diff --git a/Dockers/pia-wireguard/entrypoint.sh b/Dockers/pia-wireguard/entrypoint.sh
index f0a4fd3..9db8e3c 100644
--- a/Dockers/pia-wireguard/entrypoint.sh
+++ b/Dockers/pia-wireguard/entrypoint.sh
@@ -14,6 +14,7 @@ PIA_DNS_PRE_VPN="${PIA_DNS_PRE_VPN:-1.1.1.1}"
 PIA_HEALTH_URL="${PIA_HEALTH_URL:-https://api64.ipify.org}"
 PIA_HANDSHAKE_MAX_AGE_SECONDS="${PIA_HANDSHAKE_MAX_AGE_SECONDS:-180}"
 PIA_RECONNECT_BACKOFF_SECONDS="${PIA_RECONNECT_BACKOFF_SECONDS:-5}"
+PIA_LOCAL_NETS="${PIA_LOCAL_NETS:-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"
 
 CA_CERT_PATH="/opt/pia/ca.rsa.4096.crt"
 
@@ -114,6 +115,15 @@ wg_up_manual() {
   # Ensure endpoint traffic keeps going out via the original gateway.
   ip -4 route replace "${endpoint_ip}/32" via "$orig_default_gw" dev "$orig_default_dev"
 
+  # Ensure local (LAN/RFC1918) traffic stays reachable outside the VPN.
+  # This is needed so published ports remain accessible from your LAN.
+  IFS=',' read -ra _nets <<<"$PIA_LOCAL_NETS"
+  for _net in "${_nets[@]}"; do
+    _net="$(echo "$_net" | xargs)"
+    [[ -z "$_net" ]] && continue
+    ip -4 route replace "$_net" via "$orig_default_gw" dev "$orig_default_dev" || true
+  done
+
   # Route all egress through the tunnel (main table; avoids wg-quick sysctl/policy routing).
   ip -4 route replace default dev "$iface"
 }