<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/connect-to-a-vpn-in-a-vm-using-wireguard-5pkkcdcan" -->

---
title: Connect to a VPN-in-a-VM Using WireGuard | daily.dev
description: This guide sets up a split-tunnel VPN by running the VPN client inside a Linux VM and connecting to it from macOS over WireGuard. Only traffic matching...
canonical: https://daily.dev/posts/connect-to-a-vpn-in-a-vm-using-wireguard-5pkkcdcan
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Connect to a VPN-in-a-VM Using WireGuard | daily.dev
og:description: This guide sets up a split-tunnel VPN by running the VPN client inside a Linux VM and connecting to it from macOS over WireGuard. Only traffic matching...
og:url: https://daily.dev/posts/connect-to-a-vpn-in-a-vm-using-wireguard-5pkkcdcan
og:image: https://api.daily.dev/og/posts/5pKKCDCaN.png
og:image:alt: Connect to a VPN-in-a-VM Using WireGuard
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to a VPN-in-a-VM Using WireGuard

**[Atomic Spin](https://daily.dev/sources/atomicobject)** · 11 min read · 1 upvotes · 0 comments

## Summary

This guide sets up a split-tunnel VPN by running the VPN client inside a Linux VM and connecting to it from macOS over WireGuard. Only traffic matching specified IP ranges gets routed through the VPN, while everything else, like Zoom, stays local. The setup uses iptables in the VM to forward WireGuard traffic to the VPN interface, and macOS's /etc/resolver to resolve internal domain names through protected nameservers. It uses Ubuntu 26.04 as the VM's OS and a private subnet like 10.253.0.0/24 for the WireGuard tunnel. The author calls the approach not beginner-friendly but doable with help from an LLM.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://spin.atomicobject.com/wireguard-vpn-in-vm>

## Questions this post answers

### How do I set up a split-tunnel VPN so only certain traffic goes through the VPN on macOS?

Run the VPN client inside a Linux VM, then connect to it from macOS using WireGuard, specifying only the IP ranges you want tunneled in the WireGuard AllowedIPs setting. iptables in the VM forwards WireGuard traffic to the VPN interface with a masquerade rule, and macOS's /etc/resolver handles DNS for protected domains by pointing to internal nameservers reachable through the tunnel.

_Developers wiring up selective VPN routing compare networking approaches like this one on daily.dev._

### Why can't I connect the macOS WireGuard app to a VM running locally on the same Mac?

The WireGuard macOS desktop app uses a Network Extension-based tunnel that fails to connect to a VM running locally on the same machine. The workaround is using the command-line wg-quick implementation instead, installed via 'brew install wireguard-tools bash', which doesn't have this connection problem.

_Developers debugging local WireGuard tunneling quirks can track fixes like this on daily.dev._

### How do I use macOS's /etc/resolver to resolve internal domain names behind a VPN?

Create a file named after the domain under /etc/resolver, such as /etc/resolver/my-company.com, and list the internal (behind-VPN) nameserver IP addresses inside it, for example 10.8.51.16 and 10.8.51.17. Requests for hosts under that domain then get routed to those nameservers through the VPN tunnel, and those IPs must also be covered by the WireGuard AllowedIPs ranges.

_Developers configuring per-domain DNS resolution refer to setups like this on daily.dev when tunneling internal traffic._

## Similar posts on daily.dev

- [How To Set Up WireGuard on Ubuntu](https://daily.dev/posts/how-to-set-up-wireguard-on-ubuntu-iepekkjry) · DigitalOcean Community · 1 upvotes · 0 comments
- [Understanding iptables with WireGuard](https://daily.dev/posts/understanding-iptables-with-wireguard-knp6q0ypy) · Atomic Spin · 0 upvotes · 0 comments
- [FreeBSD: Home NAS, part 3 – WireGuard VPN, Linux peer, and routing](https://daily.dev/posts/freebsd-home-nas-part-3-wireguard-vpn-linux-peer-and-routing-dzfylv9fr) · Hacker News · 1 upvotes · 0 comments
- [Self-Hosting Behind CGNAT](https://daily.dev/posts/self-hosting-behind-cgnat-lrdls1bcr) · Lobsters · 1 upvotes · 0 comments
- [I bypassed CGNAT for free using Oracle's forever-free cloud tier, and it fixed the one thing Tailscale couldn't](https://daily.dev/posts/i-bypassed-cgnat-for-free-using-oracle-s-forever-free-cloud-tier-and-it-fixed-the-one-thing-tailsca-obog4ugtd) · XDA Developers · 0 upvotes · 0 comments

---

Tags: [#infrastructure](https://daily.dev/tags/infrastructure), [#networking](https://daily.dev/tags/networking), [#mac](https://daily.dev/tags/mac), [#vpn](https://daily.dev/tags/vpn)

[View this post on daily.dev](https://daily.dev/posts/connect-to-a-vpn-in-a-vm-using-wireguard-5pkkcdcan)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Connect to a VPN-in-a-VM Using WireGuard","url":"https://daily.dev/posts/connect-to-a-vpn-in-a-vm-using-wireguard-5pkkcdcan","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/connect-to-a-vpn-in-a-vm-using-wireguard-5pkkcdcan"},"datePublished":"2026-10-27T12:04:42.704Z","dateModified":"2026-10-27T12:05:11.478Z","description":"This guide sets up a split-tunnel VPN by running the VPN client inside a Linux VM and connecting to it from macOS over WireGuard. Only traffic matching...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d3b1851be3ddb7f58d6b84fe03ec388?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d3b1851be3ddb7f58d6b84fe03ec388?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Atomic Spin","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Atomic Spin","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e2af5ce3adaa403a8cf029268b62419f","url":"https://daily.dev/sources/atomicobject"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/connect-to-a-vpn-in-a-vm-using-wireguard-5pkkcdcan","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"infrastructure,networking,mac,vpn","timeRequired":"PT11M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Atomic Spin","item":"https://daily.dev/sources/atomicobject"},{"@type":"ListItem","position":3,"name":"Connect to a VPN-in-a-VM Using WireGuard"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/connect-to-a-vpn-in-a-vm-using-wireguard-5pkkcdcan#faq","mainEntity":[{"@type":"Question","name":"How do I set up a split-tunnel VPN so only certain traffic goes through the VPN on macOS?","acceptedAnswer":{"@type":"Answer","text":"Run the VPN client inside a Linux VM, then connect to it from macOS using WireGuard, specifying only the IP ranges you want tunneled in the WireGuard AllowedIPs setting. iptables in the VM forwards WireGuard traffic to the VPN interface with a masquerade rule, and macOS's /etc/resolver handles DNS for protected domains by pointing to internal nameservers reachable through the tunnel. Developers wiring up selective VPN routing compare networking approaches like this one on daily.dev."}},{"@type":"Question","name":"Why can't I connect the macOS WireGuard app to a VM running locally on the same Mac?","acceptedAnswer":{"@type":"Answer","text":"The WireGuard macOS desktop app uses a Network Extension-based tunnel that fails to connect to a VM running locally on the same machine. The workaround is using the command-line wg-quick implementation instead, installed via 'brew install wireguard-tools bash', which doesn't have this connection problem. Developers debugging local WireGuard tunneling quirks can track fixes like this on daily.dev."}},{"@type":"Question","name":"How do I use macOS's /etc/resolver to resolve internal domain names behind a VPN?","acceptedAnswer":{"@type":"Answer","text":"Create a file named after the domain under /etc/resolver, such as /etc/resolver/my-company.com, and list the internal (behind-VPN) nameserver IP addresses inside it, for example 10.8.51.16 and 10.8.51.17. Requests for hosts under that domain then get routed to those nameservers through the VPN tunnel, and those IPs must also be covered by the WireGuard AllowedIPs ranges. Developers configuring per-domain DNS resolution refer to setups like this on daily.dev when tunneling internal traffic."}}]}
```