Multiple WireGuard connections with Mwan3 Configuration

[digitalberg]

Hi All,

I'm new to OpenWrt, previously using Pfsense. However, due to the performance of the OpenWrt with WireGuard, I'm planning to configure two or three VPN WireGuard connections with Mwan3 on openWrt.

Not for the load balancing but two separate VPN connections for two separate dedicated LANs network OpenWrt

Would it be possible to share WireGuard (Mullvad or any provider) and Mwan3 settings/configurations?

Currently installed: OpenWrt 21 (latest version), Mwan3, dnsmsg-full and WireGuard.

Regards,
Qrsh

[jamesmacwhite]

If you don't need load balancing or failover, you may want to look at the VPN Policy Routing package to achieve what you want, rather than mwan3. To achieve what you want generally, it's policy based routing, which both packages can do.

VPN Policy-Based Routing + Web UI -- Discussion

VPN Policy-Based Routing is a service supporting multiple types of VPN Connections (Openconnect, OpenVPN, PPTP and Wireguard) allowing you to create policies to use either VPN tunnel or WAN as a gateway. More information (requirements, full features list, etc.) on the service is available in the README. Gateways/Tunnels Any policy can target either WAN or a VPN tunnel interface. L2TP tunnels supported (with protocol names l2tp*). Openconnect tunnels supported (with protocol names openconne…

mwan3 is however primarily designed for multiple independent WAN links and being able to configure load balancing or failover policies. VPN policy routing is primarily designed to allow you to route traffic to either VPN or WAN, depending on certain criteria such as IP, domain name, subnet (which is probably the best method for your VLAN case) and might be overall simpler for your use case. mwan3 can achieve what you want too, but the configuration required is probably more overkill for your requirements.

Mullvad does have it's own guide for configuring a Wireguard client: https://mullvad.net/en/help/running-wireguard-router/

Each Wireguard interface should be uniquely named so "wireguard" "wireguardb" etc. VPN policy routing will automatically pick up interfaces named as wireguard*.

Note: Mullvad IPv6 uses NAT6, you will also have to deploy to NAT6 to have working IPv6 policies as well.

If you are configuring multiple Wireguard clients through Mullvad, make sure to select servers in a different region and if possible using a different provider across each chosen endpoint in the event of any issues for redundancy.

Mullvad's server page will allow you to find all the available Wireguard endpoints under a region and their provider details.

https://mullvad.net/en/servers/

[digitalberg]

Thank you very much @jamesmacwhite

As per your instructions, I have managed to set up multi WireGuard connections with VPN-Policy routing and, while on the multi-vpn concurrent, able to hit 950 Mbps symmetrically to the UK nodes.

[jamesmacwhite]

Awesome. Glad to help! Feel free to give @stangri a mention for his work on the VPN Policy Routing package if you'd like on the linked thread in my original reply. His package makes policy based routing simple on OpenWrt for users and is very popular!