Advanced Usage · Clash documentation

Rule-Based WireGuard

Want only selected traffic to use WireGuard? Disable its default route, then use interface-name, DIRECT, and DOMAIN rules to send requests through wg0. Check AllowedIPs, MTU, and endpoint.

Read the articleBack to documentation home
  • WireGuard
  • interface-name
  • AllowedIPs
  • MTU
  • endpoint
Advanced Usage

Scope of this historical document

This document preserves historical instructions for original Clash / Clash Premium to help interpret older configurations. References to “Premium only”, unsupported features, or platform limits do not describe current Mihomo capabilities. Do not use them to overwrite your current client configuration or run permission-related commands.

For Mihomo, consult current Mihomo configuration documentation. For the graphical interface, installation, and permissions, follow the documentation for your specific client.

Assuming your kernel supports Wireguard and you have enabled it, the Table option prevents wg-quick from overriding the default route.

For example, wg0.conf:

ini
[Interface]
PrivateKey = ...
Address = 172.16.0.1/32
MTU = ...
Table = off
PostUp = ip rule add from 172.16.0.1/32 table 6666

[Peer]
AllowedIPs = 0.0.0.0/0
AllowedIPs = ::/0
PublicKey = ...
Endpoint = ...

Then, in Clash, you need only a DIRECT policy group containing a specified outbound interface:

yaml
proxy-groups:
  - name: Wireguard
    type: select
    interface-name: wg0
    proxies:
      - DIRECT
rules:
  - DOMAIN,google.com,Wireguard

This usually performs better than Clash's userspace Wireguard client. Wireguard is supported in the kernel.

Previous articleExternal ControllerNext articleRule-Based OpenConnect