When you connect your phone to WireGuard, you must decide what traffic goes through the tunnel. Do you want everything routed to your house, or just the traffic meant for your server?
Overview
The setting that controls this is called Allowed IPs, found inside the WireGuard app on your phone or laptop. Changing this one string of numbers drastically alters how the VPN behaves.
Full Tunneling (The Default)
By default, the Allowed IPs field is set to 0.0.0.0/0, ::/0.
In networking terms, 0.0.0.0/0 means "literally every IP address on the internet".
How it works: If you open YouTube, the request goes through the encrypted tunnel to your LocalNode, out your home router to YouTube, back to your home router, and through the tunnel back to your phone.
Pros: Maximum security. If you are on sketchy public Wi-Fi, 100% of your data is encrypted. You can also utilize AdGuard Home to block ads on cellular data.
Cons: Your internet speed is bottlenecked by your home internet's upload speed. If your home internet goes down, your phone loses all internet access entirely.
Split Tunneling (Advanced)
Split tunneling tells the phone: "Only send traffic through the tunnel if I am trying to talk to the LocalNode. If I am talking to YouTube, just use the standard cellular connection."
How it works: You change the Allowed IPs field to specifically match your home network subnet, such as 192.168.1.0/24, 10.13.13.0/24.
Pros: Zero performance hit. You get lightning-fast 5G speeds for normal web browsing, but you can still type 192.168.1.50:8096 to stream from Jellyfin instantly. You can leave the VPN running 24/7 without noticing it.
Cons: You lose the security benefits on public Wi-Fi. You also cannot use AdGuard Home to block ads on cellular data, because your DNS queries will bypass the tunnel.
💡 Tip: If you use Split Tunneling, ensure you include the WireGuard tunnel subnet (usually 10.13.13.0/24 or 10.8.0.0/24) in addition to your home LAN subnet, otherwise the connection will fail.
How to configure Split Tunneling
Open the WireGuard app on your phone.
Tap your connection profile and tap Edit.
Find the Allowed IPs field.
Delete 0.0.0.0/0.
Enter your home network's subnet range. (e.g., If your LocalNode is 192.168.1.50, your subnet is likely 192.168.1.0/24).
Enter the VPN subnet range (found in the "Addresses" field at the top, usually 10.13.13.0/24).
The final field should look like this: 192.168.1.0/24, 10.13.13.0/24
Tap Save.
WireGuard logo from wireguard.com; refer to project repositories for component licenses. Official clients vary by OS—follow those docs for tunnel keys and DNS fields.
