TunnlTo is a tool for controlling which Windows applications, processes, and IP addresses can use a WireGuard VPN tunnel. Here are some examples of how it could be used:
- Route only FireFox through a privacy VPN - Route Slack and Microsoft Office through a work VPN - Route a game through a gaming VPN - Stop a game from routing through a privacy VPN - Stop a browser from routing through a work VPN - Route a specific IP address range through a privacy VPN - Route all traffic through a privacy VPN except a specific IP address range
I have been collaborating on this project with the creator of WireSock - Vadim Smirnov.
"WireSock VPN Client is a lightweight command line WireGuard VPN client for Windows that has advanced features not available in the official WireGuard for Windows such as selective application tunneling and disallowed IP addresses.
WireSock VPN Client combines the power of Windows Packet Filter and BoringTun (user space WireGuard implementation in Rust) to provide exceptional performance, security and scalability."
The TunnlTo app is built with Tauri and I've used boring old HTML, CSS (bootstrap) and JavaScript as I had major JS framework fatigue. I have previously built a production app with Electron and Vue. Tauri appealed to me for its use of Rust and its small installation sizes. I tried Tauri pre version 1.0 and had a bit of trouble but this time around its been a positive experience. The docs and the Discord community have come a long way.
I would appreciate any feedback about the project so I can get an idea of what direction to take it in next. Vadim will be around a little later if anyone is curious about the WireGuard implementation and wants to know more.
Thanks for reading!
Well it's not finished yet :)
The reasons for choosing Tauri:
- With new projects I try to learn something new but not everything all at once. This helps to not get overwhelmed and ship something in a reasonable timeframe.
- I'm comfortable with HTML, CS, JS and I wanted to learn Rust which Tauri uses.
- I figured the UI is going to change a lot in the early days and I wanted to be able to iterate on it quickly, so choosing something I know already for the UI made sense to me.
- If the project gets bigger, I can move to a JS framework easily enough and will have access to all the ecosystem it provides.
- I thought it would be easier to attract contributors with a web framework UI and Rust.
- While I want it to be as lightweight as possible, it is not going to be run on low spec machines so I feel like the tech stack is fit for purpose.
Additionally, I think that your project might be useful to people and the only reason it exists is because you invested your own time on it so if using tauri was something that motivated you or gave you any type of satisfaction then I'm happy for you.
Thank you!
I would actually say it's pretty dangerous to have something installing .msi from git, touching registry etc ...
https://github.com/TunnlTo/desktop-app/blob/main/src-tauri/s...
https://github.com/TunnlTo/desktop-app/tree/main/src-tauri/w...
You're free to run WireSock in the terminal. It's linked to in this post and in the github repo. TunnlTo aims to make WireSock more accessible and to add some quality of life features. I'm collaborating with the WireSock creator and while it may seem simple at the moment it is early days... we had to start somewhere.
> I would actually say it's pretty dangerous to have something installing .msi from git, touching registry etc ...
Did you look at this code?: https://github.com/TunnlTo/desktop-app/blob/main/dist/setup....
It tells the user why it needs to install the msi, explains what it is, and gives them the option to proceed. The msi is signed by the same EV code signing certificate as the TunnlTo app. There is also information about WireSock and links in the GitHub readme.
> installing .msi from git
The .msi doesn't come from "git", it is included in the TunnlTo installer which is standard practice.
> touching registry etc ...
I'm not sure why there would be a concern if a msi interacts with the registry? That is pretty standard stuff.
Another trick: if you are using Firefox with Multi-account container tabs, you can use a Wireguard client that exposes a SOCKS5 interface (like Wireproxy) and use setup your tabs to use different Wireguard connections. You could even use this in addition to split tunnelling.
That is a cool trick. Can you actually define which Firefox tabs use the proxy? Does it highlight the tab in some way to show you which connection you're on?
So why couldn't you just have a different range for another subnet? Is it just because tail scale made everything needlessly complex? Or is it a base wireguard problem?
For example I would like *.work.example.com goes through the DNS in work VPN.
Typing on phone, so please excuse the slightly abrupt tone.
I agree, it needs better visibility of what is happening with the active connection. Its easy enough to use icanhazip etc. in a browser to see the active IP but that's not possible in apps like a torrent downloader or game. Someone suggested a feature to monitor data input/output in the repo discussion area so I'll tag onto that with your suggestions.
Do you have/plan this kind of feature? I mean Wireguard Client will check the Public IP of the Wireguard Server from time to time?
Is it bullet-proof enough for a killswitch or would the apps go through the normal route if I forgot to open your application, or if the vpn server is down?
TunnlTo uses WireSock https://www.wiresock.net/ which is a custom network driver built by Vadim Smirnov. He'll be on later to answer any technical questions. He is the expert in networking and kernel level drivers.
I wouldn't call it bullet-proof enough for a killswitch yet but certainly is something we're working towards. The response so far from HN is encouraging so it looks like it will be worthwhile dedicating more time to the project to get it to that level.
Not trying to be a jerk, just that I’d be more inclined to try out a purely usermode application than install a driver.