A WireGuard client for Windows, built on wireguard-nt, that holds many profiles at once. Each profile is connected or not on its own, and several run in parallel. A profile sends only its listed domains (each name and every subdomain, resolved through that profile's DNS) and its listed IPv4 addresses and networks through its own tunnel. Everything else (the LAN, the internet, RDP into the machine) stays on the normal connection.
- One wireguard-nt adapter per profile,
SplitWire-<name>, with a /32 address and no DNS servers; SplitWire adds its own routes. No kill switch. IPv4 only. - One DNS proxy on
127.0.0.53:53for all profiles, reached through NRPT rules written in the registry. - A Windows service (
SplitWire.exe, also the command line) and a tray icon with a window (SplitWire.Window.exe). - Rust, the standard library and the Windows API through a hand-written ABI: no crates. The official signed
wireguard.dllis vendored and pinned by SHA-256.
Version 0.1.1, in daily use with one profile: import, connect and disconnect from the window and the tray, routing by name through the profile's DNS, NRPT in the registry, the service and its recovery after a crash. Not done yet: live tests of several profiles at once.
Download SplitWire-Setup-<version>.exe from Releases, check it
against SHA256SUMS.txt and run it: it asks for administrator rights once, installs into %ProgramFiles%\SplitWire,
registers and starts the service and starts the tray. Run a newer one to update: the profiles that were connected
connect again, also over a copy installed by hand. Uninstall from Settings, Apps; the profiles and settings stay
unless you choose to delete them (installer).
You need Rust with the x86_64-pc-windows-msvc target, the MSVC linker and the Windows SDK.
powershell -NoProfile -ExecutionPolicy Bypass -File tools\build.ps1The package lands in target\package (building).
| Page | About |
|---|---|
| Architecture | Layers, modules, boundaries |
| Profiles | Names, importing a .conf, colours and order, keys |
| Lists | The list file format, its problems, all lists together |
| Configuration | splitwire.conf, profile.conf, the service-owned files |
| Files | The data folder, atomic writes, its ACL |
| Tunnel | Loading wireguard-nt, the adapter's lifecycle, IP Helper, upstream DNS |
| Engine | Connect and its rollback, Disconnect, start, restore and stop |
| Routing and DNS | Which profile gets a name or an address, the proxy, re-homing |
| Warm-up | The first seconds after Connect or idle: the first handshake, DNS retries, the cache flush |
| NRPT | The registry rules, their sync, Group Policy |
| Alerts | Alert kinds, dismiss and restore, the tray state |
| IPC | The pipe's frames, their binary codec and the messages |
| Service and pipe | The host, the pipe and its DACL, the dispatcher, the SCM |
| Window | The window's pages, its structure, the demo and the page check |
| Tray | The tray icon, its tooltip and menu, one instance, the sign-in start |
| Safety | The invariants the code holds, and who runs live tests |
| Building and running | Package, checks, the command line and the dry run |
| Contributing | Code rules, commit types and scopes |
MIT, see LICENSE. The vendored wireguard.dll is WireGuard LLC's, under its own licence; see
vendor/wireguard-nt/README.md.