Wi-Fi Works Through the Router VPN. Do Wired Ports?

The Wi-Fi laptop shows the VPN's exit address, and the wired desktop in the next room shows the ISP's. Both are plugged into the same router, so the difference is not the VPN configuration. It is which interface, VLAN or policy the traffic actually traversed. Coverage is a per-path property, not a property of the box.

Comparing the two clients side by side finds the difference faster than reading the router's rules.

Two paths into the same router

A router with a VPN client can steer traffic from one bridge, one VLAN or one port list and leave the rest on the WAN. That is a normal design, and it is why a successful wireless test proves only the wireless path. A managed switch can also put a wall port on a different segment than the one the access point uses, without anyone touching the router. Port-based policies are the easiest to miss, because the port looks like part of the same LAN.

Same hardware, different policy. The physical box is not the boundary you think it is.

Compare the gateway each client actually uses

On the wired device, read the active interface, its address and its default gateway. On a machine with both Wi-Fi and Ethernet up, the routing metric decides which one wins, and it is often not the one you expect. Compare that gateway with the one the wireless client used, and check which router network the switch port belongs to. The pfSense WireGuard client recipe shows how a single router can own a tunnel while leaving other interfaces alone.

If the two gateways differ, you have the answer before touching a single firewall rule.

Compare DNS and IPv6 separately

A wired client with a manually configured resolver can bypass the router's DNS policy entirely, even when its traffic is steered correctly. IPv6 is the other half: a tunnel that handles IPv4 only can leave IPv6 traffic on the native path. Test a name lookup and an IPv6 destination from the wired device, not just an IPv4 address check. Use a query only the router's resolver could answer, such as an internal hostname.

Each of those is a separate comparison, and each one can fail on its own.

Compare what happens when the tunnel is down

If the design requires VPN-only access, stop the tunnel and test the wired client with harmless traffic. A wired device that falls back to the normal WAN stays online while missing the intended route, which looks like success to anyone checking only connectivity. The wireless client may behave differently, and that difference is the comparison worth making.

Failure behaviour is part of coverage, not an edge case after it.

Attribute the result to the right layer

A device-level VPN client or a browser proxy on the wired machine can change the measured exit address independently of the router. Record which layers were active during the test, or a successful address change gets credited to the wrong gateway. The same caution applies to a cached result from before the change.

Test fresh traffic, note the layers, and write down the segment and interface. That record is what makes the next comparison meaningful instead of another guess.