44Net Connect/Split Tunnel

By default, 44Net Connect uses a full tunnel, meaning all of your device's traffic goes through the WireGuard tunnel and comes out of the 44Net Connect endpoint. This simplifies configuration and troubleshooting, so it's good for new users. It also puts unnecessary traffic, such as software updates, through 44Net Connect endpoints. Bandwidth is a major expense for running 44Net Connect, so we request that users who are comfortable with advanced network configuration use a split tunnel, which puts necessary traffic through the tunnel. Split tunnel usage will remain opt-in because the advanced configuration required is not beginner friendly.

WireGuard configuration

Below is a template for the split tunnel WireGuard configuration. To fill it out, complete the following steps:

1. Fill in the name of the file where this config will be saved, in every spot labeled <NAME OF CONFIG FILE>. WireGuard uses the file name for the name of the interface it creates, which is why this is necessary configuration information.
2. Fill in the 44Net IPv4 address from your original config in every spot labeled <YOUR 44NET ADDRESS>.
3. Place the new config file in /etc/wireguard/

[Interface]
PrivateKey = INSERT PRIVATE KEY
Address = YOUR ADDRESSES

# The below line disables the default WireGuard routing rules
Table = off
MTU = 1380

PostUp = ip route add default dev <NAME OF CONFIG FILE> table 51820
PostUp = ip rule add from <YOUR 44NET ADDRESS>/32 table 51820

# Apply a firewall mark (fwmark) to connections initiated through the tunnel, and 
# route marked return traffic through the tunnel
PostUp = nft add table ip wgsplit
PostUp = nft 'add chain ip wgsplit pre { type filter hook prerouting priority mangle; }'
PostUp = nft add rule ip wgsplit pre iifname "<NAME OF CONFIG FILE>" ct mark set 0x2a
PostUp = ip rule add fwmark 0x2a lookup 51820

# Undo connection tracking
PostDown = ip rule del fwmark 0x2a lookup 51820
PostDown = nft del rule ip wgsplit pre iifname "<NAME OF CONFIG FILE>" ct mark set 0x2a
PostDown = 'delete chain ip wgsplit pre { type filter hook prerouting priority mangle; }'
PostDown = nft delete table ip wgsplit

PostDown = ip rule del from <YOUR 44NET ADDRESS>/32 table 51820
PostDown = ip route del default dev <NAME OF CONFIG FILE> table 51820


[Peer]
PublicKey = PxVe0R15aG7ZraLIXgzkz96/yEzHXFce3rtH8XOCTCc=
Endpoint = 44.27.228.1:44000
PersistentKeepalive = 20
# AllowedIPs must remain 0.0.0.0/0 because people may initiate connections from non-44Net
# IP addresses, and those should be allowed in.
AllowedIPs = 0.0.0.0/0, ::/0

After installing the file, but before enabling the systemd unit, run sudo systemctl edit wg-quick@<name of config file> and add the following:

[Unit]
Conflicts=wg-quick@<name of full tunnel config file>

This will mark your split tunnel systemd unit as conflicting with the full tunnel unit. That prevents you from accidentally running them both at the same time. When you start one, if the other is running, it will be automatically stopped.

Now the tunnel is ready, and can be started with sudo systemctl enable --now wg-quick@<name of config file>.

Troubleshooting

When using a split tunnel, you may experience traffic intended to exit via the 44Net Connect tunnel instead exiting via your normal connection. The cause for this varies based on application. The following tools may be helpful in diagnosing the issue.

• traceroute
• Wireshark / tshark / dumpcap
• tcpdump
• ip route / ip rule

Applications that support binding to a particular IP address should be instructed to bind to the 44Net IP address if their traffic is meant to always exit via the 44Net Connect tunnel. The Asterisk PBX software is one example that requires this.