Advanced Usage · Clash documentation

Rule-Based WireGuard

After disabling WireGuard's default-route capture, use interface-name, DIRECT, and DOMAIN rules to send traffic through wg0, then verify AllowedIPs, MTU, and endpoint.

Read the articleBack to documentation home
  • WireGuard
  • interface-name
  • AllowedIPs
  • MTU
  • endpoint
Advanced Usage

Assuming your kernel supports Wireguard and you have enabled it, the Table option prevents wg-quick from overriding the default route.

For example, wg0.conf:

ini
[Interface]
PrivateKey = ...
Address = 172.16.0.1/32
MTU = ...
Table = off
PostUp = ip rule add from 172.16.0.1/32 table 6666

[Peer]
AllowedIPs = 0.0.0.0/0
AllowedIPs = ::/0
PublicKey = ...
Endpoint = ...

Then, in Clash, you need only a DIRECT policy group containing a specified outbound interface:

yaml
proxy-groups:
  - name: Wireguard
    type: select
    interface-name: wg0
    proxies:
      - DIRECT
rules:
  - DOMAIN,google.com,Wireguard

This usually performs better than Clash's userspace Wireguard client. Wireguard is supported in the kernel.

Previous articleExternal ControllerNext articleRule-Based OpenConnect