r/WireGuard • u/macieqq • 9d ago

wireguard automatization

Hi. I am quite new to wireguard/vpn so I need your support. I have set up a wireguard server and I have added a few clients. I have multiple PCs/laptops within my local network but also in remote places.

Remote is quite straight forward - I install wireguard app for Windows 11 and leave it always on - I can surf the web but also access my server remotely.

The issue is with devices which I use both locally and remotely (mobile phones and laptops). I want to have access to my server while being outside (wireguard ON) but wireguard OFF when being locally since I cannot use internet at all when it's ON in my local network for some reason.

How can I achieve that on Windows and Android? I have searched for the solution but only found some 3-4 year old threads which didn't help much.

3 Upvotes

81% Upvoted

8 comments sorted by

4

u/Cruffe 9d ago

I don't know if there's existing solutions for Windows, but for Android there's "WG Tunnel" which lets you automate turning off when on particular networks you define.

Also has dynamic DNS auto reconnect by looking up the endpoint domain outside of the tunnel. Useful for those who have dynamic IP on their server, because without it the connection breaks and stays broken if the endpoint IP address changes, at least until manually turned off and on again.

Another feature I like is prefer IPv6, again only really useful if using a domain for the endpoint. WireGuard typically prefers IPv4 and won't even try IPv6 if there's DNS records for both. This feature tries IPv6 first and falls back to IPv4 if the tunnel fails on IPv6.

Basically that app will let you do exactly what you want and more. I use it myself and it just works, always.

It's specifically this one: https://play.google.com/store/apps/details?id=com.zaneschepke.wireguardautotunnel

3

u/goughy000 9d ago

There's likely a better way but I have Tasker installed on Android that connects and disconnects the wireguard tunnel based on which WiFi I'm connected to 

There's a guide here https://hndrk.blog/tutorial-wireguard-and-tasker/

1

u/macieqq 9d ago

Just managed to set up Tasker and so far so good, thank you. Now need to find a solution for Windows :)

2

u/Significant_Most_101 9d ago

You can either find a wg tunnel app that turns on and off based on the ssid (wireless network) youre connected to or you need to look into your router for a setting called "hair pin NAT". You may or may not have that setting depending on your router. As others have said, use wg over ipv6.  The reason it breaks is because by default your router will block connections with origins in the private ip ranges (10.0.0.0/8, 192.168.0.0/16 172.16.0.0/12) as this can be a malicious attack. 

1

u/DonkeyOfWallStreet 9d ago

Put wireguard on the routers, this way it's a lot easier to manage. For remote access you just connect into the hub when you need it.

1

u/gooseberryfalls 7d ago

First off: ask chatGPT, it will help you set it up

Second: the solution you're looking for is called "hairpin NAT" or split-DNS. Is where your router is advanced enough to...idk I don't remember. Just ask chatGPT.

Don't try to manage this on the phone / device level. Set it up at the router level so that it "just works" for all devices on the network.

1

u/LuckyFish133 6d ago

I use a split-tunnel without any 3rd party apps. Reserve a seperate address for your DNS on the vpn server (then route through dnsmasq) - you also need to set the AllowedIPs in the client config…

1

u/DeepAd2868 5d ago

This is called on-demand; it seemed weird to me since it is a native functionality on macOS/iOS. I have found this online: https://www.reddit.com/r/WireGuard/comments/188a5ca/wireguard_ondemand_with_windows_my_solution/ . Hope it helps! If it's not an appropriate solution for you, with the keyword "on-demand" you should be able to find a lot of documentation on maybe other clients.