# How to use wg client (w/ static routing) in route10? **URL:** \ **Category:** Routers\ **Tags:** controller\ **Created:** [February 22, 2025, 3:19pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683 "2025-02-22T15:19:19Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![erpn7](https://forum.alta.inc/letter_avatar_proxy/v4/letter/e/f475e1/32.png) [@erpn7](https://forum.alta.inc/u/erpn7)\ **Post date:** [February 22, 2025, 3:19pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/1 "2025-02-22T15:19:20Z")
with the new “WireGuard Client support (with static routing)” feature in route10 i’m able to setup a wg client, but i cant find a way to add routing to that ‘tunnel’ and actually use it. is that part still not available in the controller (im using the cloud controller)? is there a guide on how to set it up? (the subnet field on the client setting does nothing) ---
**Author:** ![Hefty](https://forum.alta.inc/letter_avatar_proxy/v4/letter/h/ed655f/32.png) [@Hefty](https://forum.alta.inc/u/Hefty)\ **Post date:** [February 24, 2025, 3:15pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/2 "2025-02-24T15:15:17Z")
I think this feature may have been broken in 1.3x, I had everything working in 1.3w but since upgrading to 1.3x no peers are added for wg clients I create, and I can’t see any config for it when doing a `uci show` or a `wg show` / `wg showconf `. Which FW version are you on? ---
**Author:** ![erpn7](https://forum.alta.inc/letter_avatar_proxy/v4/letter/e/f475e1/32.png) [@erpn7](https://forum.alta.inc/u/erpn7)\ **Post date:** [February 24, 2025, 4:14pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/3 "2025-02-24T16:14:24Z")
Latest fw on every device. and i can see my peers (from wg server) and the wg client using `wg show` / `wg showconf ` ---
**Author:** ![Alta-MikeD](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-miked/32/1942_2.png) [@Alta-MikeD](https://forum.alta.inc/u/Alta-MikeD)\ **Post date:** [February 24, 2025, 9:39pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/4 "2025-02-24T21:39:37Z")
> [@erpn7](#): > > (the subnet field on the client setting does nothing) These are supposed to work. Firmware 1.3y is being pushed out now with fixes for the WG client. ---
**Author:** ![erpn7](https://forum.alta.inc/letter_avatar_proxy/v4/letter/e/f475e1/32.png) [@erpn7](https://forum.alta.inc/u/erpn7)\ **Post date:** [February 24, 2025, 10:51pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/5 "2025-02-24T22:51:55Z")
update to 1.3y … reboot … still not routing the subnet 10.x.x.1/24 out thru the wg\_client (i even tried 10.x.x.1/32 [route just 1 ip] still not luck [with reboot of route10 after every client change]) also, im still not able to add wg client without PKS. _firmware 1.3x → Add support for WireGuard client without PSK (controller support pending)_ ```auto current firmware: route10 -- 1.3y s8-poe -- 2.1t APs -- 2.2g controller -- cloud ``` ---
**Author:** ![erpn7](https://forum.alta.inc/letter_avatar_proxy/v4/letter/e/f475e1/32.png) [@erpn7](https://forum.alta.inc/u/erpn7)\ **Post date:** [February 27, 2025, 10:07pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/6 "2025-02-27T22:07:14Z")
@Alta-MikeD – any news? i’m doing anything wrong on the setup? ---
**Author:** ![raematazz](https://forum.alta.inc/user_avatar/forum.alta.inc/raematazz/32/298_2.png) [@raematazz](https://forum.alta.inc/u/raematazz)\ **Post date:** [March 3, 2025, 1:37am UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/7 "2025-03-03T01:37:14Z")
My Route10 is on the 1.3y firmware and also unable to save my configuration with no PSK in the field. ![WG Client](https://forum.alta.inc/uploads/default/original/2X/f/f6bcc23ac307f69a5c3f6f51b093737c0c078aec.jpeg) ---
**Author:** ![Alta-MikeD](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-miked/32/1942_2.png) [@Alta-MikeD](https://forum.alta.inc/u/Alta-MikeD)\ **Post date:** [March 6, 2025, 6:11pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/8 "2025-03-06T18:11:37Z")
> [@erpn7](#): > > still not routing the subnet 10.x.x.1/24 out thru the wg\_client Can you please clarify the use of “out” here? I assume this is out from the server? Or do you literally mean out/transmit from the WG client/peer (to server)? > [@erpn7](#): > > also, im still not able to add wg client without PKS. This still is not yet supported, even as of 1.0v. This is Control side. > [@erpn7](#): > > any news? i’m doing anything wrong on the setup? I’ll be doing some testing/verification shortly and will follow up. This was working perfectly fine for me before when I tested—any of the configured remote peer’s subnets were accessible, but only after I configured them in the `AllowedIPs` list (and `AllowedIPs` is really only meant for the remote peer, not for subnets local to the device, to my understanding). I do have a question mark/possible bug I’m wondering about there, but you don’t appear to have hit that one based on what you shared in your post (I’m curious about network address interpretation as there was a previous bug related to exactly that). There is another one I’m wondering about with S2S, too, but that’s a separate topic… ---
**Author:** ![Alta-MikeD](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-miked/32/1942_2.png) [@Alta-MikeD](https://forum.alta.inc/u/Alta-MikeD)\ **Post date:** [March 6, 2025, 6:13pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/9 "2025-03-06T18:13:00Z")
> [@raematazz](#): > > My Route10 is on the 1.3y firmware and also unable to save my configuration with no PSK in the field. Support will be fixed in a future Control update. This is not a firmware side change. It is not supported in 1.0v which is the latest at the time of this post. ---
**Author:** ![erpn7](https://forum.alta.inc/letter_avatar_proxy/v4/letter/e/f475e1/32.png) [@erpn7](https://forum.alta.inc/u/erpn7)\ **Post date:** [March 6, 2025, 8:32pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/10 "2025-03-06T20:32:58Z")
@Alta-MikeD – what im trying to do is this: - connect to a wg server in another state (wg\_s1) - use route10 as a wg client (wg\_c1) to connect to wg\_s1 (i can connect successfully from wg\_c1 to wg\_s1 – at least thats what i see in the wg\_s1 logs) - my local machine (local1) should exit to the internet thru wg\_s1 via the wg\_c1 tunel (local1 is in the subnet assigned in the wg\_c1 settings) - local1 gets no internet access when the wg\_c1 is enabled - if i connect to wg\_s1 directly from my laptop wg client (wg\_c2) or phone wg client (wg\_c3) using the same settings, i can see the successful connection(s) in wg\_s1 logs, and my traffic goes out to the internet via wg\_s1 (if i visit ip.wtf or [ip.me](http://ip.me) i get the wg\_s1 public IP address) my question: how can i direct the traffic from my local1 via the wg tunnel created between wg\_c1 and wg\_s1? (on my wg\_c2 and wg\_c3 tunnels, Allowed IPs in the settings is 0.0.0.0/0) PS - in the wg\_c1 config, the IP range from Subnet, shows as Allowed IPs if i do a wg show (in route10 via ssh); if i try to add Subnet 0.0.0.0/0 its not letting me (_Please enter a valid subnet address and prefix._) PS2 - if you need access to my site let me know; all hardware is on latest firmware as of right now, and i use cloud controller ---
**Author:** ![Alta-MikeD](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-miked/32/1942_2.png) [@Alta-MikeD](https://forum.alta.inc/u/Alta-MikeD)\ **Post date:** [March 6, 2025, 9:00pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/11 "2025-03-06T21:00:27Z")
Thanks for the details! So I haven’t gotten to testing yet, but based on your details I think it’s leaning at least partially on what I was suspecting. I really want to test before I say too much more though as I’m not 100% sure of all the parts. Getting set up for it now, I have 2 WANs here at home, and multiple Route10s, so that part is easy… When you specify the actual remote peer’s subnet in the AllowedIPs on the client, are you entering the gateway IP 10.x.x.1/24? or 10.x.x.0/24? Both are technically valid ways to write it, but the latter written as a literal network address is more likely to fail, and it should be the (actual) gateway IP+CIDR when you want an entire subnet. If you haven’t yet tried that, please do (not entirely sure in the above post with the /24 and /32 mentioned). I realize this won’t route all traffic, but this would confirm if we can access a remote peer’s subnet, which is a start. I know 0.0.0.0/0 is also valid, and usually is used client side to route all client/peer traffic over the WG tunnel, but if the firmware is reporting it’s not valid then that is a red-flag for an issue if it’s what’s currently configured in AllowedIPs. I am not sure why it’s allowed in the front end if it’s being rejected by the firmware, but that’s something I need to check too. I’m more than happy to take a look if that’s what you’d prefer. Please just let me know. I’ll follow up shortly with the various results from my testing. ---
**Author:** ![erpn7](https://forum.alta.inc/letter_avatar_proxy/v4/letter/e/f475e1/32.png) [@erpn7](https://forum.alta.inc/u/erpn7)\ **Post date:** [March 6, 2025, 9:59pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/12 "2025-03-06T21:59:55Z")
> [@Alta-MikeD](#): > > When you specify the actual remote peer’s subnet in the AllowedIPs on the client, are you entering the gateway IP 10.x.x.1/24? or 10.x.x.0/24? in route10 client setup … what should be entering for Subnet? (subnet in our route10 … or a subnet in wg server?) ---
**Author:** ![erpn7](https://forum.alta.inc/letter_avatar_proxy/v4/letter/e/f475e1/32.png) [@erpn7](https://forum.alta.inc/u/erpn7)\ **Post date:** [March 6, 2025, 10:04pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/13 "2025-03-06T22:04:14Z")
> [@erpn7](#): > > in route10 client setup … what should be entering for Subnet? > (subnet in our route10 … or a subnet in wg server?) i just tested, if i enter a subnet (i used 10.x.x.0/24) in the wg server … i can access stuff on that network. but its using the tunnel just for the IPs in that range. Im not going out to the internet via that tunnel. _(edit: 10.x.x.1/24 does not allow me to access any resources)_ maybe as feedback … on the route10 client setup GUI … **Subnet** should be renamed to **Allowed IPs**? ---
**Author:** ![Alta-MikeD](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-miked/32/1942_2.png) [@Alta-MikeD](https://forum.alta.inc/u/Alta-MikeD)\ **Post date:** [March 6, 2025, 10:44pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/14 "2025-03-06T22:44:38Z")
> [@erpn7](#): > > in route10 client setup … what should be entering for Subnet? Sorry, to answer this, my understanding is that the `AllowedIPs` should contain the IP(s)/subnet(s) you wish to allow from the remote peer. So for the client you would want the server’s remote subnets, and then if it was S2S, you would want the server to have the subnets of the client in the `AllowedIPs` to get 2 way traffic over the tunnel. Now that part just covers internal subnet traffic, but not everything. This goes back to `0.0.0.0/0` being rejected by firmware. I certainly could be mistaken, but I think on the client side this is usually what you’d enter to route all (IPv4) traffic over the tunnel ( `::/0` for IPv6). That seems like an unintended bug/limitation that needs to be fixed in firmware, but I could be mistaken. Technically server/client roles really are only defined by the connection initiation (i.e., the server listens for incoming connections), once the tunnel is established both ends are essentially peers… If that helps simplify what I meant by peer and remote peer above. > [@erpn7](#): > > i just tested, if i enter a subnet (i used 10.x.x.0/24) in the wg server … i can access stuff on that network. but its using the tunnel just for the IPs in that range. Im not going out to the internet via that tunnel. > _(edit: 10.x.x.1/24 does not allow me to access any resources)_ Thanks! So maybe it’s not the network address interpretation. However that does confirm my other suspicion. > [@erpn7](#): > > maybe as feedback … on the route10 client setup GUI … **Subnet** should be renamed to **Allowed IPs**? Thanks! Will bring this up for discussion. ---
**Author:** ![anon77415413](https://forum.alta.inc/letter_avatar_proxy/v4/letter/a/f1d935/32.png) [@anon77415413](https://forum.alta.inc/u/anon77415413)\ **Post date:** [August 5, 2025, 2:16pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/15 "2025-08-05T14:16:11Z")
Has there been any internal discussion, resolution to not being able to enter 0.0.0.0/0 in allowed IPs for a VPN client setup? I am trying to set up ProtonVPN to route a bunch of my traffic through and running into a roadblock. ---
**Author:** ![akalkbrenner](https://forum.alta.inc/letter_avatar_proxy/v4/letter/a/cab0a1/32.png) [@akalkbrenner](https://forum.alta.inc/u/akalkbrenner)\ **Post date:** [September 11, 2025, 2:23am UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/16 "2025-09-11T02:23:47Z")
I would like to add to this. I do know that some OS’s don’t allow 0.0.0.0/0 but if that’s the case, could you allow us to use 0.0.0.0/1,128.0.0.0/1 as a workaround? It appears you are automatically not allowing anything that starts with a 0, even 0.10.10.10/32 for example. I think there is a better way to get this working as I too want to route all traffic over the VPN. ---
**Author:** ![mohsha](https://forum.alta.inc/letter_avatar_proxy/v4/letter/m/6a8cbe/32.png) [@mohsha](https://forum.alta.inc/u/mohsha)\ **Post date:** [November 25, 2025, 1:43am UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/17 "2025-11-25T01:43:11Z")
Is there an ETA to fix entering 0.0.0.0 in allowed IPs? This is a dealbreaker for me as I need this to configure Windscribe wireguard client for my daily use. I may have to end up returning this router as this has not been fixed for almost a year. ---
**Author:** ![Alta-Jeff](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-jeff/32/56_2.png) [@Alta-Jeff](https://forum.alta.inc/u/Alta-Jeff)\ **Post date:** [November 25, 2025, 4:05pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/18 "2025-11-25T16:05:35Z")
Are you referring to the application inserting 0.0.0.0 by default as the allowed IP? You can very easily edit the configuration file or Wireguard configuration after it’s been imported. ---
**Author:** ![mohsha](https://forum.alta.inc/letter_avatar_proxy/v4/letter/m/6a8cbe/32.png) [@mohsha](https://forum.alta.inc/u/mohsha)\ **Post date:** [November 25, 2025, 5:44pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/19 "2025-11-25T17:44:34Z")
Can you share the instructions on how to edit the configuration after it is imported? ---
**Author:** ![Alta-Jeff](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-jeff/32/56_2.png) [@Alta-Jeff](https://forum.alta.inc/u/Alta-Jeff)\ **Post date:** [November 25, 2025, 5:51pm UTC](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/20 "2025-11-25T17:51:12Z")
At least for the WireGuard Mac client: 1. Open WireGuard 2. Select the tunnel you want to modify 3. Click Edit 4. Edit the line “AllowedIPs”. You can delete the line or change it, or have multiple subnets, separated by commas. 5. Save 6. Activate [Next page](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683.md?page=2)