WireGuard per session

WireGuard per session

This page explains how Cablebag runs WireGuard inside the app for the sessions you choose, how to add a network from a session or folder, and what does and does not go through it.

The problem it solves

Most VPN clients connect the whole PC. When you work for more than one customer, two networks that both use 10.0.0.0/24 cannot be connected at the same time, so you switch one VPN off and the other on all day, and a tab you left open for customer A quietly starts talking to customer B's address.

Cablebag runs WireGuard itself, inside the app (in user space: boringtun with a small TCP/IP stack), and only for the sessions, folders or Proxmox servers that choose a WireGuard network. Each network is its own small network inside Cablebag. Two VPNs whose machines have exactly the same addresses can be open side by side, in two tabs, at the same time.

Nothing changes in Windows: no WireGuard adapter, no routes, no admin rights. The WireGuard app can stay installed.

Adding a network where you use it

Open a session's editor (or a folder's Folder settings) and look at Network. It offers Directly from this PC (the default) and every WireGuard network you have. Next to it:

• Import .conf: choose the .conf file you use in the WireGuard app. Cablebag reads it, keeps the private key in its encrypted vault, and selects the new network for this session straight away.
• New: fill in a network yourself (see the fields below).
• Edit: change the chosen network.

A folder's network applies to all its sessions and subfolders. A session or subfolder can still pick another network, or Directly from this PC to leave the tunnel. The session editor shows "From the folder: WireGuard network ..." when the choice comes from a folder.

Network is offered for SSH, SFTP, RDP, VNC, Telnet, PowerShell remoting and Browser sessions, and for Proxmox servers (Settings, Proxmox servers).

The fields of a network

The editor (New WireGuard network, or Edit) has:

• Name, for example "Customer A".
• Server (endpoint): vpn.example.com:51820.
• Address of this side in the tunnel: 10.8.0.2/32, the address the server gave you.
• Public key of the server.
• Private key of this side: from the [Interface] part of the .conf, kept in Cablebag's vault. Leave it empty on Edit to keep the key Cablebag has.
• Or the private key from the vault (the item's password): a login from one of your credential sources (usually a Vaultwarden item) whose password is the private key. Show the public key of the key in the vault displays the matching public key; Read the key in the vault again refreshes it after the item changed there.
• DNS servers in the tunnel: optional, see below.
• Keepalive (s) and MTU (1420 when empty).
• Networks behind the server (shown only): the allowed IPs, shown on the Tunnels page for your information. A session that chooses the network sends all of its traffic through it, whatever the address.
• Preshared key (optional).

The same .conf as the WireGuard app, or a key pair of Cablebag's own

You can import the .conf you already use. The server then knows one peer with one key, so use it in Cablebag or in the WireGuard app, not both at the same time: the server talks to one of them only. Cablebag warns when it sees that the WireGuard app has the same tunnel switched on.

To have both at once, give Cablebag a peer of its own:

1. In the network's editor click New key pair next to Private key of this side.
2. Copy the Public key to add as a peer on the server with Copy, and add it on the server as an extra peer, with an address of its own for this side.
3. Fill in that address under Address of this side in the tunnel and click Save (the new key is kept only when you save).

DNS in the tunnel

Without DNS servers in the network, host names are looked up the ordinary way, from this PC. Fill in DNS servers in the tunnel when names only resolve inside the customer's network; Cablebag then asks those servers through the tunnel. If a name cannot be found, the error says so and suggests a DNS server or an IP address.

What goes through it

Everything the session itself does:

• SSH, including the remote files pane, the editor, the assistant's commands, Run on many servers and the SSH key generator's Add to the server, all for a session that chose the network. Jump hosts go through it too.
• SFTP, RDP, VNC and Telnet sessions.
• PowerShell remoting sessions, with limits: use HTTPS (port 5986), because Windows only sends the login over HTTP to servers on its trusted hosts list and the tunnel's local address is not on it; Kerberos cannot work through the tunnel and is refused up front; and the remote prompt reads [127.0.0.1]:, the address PowerShell connected to. Cablebag checks the server's certificate against its real name through the tunnel, and Windows checks who issued it. See PowerShell remoting.
• Browser sessions: the page gets an internal proxy that only that tab uses, so every address, including local ones, goes through the tunnel, and WebRTC cannot show the page this PC's own address. Each WireGuard network keeps its own cookies, which are removed with the network.
• Proxmox servers that chose a network under Settings, Proxmox servers: the API, the machines list, start and stop, snapshots, the console, the node shell, the SSH and RDP sessions Cablebag opens for its machines, and the Proxmox web interface in a Cablebag tab. See Proxmox.

What does not

• Windows itself and every other program on the PC. Cablebag creates no adapter and adds no route. The ports Cablebag opens on this PC for a network (the web proxy of a Browser tab, and the local forwards behind Remote Desktop, VNC, Telnet and PowerShell remoting) let in Cablebag's own programs only: another program that tries them is refused, so nothing else on the PC can slip into the customer's network through an open tab. Programs started from one of Cablebag's own local terminal tabs count as Cablebag's.
• The dots under Which hosts answer: a session that goes through a WireGuard network gets no dot, because checked from this PC the address means something else, possibly a machine on your own network.
• The Network scanner, Port scanner, Open ports on this PC and Wake on LAN tools work on this PC's own network.
• The SSH port forwards on the Tunnels page connect to their SSH server directly from this PC.

The Tunnels page

Open Tunnels under Tools in the sidebar. Under the SSH port forwards, the WireGuard networks section lists every network with its address on this side, the server and the networks behind it. While a network runs you see its open connections, the last handshake and the data sent and received; otherwise it says "Starts when a session needs it". A network without a key shows a "no private key" tag.

• Test starts the tunnel and waits for the server's answer: "The server answered." means the keys and endpoint are right.
• Import .conf and New WireGuard network add networks here as well.
• Edit and Delete. Deleting asks first and says how many sessions or folders use the network; they connect directly again afterwards.

The status line of a network shows a warning when the WireGuard app on this PC has the same tunnel switched on.

Keys, the vault and sync

Private keys and preshared keys live in Cablebag's encrypted vault on this PC (see Credential sources), or come from a login in one of your credential sources. WireGuard networks travel with Sync; their keys do not. On another PC, open the network, give it the key again (or link the same login), and it works there too.

When it does not answer

See Troubleshooting and FAQ for the checklist: endpoint, keys, the peer on the server, and the WireGuard app.