Add route for Wireguard connection over OpenVPN

I need to setup two different VPN services one on top of the other.
So here is how it should be:

Now I can easily achieve this by adding the two vpn interfaces and the editing the routes with a bash script:

ip route del <wireguard_server> dev eth0.2
ip route add <wireguard_server> dev openvpn
ip route del dev openvpn_if
ip route add dev wireguard_if

So the script delete the route that gets created automatically when openwrt tries to bring up the wireguard interface and change it to make the connection happen through OpenVPN. Then change the default route to Wireguard.
This actually works but I would like to understand how to do it via Luci or al least via /etc/config/network


This is a bit complicated and doesn't roll back when a vpn goes down.. Better use pbr package.

1 Like

Why? Seems overly complicated to run a VPN inside a VPN.

cat << EOF >> /etc/openvpn/client.conf
pull-filter ignore redirect-gateway
route ${WG_SERV} vpn_gateway

Also add a static route to the OVPN_SERV via ISP_GW:
And configure the default route via the WG interface.

Thanks for the suggestion, I installed the package and I'm trying with it. The Netflix exclusion script is also a very nice addition.

Currently, I'm having some issues, here's how I have configured the policies:

Name_Remote addresses_Interface
Tunnel_<openvpn gateway>_WAN
WG Gateway_<wg gateway>_TUNNEL

And then enabled the script:

But then I'm unable to reach the internet

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export vpn-policy-routing; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \

ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*

Should I do it without the routes set by my script or with it? And when policy based routing is enabled, right?

Without anything extra from you, just the vpn-pbr running.