Hi,
I have a question, I am not sure about the exact terminology, but I will try to explain as best.
I use multiwan on Openwrt, this seems to work well. I am using various VPN with wireguard protocol. Why various, because some are for P2P, some location related and some point-to-site to access cloud infrastructure. Basically, I do not want any of my traffic going through wwan without using one VPN.
The issue
I want all my wireguard client to connect directly to my wwan. It seems that some VPN are connecting through other VPN, like so :
VPN_P2S -> VPN_P2P -> wwan
Which would not make any sense. So basically, I think it is the right way to formulate, how can I force my VPN connection to use my wwan gateway?
NB: my wwan gateway might change of address depending on which Wifi I will connect
Bonus question: Is there a way to automatically change metric or weight of a connection based on its latency? (for example if I want to route IPV4 through the best VPN at the moment. I did configure a check link quality that manage to disable bad connection but it does not mean it will use the absolute best one)
You probably have a default route via one of the WG interfaces .
When a WG interface is setting up it automatically routes its endpoint via the existing default route depending on the order on which the interfaces are setup you might run a tunnel in a tunnel.
What you can try is instead of using 0.0.0.0/0 for Allowed IPs use 0.0.0.0/1 and 128.0.0.0/1 this will preserve the default route but still routes everything via the tunnel (if route Allowed IPs is enabled).
Otherwise you can disable the host route and manually make a route for the endpoint via the wwan (No Host routes on the interface > General Settings)
Before coming back here I found a solution that seems to work but needs a little bit of setup as I have to config all interface individually :
Add a rule in Multiwan with an only wwan policy with destination address set as the endpoint host of my VPNs.
It does work but I need to do that for every VPN.
I am going to try your method that to me seems better as I do not have to worry about each VPN individually.
About your bonus question, I do not have a ready made script but you might be able either to use a hotplug event or even a cron job running to get latencies and then use uci to set metrics
Some inspiration:
This script uses uci to toggle WireGuard tunnels on and off:
After some time I can see it actually did not work, sometimes you make a change and the odds are against you thinking you resolve the problem.
However, setting ip an IPV4 rule asking the incomming interfaces VPNx to go through outcomming interfaces wwan seems to do the trick.
Do you think it is a fluke or could it really be the solution?
Thanks for your precious help!
