Routing & IP forwarding

ShadowVPN brings the TUN interface up (address, netmask, peer, MTU) but deliberately does not touch the system routing table or sysctl. Doing so silently is dangerous and platform-specific. The steps below are what you run outside the process. The binaries also print these hints at startup.

Prefer a split tunnel?

If you only want some destinations tunneled, skip the manual routes below and use the client's built-in policy routing — it programs per-destination routes automatically and removes them on exit.

Server: enable IP forwarding + NAT

So that tunneled clients can reach the wider network through the server, the server host must forward packets and NAT (masquerade) them out its WAN interface. Replace <wan-if> with the server's real outbound interface (e.g. eth0).

Linux:

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -o <wan-if> -j MASQUERADE

macOS:

sudo sysctl -w net.inet.ip.forwarding=1
# Configure pf NAT, e.g. add to /etc/pf.conf:
#   nat on <wan-if> from 10.9.0.0/24 to any -> (<wan-if>)
# then: sudo pfctl -f /etc/pf.conf -e

Client: route traffic through the tunnel (full tunnel)

The client must keep a host route to the server's IP via the real gateway (otherwise the encrypted UDP would loop back into the tunnel), then route the desired destinations via the tunnel peer. The two /1 routes below override the default route without deleting it.

Linux:

# Keep the server reachable over your real link (replace GW/DEV):
sudo ip route add <SERVER_IP>/32 via <YOUR_DEFAULT_GW> dev <YOUR_WAN_DEV>
# Route everything through the tunnel peer:
sudo ip route add 0.0.0.0/1 via 10.9.0.1
sudo ip route add 128.0.0.0/1 via 10.9.0.1

macOS:

# Keep the server reachable over your real link (replace GW):
sudo route -n add -host <SERVER_IP> <YOUR_DEFAULT_GW>
# Route everything through the tunnel peer:
sudo route -n add -net 0.0.0.0/1 10.9.0.1
sudo route -n add -net 128.0.0.0/1 10.9.0.1

Windows (elevated prompt):

:: Keep the server reachable over your real link (replace GW):
route add <SERVER_IP> mask 255.255.255.255 <YOUR_DEFAULT_GW>
:: Route everything through the tunnel peer:
route add 0.0.0.0 mask 128.0.0.0 10.9.0.1
route add 128.0.0.0 mask 128.0.0.0 10.9.0.1

To stop using the tunnel, delete the routes you added. If the server is given as a hostname rather than a literal IP, resolve it first and add the host route for that resolved IP.

MTU

The TUN MTU defaults to 1400, leaving headroom for the salt + AEAD tag + UDP

• IP overhead on the outer datagram. If you enable base64 obfuscation (~33% payload growth on the wire), size the mtu down to compensate — see carrier obfuscation.