGuard routing table or interface.
- Configure NAT where required. If the remote network has no route back to the LAN addresses, add outbound masquerading or another appropriate translation on the WireGuard zone. If the remote side does have a return route, avoid unnecessary NAT so original client addresses remain visible.
- Keep the endpoint on WAN. Add an explicit endpoint route or equivalent fwmark/table rule so handshake packets never follow the VPN default. Recheck this after reconnects and after changing the peer endpoint.
- Handle DNS and IPv6 intentionally. Decide whether selected clients use DNS through the tunnel, local DNS, or another resolver. Add IPv6
AllowedIPsand policy rules only if IPv6 should follow the same path; otherwise block or separately route it according to your design. - Verify in LuCI and from clients. Confirm a recent handshake, then test one selected client and one excluded client independently. OpenWrt recommends checking paths with
tracerouteandtraceroute6, not relying only on the interface status page.
OpenWrt route-setting choices
| Situation | Practical OpenWrt choice | Reason |
|---|---|---|
| Only selected remote prefixes should use WireGuard | Use those prefixes in allowed_ips and install only their routes, either automatically or in the policy table. |
The WAN default remains available for ordinary Internet traffic. |
| Selected clients should use a peer as their Internet gateway | Keep the peer’s default prefixes available for peer selection, but prevent an unintended main-table default; apply source-based policy routing. | The source selector, not the default prefix alone, limits which LAN clients use the VPN. |
| Excluded clients must remain on WAN | Test the policy order and confirm no broader default route or rule catches them. | A broad rule can override the intended exception. |
Configure selective routing on pfSense
pfSense supports both static routes and policy routing over WireGuard. Its clearest per-device pattern is a LAN firewall rule that matches a selected host address and chooses the WireGuard gateway.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Create the WireGuard tunnel and peer. Enter the tunnel addresses, peer key, endpoint, and the peer’s allowed networks. Use narrow remote prefixes for private-network routing, or the appropriate default prefixes when the peer is an Internet gateway.
- Assign the WireGuard interface. An assigned interface receives its own firewall-rule tab. This makes forwarding, logging, and return-path behavior easier to reason about than leaving all decisions on an unassigned interface.
- Create the gateway. Make the WireGuard interface available as a gateway for policy rules. Check automatic gateway behavior carefully; pfSense documentation warns that automatic selection can cause the firewall to use WireGuard as its default gateway unintentionally.
- Add the LAN policy rule. On the LAN rules page, match the selected host address, alias, VLAN, or destination and set the gateway to WireGuard. Place this rule above broad LAN-to-any rules. A selected host rule is the standard per-device split-tunnel pattern.
- Preserve return-path behavior. Rules on assigned interfaces provide
reply-tobehavior for return traffic. Use that interface-specific rule model when you need replies to leave through the same WireGuard gateway rather than being reselected by the default route. - Configure outbound NAT. pfSense applies automatic outbound NAT to traffic leaving assigned WireGuard interfaces. Verify the resulting translation against the remote network’s expectations; switch to a more explicit NAT arrangement only when the topology requires it.
- Add static routes when the design is destination-based. A static route can direct a remote prefix to WireGuard without selecting clients. If both source and destination matter, combine the route with a LAN policy rule.
- Resolve multiple-peer ambiguity. When several peers share one WireGuard tunnel, their
AllowedIPsmust disambiguate which peer receives each network. Overlapping prefixes can send traffic to the wrong peer or make the intended peer impossible to select. - Test selected and excluded clients separately. Check the handshake, gateway state, public address, DNS behavior, traceroute path, and firewall counters. Then disconnect or disable the tunnel and confirm that the ordinary WAN path behaves as expected.
Per-device pfSense example in words
Suppose one LAN host should use the WireGuard Internet gateway while other hosts remain on WAN. Give the host a stable address, create a LAN rule matching that address, select the WireGuard gateway, and place the rule above the general LAN allow rule. Leave the general rule’s gateway at the normal WAN selection. Verify that the selected host’s replies follow the assigned-interface policy and that outbound NAT presents an address accepted by the peer.
Testing that split tunneling really works
Testing must compare at least two clients: one selected and one excluded. Testing only the router can hide a policy mistake because router-originated traffic may use a different table from forwarded LAN traffic.
- Check the handshake time. A recent WireGuard handshake confirms that encrypted peer traffic is exchanging successfully. It does not establish that the desired client traffic is using the tunnel.
- Check the public address. From the selected client, verify that an Internet-facing service sees the VPN egress when the design is an Internet gateway. From the excluded client, verify that the ordinary WAN address remains visible.
- Check private destinations. Access a service in the remote prefixes from both a selected and an excluded source. The selected source should use WireGuard; the excluded source should follow the intended alternative path or be denied.
- Trace IPv4 and IPv6 separately. Run
traceroutefor IPv4 andtraceroute6for IPv6. A successful IPv4 trace says nothing about an IPv6 leak or broken IPv6 return route. - Inspect DNS behavior. Confirm which resolver each client uses and whether DNS requests follow the same policy as application traffic. A client can show a VPN public address while still sending DNS queries to the ISP path.
- Read firewall and NAT counters. Counters should increase on the intended LAN-to-WireGuard rule and, when configured, on the WireGuard outbound-NAT rule. Unexpected WAN counters often identify a rule-order or route-table problem.
- Test failure and recovery. Stop the tunnel, restart it, and change the endpoint state. Selected clients should either fail closed according to your policy or return to the explicitly chosen fallback; they should not silently switch paths without your design allowing it.
Troubleshoot the common failure modes
| Symptom | Likely cause | Fix to investigate |
|---|---|---|
| The whole LAN uses the VPN | 0.0.0.0/0 or ::/0 was installed in the main table, or a broad policy rule appears above the exception. |
Inspect the main routing table and policy-rule order. Keep the WAN default for ordinary traffic and apply a source or destination selector to the VPN gateway. |
| The handshake is present but applications fail | Incorrect AllowedIPs, missing firewall forwarding, absent return route, or missing NAT. |
Check peer prefixes, LAN-to-WireGuard forwarding, the remote return path, and outbound NAT requirements one at a time. |
| Replies leave through the wrong interface | The firewall selected WireGuard for outbound traffic but did not preserve the return path. | Use assigned-interface rules with reply-to or the platform’s equivalent return-path policy, then retest with counters and traceroute. |
| IPv4 works but IPv6 leaks or fails | IPv6 has separate routes and policy rules; IPv4 settings do not cover it. | Configure IPv6 AllowedIPs, firewall rules, and policy routing deliberately, or provide an explicit IPv6 fallback/blocking policy. |
| The router loses access to the peer endpoint | The endpoint address is being routed into the tunnel, creating a loop or removing the handshake path. | Restore an explicit WAN endpoint route or use fwmark-based endpoint protection with an alternate routing table. |
| DNS exposes the ISP path | DNS requests use a resolver or route outside the selected tunnel policy. | Choose DNS servers intentionally and route DNS requests consistently with the clients’ tunnel policy. |
| One of several peers receives the wrong network | Overlapping or insufficient peer AllowedIPs do not disambiguate ownership. |
Give each peer distinct, accurate prefixes and remove overlap unless the platform’s selection behavior is explicitly understood. |
Firewall, NAT, and endpoint details that decide reliability
Firewall forwarding is separate from route selection
A packet can have a valid WireGuard route and still be dropped by the firewall. Create a narrowly scoped forwarding permission from the selected LAN source to the WireGuard zone or gateway. Conversely, a permissive forwarding rule cannot force a packet into the tunnel if the route or policy still selects WAN.
Free tools Windows power users keep installed
One-click scans. No signup required.
NAT depends on the remote side
If the remote network knows how to return traffic to the original LAN prefixes, routing without NAT preserves client identity. If it does not, outbound NAT on the WireGuard interface may be necessary. Automatic NAT defaults differ by implementation, so inspect the translated source and the rule counters rather than assuming that a successful handshake implies usable forwarding.
PersistentKeepalive and idle NAT mappings
WireGuard’s quick-start documentation identifies 25 seconds as a sensible PersistentKeepalive value for many NAT or firewall situations in which a peer must receive traffic after being idle. It is a keepalive interval, not a speed setting. Use it when the topology needs periodic packets to maintain a mapping, and avoid treating it as a cure for incorrect routes, firewall rules, or peer prefixes.
Implementation trade-offs: OpenWrt and pfSense
| Capability | OpenWrt | pfSense |
|---|---|---|
| Per-device selection | Use policy-routing rules matching client addresses, VLANs, or aliases; keep route installation separate from the selector. | Use LAN firewall rules that match a host or alias and choose the WireGuard gateway. |
| Per-destination selection | Install selected peer prefixes or place them in a policy routing table. | Use static routes, gateway rules, or a combination of routes and firewall policy. |
| Default-prefix risk | Enabling route installation for 0.0.0.0/0 can replace the main-table WAN default; policy routing is intended to avoid that outcome. |
Automatic gateway selection can make WireGuard the firewall’s default gateway unintentionally. |
| Firewall integration | Assign the WireGuard interface to a firewall zone and permit the intended forwarding. | Assigning the interface creates a dedicated rule tab and supports interface-specific return behavior. |
| Return traffic | Requires correct remote routes or NAT and a policy that keeps replies on the intended path. | Assigned-interface rules provide reply-to behavior for return traffic. |
| Multiple peers | Peer prefixes must identify the intended remote networks and route table. | Peer AllowedIPs must disambiguate which peer receives each network. |
| Verification | LuCI handshake checks plus traceroute and traceroute6 are documented checks. |
Use gateway state, firewall counters, NAT state, and separate client path tests. |
WireGuard’s limits for split-tunnel deployments
WireGuard is a UDP VPN protocol. Its own documentation says it does not focus on obfuscation and explicitly does not support tunneling over TCP. Networks that block or severely restrict UDP therefore need an additional transport or obfuscation layer, evaluated separately from WireGuard itself. Adding such a layer changes the failure modes and should not be confused with ordinary split-routing configuration.
WireGuard also does not supply a one-click “route only these devices” function. That behavior comes from the router’s policy engine. The practical quality of an implementation depends on whether the firmware exposes source selectors, destination routes, separate tables, firewall zones, NAT controls, and endpoint-route protection clearly enough to audit.
A decision checklist before you enable the tunnel
- Have you named the exact devices, VLANs, or destination prefixes that should use WireGuard?
- Does the peer’s
AllowedIPsdescribe only the networks it should carry, or is a default prefix required because it is an Internet gateway? - Will enabling route installation put a default route in the main table?
- Are the selected source addresses stable enough for policy rules?
- Is forwarding from the selected LAN source to the WireGuard zone or gateway allowed?
- Does the remote side have a return route, or is outbound NAT required?
- Is the peer endpoint pinned to WAN so the handshake cannot loop into the tunnel?
- Do IPv4 and IPv6 each have an intentional route, firewall, and DNS policy?
- Have you tested one selected and one excluded client, including DNS and both traceroute variants?
The dependable pattern is consistent across platforms: keep ordinary WAN routing available, use AllowedIPs to describe the peer’s cryptokey reachability, use explicit policy rules to select traffic, permit only the required forwarding, provide a valid return path, and verify every path from real clients. A WireGuard handshake is the beginning of the test, not the final proof that split tunneling is working.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
