Firewall + VPN: How to pass all traffic through VPN, except for Zoom/video calls

I use NordVPN (WireGuard) and direct all my zoom and teams calls for extensive business use through that on an LTE connection and it works perfectly well. I have about two or three such calls per week.

Have you set up sqm properly? A challenge with sqm in the context of VPN is dealing with mixture of encrypted and unencrypted flows. I spent many hours on this and ended up writing my own script to set up sqm (rather than use the default sqm tool in OpenWrt):

It's very simple. In short what this does is this:

For download it checks to see if there is a WireGuard peer. If there is then it sets up a single ifb interface incorporating mixture of a) unencrypted data on wan (it passes over the encrypted data on wan) and b) unencrypted data on VPN interface. If no interface it just takes all traffic from wan.

For upload it relies on cake's ability to work with flow has preservation enabling cake to see differentiate encrypted flows on upload.

Thus we end up with a single interface despite VPN pbr on which to apply cake and keep latency nice and low.

See e.g. this thread:

The solution on that is an alternative but shows how I grappled with this issue.

You should also switch to WireGuard because it's faster and can be set up with NordVPN by extracting credentials using Linux client on Virtual machine having connected with their nordlynx service.

See here:

Perhaps OpenVPN is overwriting the DHCP config all the time. So I'd suggest ditching OpenVPN and switching to WireGuard anyway and seeing how that goes since ultimately unless some reason is holding you to OpenVPN WireGuard is technically superior anyway.

1 Like