Add RouteLan and AllowLan configuration options for private network routing

[NNdroid]

Currently, there is no fine-grained control over how private network addresses are handled in the VPN configuration. This proposal suggests adding two new configuration options to provide more flexibility in routing private network traffic.

Proposed Solution

I suggest adding the following two configuration options:

1. RouteLan

• Purpose: Indicates whether to route private network addresses to the VPN gateway
• Effect: When enabled, private network traffic (e.g., RFC 1918 addresses) is tunneled through the VPN connection
• When to use: For scenarios where users want to access local network resources through the VPN gateway

2. AllowLan

• Purpose: Indicates whether clients are allowed to route packets containing private network addresses
• Effect: When enabled, clients can send and receive packets with private network addresses; when disabled, such packets are dropped or rejected
• When to use: For controlling client permissions and preventing unintended local network access

Use Cases

• Network Isolation: Administrators can prevent users from accessing local network resources outside the VPN policy
• Split Tunneling: Users can route only specific traffic types (public vs. private addresses) through the VPN
• Security Control: Enhanced control over which network ranges are accessible through VPN clients
• Hybrid Network Setup: Better support for hybrid environments where some resources should be accessed locally and others through VPN

Expected Behavior

Config	RouteLan	AllowLan	Behavior
A	Enabled	Enabled	Private network traffic is routed through VPN gateway; clients can access it
B	Enabled	Disabled	Private network traffic is routed through VPN gateway; clients cannot send private network packets
C	Disabled	Enabled	Private network traffic bypasses VPN; clients can access local network directly
D	Disabled	Disabled	Private network traffic is blocked or bypassed; no client access to private addresses

[NNdroid]

I've noticed an issue: I'm running AWL on a Linux device and directing the 10.66.0.0/24 route to that device, but devices on the local network are unable to access the 10.66.0.0/24 network segment. I've enabled IP forwarding and masquerade.

[sheckandar]

I've noticed an issue: I'm running AWL on a Linux device and directing the 10.66.0.0/24 route to that device, but devices on the local network are unable to access the 10.66.0.0/24 network segment. I've enabled IP forwarding and masquerade.

Did you remove the DROP rules from iptables AWL-FORWARD chain for the subnet you want to access ?

[NNdroid]

I've noticed an issue: I'm running AWL on a Linux device and directing the 10.66.0.0/24 route to that device, but devices on the local network are unable to access the 10.66.0.0/24 network segment. I've enabled IP forwarding and masquerade.

Did you remove the DROP rules from iptables AWL-FORWARD chain for the subnet you want to access ?

thank you.It's worked fine.

[pymq]

Hi, I like this idea!

Yes, currently LAN (or any other private network) is unavailable from VPN Gateway as the sensible default for every platform. (documented in the README or in the code)

I agree that this should be configurable.

Should we have both these settings per device? For example, the server should enable AllowLAN for each device separately.

How would you describe the user flow in terms of UI/UX?

[pymq]

By the way, this should work in the same way for SOCKS5 proxy (but currently it's not, LAN is available through the proxy)