How can I manually configure an application split tunnel in wireguard?
You want to route traffic to your home network (192.168.1.0/24
) the same way as you route traffic to your NAS network (192.168.2.0/24
), so like Daniel B suggested, add a route specifically for your home network that uses the same gateway as your NAS network:
ip route add 192.168.1.0/24 via 192.168.2.1 dev enp0sx
If you have a /0
block in your WireGuard AllowedIPs
setting, wg-quick will always add the suppress_prefixlength
and fwmark
policy-routing rules you noted -- those rules tell the kernel to skip the default route in your main table and instead use the custom table zzzzzzzzzz
that wg-quick sets up for this case (except for traffic with your WireGuard endpoint, which WireGuard marks with 0xyyyyyyy
). Those rules are what send all traffic without a specific route defined for it through the WireGuard tunnel. They effectively override the default route in your main table which would normally send that traffic to your LAN router 192.168.2.1
.