Tunnel a specific user's traffic over a WireGuard VPN connection
We’re using wg-quick and its systemd unit to manage the tunnel. Assuming you’ve set up /etc/wireguard/vpn.conf, add these rules to the [Interface] section:
Table = vpn PostUp = ip rule add to 10.0.0.0/8 table main priority 1000 PostUp = ip rule add uidrange 1000-1000 table vpn priority 1001 PreDown = ip rule del to 10.0.0.0/8 table main PreDown = ip rule del uidrange 1000-1000 table vpn
Table configures wg-quick to create a vpn routing table. It won’t be used unless you add rules to send traffic to that table.
The first rule excludes traffic on the local 10...* network from being tunneled over WireGuard. I use this so that my ZeroTier connections keep working.
The second rule is what actually causes traffic from the selected users to be sent over WireGuard.
To get the UID for a user, use
id -u myusername.