BE3600 Wireguard Client ignores AllowedIPs

BE3600 Wireguard Client ignores AllowedIPs

BE3600 Wireguard Client ignores AllowedIPs
BE3600 Wireguard Client ignores AllowedIPs
Sunday
Model: Archer BE3600  
Hardware Version: V1
Firmware Version: 1.2.1 Build 20250804 rel.79639(4555)

I am trying to configure a site-to-site wireguard VPN between two Archer BE3600 routers.

 

I have 192.168.0.0/24 and 192.168.1.0/24 LANs that I want to bridge. (I am additionally using 10.254.0.0/24 IPs for VPN addresses)
The router on 192.168.1.1 runs the VPN Server, and the router on 192.168.0.1 runs the VPN Client.

 

I can successfully connect to the VPN server from the client, but the client seems to be trying to route *all* traffic across the VPN link when I enable it, not just the networks I have specified in the AllowedIPs option for the WireGuard VPN client.

 

I specifically only have: 10.254.0.0/32, 192.168.0.0/24 set in the AllowedIPs configuration, but enabling the VPN Client for any devices on my local network causes them to lose Internet access. Connectivity across the VPN works as expected though.

 

I want to only route the AllowedIPs across the VPN link, not all traffic. Is there a configuration I am missing that will allow for that?

0
0
#1
2 Reply
Re:BE3600 Wireguard Client ignores AllowedIPs
Yesterday

  @Deelon 

hello

Fix 1: Switch to Policy-Based Routing (VPN Client Feature)
Instead of relying on the WireGuard AllowedIPs parameter to handle the routing, use the router’s built-in VPN Client settings to control which traffic goes where.

  1. On your Client Router (192.168.0.1), go to Advanced > VPN Client.
  2. Do not assign your devices to the WireGuard profile in the general "VPN Access" list (leave them off so they keep regular internet access).
  3. Look for Policy Routing (or Advanced Routing/Static Routes depending on the exact firmware sub-menu layout).
  4. Add a Static Route:
    • Destination Network: 192.168.1.0
    • Subnet Mask: 255.255.255.0
    • Gateway/Interface: Select your WireGuard VPN Interface instead of the WAN port.

This allows your local devices to keep their standard internet gateway for 0.0.0.0/0 traffic, while manually pushing 192.168.1.0/24 traffic through the WireGuard tunnel.
Fix 2: Flip the Server/Client Roles
If the Server router (192.168.1.1) has better configuration options, or if you can configure its Client Access type, changing how the handshake initiates might help.
On TP-Link WireGuard Server configurations, there is a setting called Client Access. If it is set to "Internet and Home Network", it explicitly tells connected peers to route everything through it. If you have administrative control over the Server router, ensure the profile generated for the Client router is restricted to "Home Network Only".
Fix 3: Handle the Routing at the OS Level (If possible)
If the primary devices needing access to the remote site are PCs or servers:

  1. Turn off the VPN Client feature on the Archer router entirely.
  2. Install the standalone WireGuard application directly onto those specific computers.
  3. Import the configuration file into the OS app. The official WireGuard software handles AllowedIPs flawlessly and will correctly split-tunnel the traffic.

 

1
1
#2
Re:BE3600 Wireguard Client ignores AllowedIPs
Yesterday

Hello @Deelon ,

Thanks for contacting our community.

 

If you require bidirectional network access, TP-Link's "Home" series products may not meet your needs, as they do not support site-to-site (also known as LAN-to-LAN) connections.

However, some of our business products support this feature; you can visit How to configure Site-to-Site WireGuard VPN on Omada Controller for more information.

Alternatively, you can consult our Business Community.

 

Best Regards.

Welcome to Our Community! Get the latest posts: △New Firmware for Archer GE550/GE650 V1 Introduces AI-QoS, EasyMesh IoT Expansion, and More! △New Firmware Releases for Archer BE805 V1/BE450 V1 to Support VPN Merge, New ECO Mode, and More! More posts, please see: △ Get the Ongoing Pre-release Firmware for Wi-Fi Routers Here— Subscribe for Updates! Urgent problems with your Wi-Fi Router, Range Extender, or DSL Modem? Please reach out via private Messages or @Joesph-TP in your new thread directly. Click Or ☆Recommended Solution if the post/answer helps.
0
0
#3