Any chance to get WiFi direct printer, Miracast, hotspot, ... working with Wireguard and "always on vpn"?

[onetimecontributor]

Hi, I'm trying to figure out if I can somehow configure RethinkDNS using WireGuard, to work with local services, like WiFi direct printer, Miracast and accessing devices connected to the protected device's hotspot.

I've seen answers re split tunelling, that its not planned to be brought back, but maybe (low chances), my use case has some workaround as it's Private Address Space RFC1918 IANA? #1789 (comment)

The only working set I've found is to disable kill switch on Android system level, which I don't feel comfortable with, please let me know if that's still ok, and that it will not introduce leaks, even if I have in-rethinkdns wireguard configured to capture all apps except for those I need for local services.

[onetimecontributor]

is there any way to configure wireguard's AllowedIPs field for that?

[zod076]

You could try that when at home connected to Wifi and rethink app enabled:

AllowedIPs = 0.0.0.0/1, 128.0.0.0/1, 8000::/1, ::/1

Then try to access local resources

[onetimecontributor]

speaking of Miracast, dunno why it wasn't working before, and if I've triggered anything, but as of now, Miracast works:

1. Wireguard's settings within rdns is in lockdown + always on mode
2. strange "app" listed by rdns as "Unnamed (5386)" is in Isolate mode with 192.168.. whitelisted and "bypass app from all proxies"
   I haven't noticed any connection attempts from the "app" to other addresses, but just in case, I've whitelisted broadcast 255.255.255.255 just in case

Are there any visible drawbacks of such combination Isolate + "bypass app from all proxies"?
Do I understand correctly, that the app will be allowed to connect only to whitelisted IPs but will skip WireGuard?

lag/delay is horrible that makes it unusable, but it may be due to my underpowered android device (will test with another one later).

[ignoramous]

The only working set I've found is to disable kill switch on Android system level, which I don't feel comfortable with, please let me know if that's still ok, and that it will not introduce leaks

Well, by "kill switch" I reckon you mean Android's VPN Lockdown mode (aka Block connections without VPN + Always-on VPN turned ON)? If so, leaving it turned ON is recommended to absolutely avoid ALL leaks (esp, given Rethink is supposed to be a "firewall"). Unfortunately, like you have found, LAN-local / WireGuard-local services are sometimes not routable by Rethink. This is something we want to desperately fix, but haven't been able to (see also: other peer-to-peer apps that don't optimally work with Rethink; like Synchthing, KDE Connect, uTorrent etc).

I've whitelisted broadcast 255.255.255.255 just in case

I don't Rethink correctly handles broadcast and multicast at all. Or at least, we have never tested if it does.

Do I understand correctly, that the app will be allowed to connect only to whitelisted IPs but will skip WireGuard?

Correct. That app will only connect to allowlisted / whitelisted IPs and domains, and will skip ALL active proxies (WireGuard, HTTP Connect, Orbot, SOCKS5).

lag/delay is horrible that makes it unusable

Does Miracast use UDP or TCP? If the latter (ie, TCP), in v055o (the upcoming version), we've made a bunch of improvements.

[onetimecontributor]

Just in case, I use WiFi direct printing, and Miracast screen mirroring just fine with settings I've described = everything works just fine
Kill switch - yes, that's what I meant and I do always keep it on.

[onetimecontributor]

thanks for the great software it's unique in its kind and the only one that solves my needs