Using both Twingate and Wireguard on a Windows PC

Twingate is a fantastic alternative to traditional VPNs like WireGuard because it offers superior security with Zero Trust principles and is incredibly easy to deploy, ensuring seamless and secure access to your resources without the hassle of complex configurations.

However, in order to use Twingate only you must own the infrastructure behind it (I’m talking about Twingate connectors here).
What if one of your customers is using Wireguard to access the company’s cloud-based servers and databases?

You can’t use both solutions at the same time: if your Twingate client is active and you try to open a Wireguard tunnel connection your Windows PC will freak out. Most likely, you are going to completely lose your Internet connection.

So how can you use both? Is it even possible? Yes, it is!

There is a secret feature in Wireguard, it allows Windows clients to execute commands before or right after establishing a Wireguard connection or closing one.

You could even spice up your script a little bit more, by using WIREGUARD_TUNNEL_NAME variable to conditionally execute or not execute certain statements, based on which Wireguard connection is being established.

The only caveat is that these commands will be executed under SYSTEM user, which is a big deal, because it might make you an easy target for malware.
But we know what we are up to, don't we?

You can activate this PreUp-PostDown magic by running enabling it via registry

reg add HKLM\Software\WireGuard /v LimitedOperatorUI /t REG_DWORD /d 1 /f

Then you can start adding the PreUp, PostUp, PreDown, and PostDown options to your tunnel configurations.

I will add

PreUp = net stop Twingate.Service
PostDown = net start Twingate.Service

to the [Interface] section in all my tunnel configs.

Now, every time I activate Wireguard it stops Twingate and re-starts the service, when I close my Wireguard connection. It’s super convenient!

You are welcome! 😊 Subscribe for more valuable tech tips and insights!