# Route specific VLANs through ProtonVPN? **URL:** \ **Category:** Routers\ **Tags:** router\ **Created:** [August 4, 2025, 9:39pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775 "2025-08-04T21:39:13Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![anon77415413](https://forum.alta.inc/letter_avatar_proxy/v4/letter/a/f1d935/32.png) [@anon77415413](https://forum.alta.inc/u/anon77415413)\ **Post date:** [August 4, 2025, 9:39pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/1 "2025-08-04T21:39:13Z")
Can someone help me understand how to route specific VLAN traffic through ProtonVPN using a Wireguard config? ---
**Author:** ![anon77415413](https://forum.alta.inc/letter_avatar_proxy/v4/letter/a/f1d935/32.png) [@anon77415413](https://forum.alta.inc/u/anon77415413)\ **Post date:** [August 5, 2025, 11:59am UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/2 "2025-08-05T11:59:46Z")
Perhaps I can ask this question a different way. I would like to set up a clientVPN connection on Route10 to route most of my traffic through ProtonVPN. Right now it seems like I can only set up a site to site, and not a client. Am I missing something? ---
**Author:** ![jmszuch](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b2d939/32.png) [@jmszuch](https://forum.alta.inc/u/jmszuch)\ **Post date:** [August 5, 2025, 1:50pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/3 "2025-08-05T13:50:23Z")
I was thinking about this a little last night, but would you be able to setup a static route to send traffic from the subnet through the interface connecting to ProtonVPN? I haven’t really tried it myself but it sounds plausible to me at least 😄 Otherwise I know we could start getting into [Policy Based Routing using netifd from the CLI](https://openwrt.org/docs/guide-user/network/routing/pbr_netifd) ---
**Author:** ![anon77415413](https://forum.alta.inc/letter_avatar_proxy/v4/letter/a/f1d935/32.png) [@anon77415413](https://forum.alta.inc/u/anon77415413)\ **Post date:** [August 5, 2025, 2:02pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/4 "2025-08-05T14:02:20Z")
Those are all good thoughts. I wish I was even getting that far to try! where I am getting stuck is getting set up as a client. Route10 seems to only allow you to set up a site to site Wireguard connection, and I need a client connection. I can’t enter something there that makes sense. ![Screenshot 2025-08-05 at 08.01.26](https://forum.alta.inc/uploads/default/original/2X/3/3541f7addc70ccd9367983c5cbf2eb678d956cd1.png) ---
**Author:** ![jmszuch](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b2d939/32.png) [@jmszuch](https://forum.alta.inc/u/jmszuch)\ **Post date:** [August 5, 2025, 2:09pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/5 "2025-08-05T14:09:56Z")
Dang! I thought that’s part of what this option did: ![image](https://forum.alta.inc/uploads/default/original/2X/e/eb00c818350f3785aeca0cea00bd5f99409a3b23.png) There’s some chat about this as well a few months ago in a different topic I think: [How to use wg client (w/ static routing) in route10? - #5 by erpn7](https://forum.alta.inc/t/how-to-use-wg-client-w-static-routing-in-route10/4683/5) ---
**Author:** ![anon77415413](https://forum.alta.inc/letter_avatar_proxy/v4/letter/a/f1d935/32.png) [@anon77415413](https://forum.alta.inc/u/anon77415413)\ **Post date:** [August 5, 2025, 2:17pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/6 "2025-08-05T14:17:00Z")
Looks like that thread is discussing exactly the problem I am having… not sure there was ever any resolution. I bumped the thread. ---
**Author:** ![Beaker](https://forum.alta.inc/user_avatar/forum.alta.inc/beaker/32/3062_2.png) [@Beaker](https://forum.alta.inc/u/Beaker)\ **Post date:** [August 5, 2025, 2:58pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/7 "2025-08-05T14:58:08Z")
Yeah, it won’t let you configure 0.0.0.0/0 on the UI, bummer. My guess would be to assign a dummy IP (1.0.0.0/0) for example, get the config to stick within the R10, but don’t enable it. Log in through CLI and modify the route to 0.0.0.0/0, save to post-cfg.sh? ---
**Author:** ![dalewhlrr](https://forum.alta.inc/user_avatar/forum.alta.inc/dalewhlrr/32/1780_2.png) [@dalewhlrr](https://forum.alta.inc/u/dalewhlrr)\ **Post date:** [August 5, 2025, 5:14pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/8 "2025-08-05T17:14:03Z")
This is my /cfg/rc.local config. You can modify it for your needs. ```auto ~ # cat /cfg/rc.local #!/bin/ash # === WireGuard Interface === if ! uci show network | grep -q "^network.wg0="; then uci set network.wg0='interface' uci set network.wg0.proto='wireguard' uci set network.wg0.private_key='' uci set network.wg0.addresses='' uci set network.wg0.peerdns='0' uci add_list network.wg0.dns='' fi # === WireGuard Peer === if ! uci show network | grep -q "network.@wireguard_wg0.*.public_key=''"; then uci add network wireguard_wg0 uci set network.@wireguard_wg0[-1].public_key='' uci set network.@wireguard_wg0[-1].allowed_ips='0.0.0.0/0' uci set network.@wireguard_wg0[-1].endpoint_host='' uci set network.@wireguard_wg0[-1].endpoint_port='51820' uci set network.@wireguard_wg0[-1].persistent_keepalive='25' fi uci commit network /etc/init.d/network reload ifup wg0 # === Firewall Zone for WireGuard === if ! uci show firewall | grep -q "firewall.wg0_zone"; then uci set firewall.wg0_zone="zone" uci set firewall.wg0_zone.name="wg0" uci set firewall.wg0_zone.network="wg0" uci set firewall.wg0_zone.input="ACCEPT" uci set firewall.wg0_zone.output="ACCEPT" uci set firewall.wg0_zone.forward="REJECT" uci set firewall.wg0_zone.masq="1" uci set firewall.wg0_zone.mtu_fix="1" fi if ! uci get firewall.@zone[2].network | grep -q 'wg0'; then uci add_list firewall.@zone[2].network='wg0' fi # === Custom Firewall Rule === if ! uci show firewall | grep -q "Block_10.14.66.0_to_WAN"; then uci add firewall rule uci set firewall.@rule[-1].name='Block_10.14.66.0_to_WAN' uci set firewall.@rule[-1].src='lan' uci set firewall.@rule[-1].src_ip='10.14.66.0/24' uci set firewall.@rule[-1].dest='wan' uci set firewall.@rule[-1].proto='all' uci set firewall.@rule[-1].target='REJECT' uci set firewall.@rule[-1].enabled='1' fi uci commit firewall /etc/init.d/firewall restart # === Routing Table and Rules === grep -q "wgroute" /etc/iproute2/rt_tables || echo "200 wgroute" >> /etc/iproute2/rt_tables ip route show table wgroute | grep -q "^default" || ip route add default dev wg0 table wgroute ip rule | grep -q "from 10.14.66.0/24.*table wgroute" || ip rule add from 10.14.66.0/24 table wgroute priority 300 ip rule | grep -q "to 10.14.1.0/24.*lookup main" || ip rule add to 10.14.1.0/24 lookup main # === VPN Route Checker Script === cat << 'EOF' > /root/vpn-route-check.sh #!/bin/ash INTERFACE="10.14.66.1" EXPECTED_CITY="Göteborg" VPN_IF="wg0" ROUTING_TABLE="wgroute" LOG_TAG="VPNRouteCheck" CITY=$(curl --silent --interface "$INTERFACE" http://ipinfo.io/city) if ["$CITY" != "$EXPECTED_CITY"]; then logger -t "$LOG_TAG" "❌ City mismatch: '$CITY'. Reapplying route through $VPN_IF." ip route flush table $ROUTING_TABLE ip route add default dev "$VPN_IF" table $ROUTING_TABLE ip rule add from 10.14.66.0/24 table $ROUTING_TABLE priority 300 logger -t "$LOG_TAG" "✅ Route reapplied." else logger -t "$LOG_TAG" "✅ Routing through expected city: '$CITY'." fi EOF chmod +x /root/vpn-route-check.sh # === Cron Job for VPN Check === grep -q "/root/vpn-route-check.sh" /etc/crontabs/root || echo "* * * * * /root/vpn-route-check.sh" >> /etc/crontabs/root /etc/init.d/cron enable /etc/init.d/cron start # === Custom Restart on Firewall Reload === grep -q "/cfg/rc.local restart" /etc/init.d/firewall || sed -i '/reload_service()/a\ /cfg/rc.local restart' /etc/init.d/firewall exit 0 ``` ---
**Author:** ![anon77415413](https://forum.alta.inc/letter_avatar_proxy/v4/letter/a/f1d935/32.png) [@anon77415413](https://forum.alta.inc/u/anon77415413)\ **Post date:** [August 5, 2025, 5:26pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/9 "2025-08-05T17:26:20Z")
I really appreciate that! I like that we can get by with configs like this, but I really hope this can be fixed in the UI sooner rather than later. They released a “Client” section in the VPN config, and this sure seems like a bare minimum need for that to work correctly. ---
**Author:** ![dalewhlrr](https://forum.alta.inc/user_avatar/forum.alta.inc/dalewhlrr/32/1780_2.png) [@dalewhlrr](https://forum.alta.inc/u/dalewhlrr)\ **Post date:** [August 5, 2025, 5:28pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/10 "2025-08-05T17:28:58Z")
Yeah right now its just a split tunnel in the UI which in most business cases is what you want. But yeah I cant wait until policy based routing is implemented. ---
**Author:** ![system](https://forum.alta.inc/uploads/default/original/1X/087669c3d7c0a6495087b41d6f385a6771f2231c.png) [@system](https://forum.alta.inc/u/system)\ **Post date:** [February 1, 2026, 5:29pm UTC](https://forum.alta.inc/t/route-specific-vlans-through-protonvpn/5775/11 "2026-02-01T17:29:54Z")
This thread has been automatically closed due to inactivity. If you believe you have the same issue, please create a new post describing your issue. Feel free to link to this post for context if desired.