Mwan3, access VPN through "unused" line

Knogle · April 11, 2022, 8:15am

Hey friends, how are you doing.
For some time i have been using mwan3 already.
I have got a 1000/50 cable line, as well as 100/40 DSL line.
My current mwan3 ipv4/ipv6 default policy is set to wan_wanb, so whenever WAN fails, which is quite often, it switches to WANB.
Both WAN lines have some DynDNS addresses associated with their public ip addresses.
As i have a lot of VPN traffic from other sites going in (my cameras in my 2nd residence, gitlab etc. with collegues etc.) i'd like to send this traffic through the unused wanb line.
In case of traffic like Minecraft, or HTTP traffic it seems to work, by simply accessing the target through the IP of the WANB interface, instead of WAN. But when i try to connect to Wireguard on my OpenWrt device, traffic is being received on WANB, and is sent out to the client on WAN.
Does someone have an idea in order to solve this issue? So i want everything what goes in through WANB, also to go out on the same interface.
Same for WAN. Is it a good idea to use "balanced" mode using both lines, the 1000/50 and the 100/40 in order to prevent this issue from happening? Unfortunately balanced mode seems to break some services, so i'd like to stay with my wan_wanb policy.
I'm looking forward for some suggestions!
I'd like to have something like that.

Thanks in advance!

trendy · April 11, 2022, 9:43am

Make a rule to match the source port of Wireguard and use wanb_wan policy for that.

Knogle · April 11, 2022, 10:31am

Thanks a lot! That's a great approach.
Unfortunately destination port and source port are the same. So incoming traffic is also redirected.
Have you got any idea on how to match outgoing Wireguard traffic from the OpenWrt device itself?
I wasn't able to match the traffic yet, somehow the Wireguard traffic is originating from the WAN interface, and it's IP address.
I didn't omit the IP addresses and hostnames because there is no sensitive information.
192.168.178.39 is the OpenWrt interface facing the WAN ISP router.

Is it possible to source the Wireguard traffic from an loopback interface in order to match the traffic?

Some incoming traffic on port 51822 redirected from WAN to WANB

trendy · April 11, 2022, 11:10am

What is the output of uci export mwan3; iptables-save -c -t mangle ?

Knogle · April 11, 2022, 11:19am

Sure!
Just another question, not related to it.
Is it possible to balance my 1000/50 and my 100/40 connection? When doing so, i get half the bandwidth of only using the 1000/50, but almost 90mbps upload.

package mwan3

config rule 'bypass_devnet'
	option family 'ipv4'
	option src_ip '172.20.128.0/19'
	option proto 'all'
	option sticky '0'
	option use_policy 'wanb_wan'

config rule 'bypass_dyndns'
	option family 'ipv4'
	option proto 'all'
	option sticky '0'
	option use_policy 'wanb_wan'
	option dest_ip '193.122.6.168'
	option logging '1'

config rule 'default_gst_v4'
	option family 'ipv4'
	option proto 'all'
	option sticky '0'
	option use_policy 'wanb_wan'
	option src_ip '172.20.192.0/19'
	option dest_ip '0.0.0.0/0'

config rule 'default_rule_v4'
	option family 'ipv4'
	option dest_ip '0.0.0.0/0'
	option proto 'all'
	option sticky '0'
	option use_policy 'wan_wanb'

config rule 'default_rule_v6'
	option dest_ip '::/0'
	option family 'ipv6'
	option proto 'all'
	option sticky '0'
	option use_policy 'wan_wanb'

config globals 'globals'
	option mmx_mask '0x3F00'
	option logging '1'
	option loglevel 'notice'

config interface 'wan'
	option enabled '1'
	list track_ip '8.8.4.4'
	list track_ip '8.8.8.8'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option family 'ipv4'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option check_quality '1'
	option failure_latency '1000'
	option failure_loss '40'
	option recovery_latency '500'
	option recovery_loss '10'
	option timeout '4'
	option interval '3'
	option failure_interval '5'
	option recovery_interval '5'
	option up '3'
	option down '3'
	option reliability '1'

config interface 'wan6'
	list track_ip '2001:4860:4860::8844'
	list track_ip '2001:4860:4860::8888'
	list track_ip '2620:0:ccd::2'
	list track_ip '2620:0:ccc::2'
	option family 'ipv6'
	option enabled '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option timeout '4'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option check_quality '1'
	option failure_latency '1000'
	option failure_loss '40'
	option recovery_latency '500'
	option recovery_loss '10'
	option interval '3'
	option up '3'
	option reliability '1'

config interface 'wanb'
	list track_ip '8.8.4.4'
	list track_ip '8.8.8.8'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option family 'ipv4'
	option reliability '1'
	option enabled '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option check_quality '0'
	option timeout '4'
	option interval '10'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'

config interface 'wanb6'
	list track_ip '2001:4860:4860::8844'
	list track_ip '2001:4860:4860::8888'
	list track_ip '2620:0:ccd::2'
	list track_ip '2620:0:ccc::2'
	option family 'ipv6'
	option reliability '1'
	option enabled '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option check_quality '0'
	option timeout '4'
	option interval '10'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'

config member 'wan_m1_w3'
	option interface 'wan'
	option metric '1'
	option weight '3'

config member 'wan_m2_w3'
	option interface 'wan'
	option metric '2'
	option weight '3'

config member 'wanb_m1_w2'
	option interface 'wanb'
	option metric '1'
	option weight '2'

config member 'wanb_m2_w2'
	option interface 'wanb'
	option metric '2'
	option weight '2'

config member 'wan6_m1_w3'
	option interface 'wan6'
	option metric '1'
	option weight '3'

config member 'wan6_m2_w3'
	option interface 'wan6'
	option metric '2'
	option weight '3'

config member 'wanb6_m1_w2'
	option interface 'wanb6'
	option metric '1'
	option weight '2'

config member 'wanb6_m2_w2'
	option interface 'wanb6'
	option metric '2'
	option weight '2'

config policy 'wan_only'
	list use_member 'wan_m1_w3'
	list use_member 'wan6_m1_w3'

config policy 'wanb_only'
	list use_member 'wanb_m1_w2'
	list use_member 'wanb6_m1_w2'

config policy 'balanced'
	list use_member 'wan_m1_w3'
	list use_member 'wanb_m1_w2'
	list use_member 'wan6_m1_w3'
	list use_member 'wanb6_m1_w2'

config policy 'wan_wanb'
	list use_member 'wan_m1_w3'
	list use_member 'wanb_m2_w2'
	list use_member 'wan6_m1_w3'
	list use_member 'wanb6_m2_w2'

config policy 'wanb_wan'
	list use_member 'wan_m2_w3'
	list use_member 'wanb_m1_w2'
	list use_member 'wan6_m2_w3'
	list use_member 'wanb6_m1_w2'

# Generated by iptables-save v1.8.7 on Mon Apr 11 13:18:08 2022
*mangle
:PREROUTING ACCEPT [476489:475309627]
:INPUT ACCEPT [129237:163914819]
:FORWARD ACCEPT [347194:311315598]
:OUTPUT ACCEPT [68302:8317265]
:POSTROUTING ACCEPT [415470:319622413]
:mwan3_connected - [0:0]
:mwan3_hook - [0:0]
:mwan3_iface_in_wan - [0:0]
:mwan3_iface_in_wanb - [0:0]
:mwan3_ifaces_in - [0:0]
:mwan3_policy_balanced - [0:0]
:mwan3_policy_wan_only - [0:0]
:mwan3_policy_wan_wanb - [0:0]
:mwan3_policy_wanb_only - [0:0]
:mwan3_policy_wanb_wan - [0:0]
:mwan3_rules - [0:0]
[477084:475819467] -A PREROUTING -j mwan3_hook
[60:3504] -A FORWARD -o bonding-i0.2100 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[54:3112] -A FORWARD -i bonding-i0.2100 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[2:104] -A FORWARD -o pppoe-wanb -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[7:364] -A FORWARD -i pppoe-wanb -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[68369:8325307] -A OUTPUT -j mwan3_hook
[526500:481588189] -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark 0x3f00/0x3f00
[539553:483615588] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j CONNMARK --restore-mark --nfmask 0x3f00 --ctmask 0x3f00
[6097:836150] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_ifaces_in
[5889:824046] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_connected
[664:414388] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_rules
[545453:484144774] -A mwan3_hook -j CONNMARK --save-mark --nfmask 0x3f00 --ctmask 0x3f00
[527764:482514600] -A mwan3_hook -m mark ! --mark 0x3f00/0x3f00 -j mwan3_connected
[2:80] -A mwan3_iface_in_wan -i bonding-i0.2100 -m set --match-set mwan3_connected src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[160:9857] -A mwan3_iface_in_wan -i bonding-i0.2100 -m mark --mark 0x0/0x3f00 -m comment --comment wan -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_iface_in_wanb -i pppoe-wanb -m set --match-set mwan3_connected src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[46:2167] -A mwan3_iface_in_wanb -i pppoe-wanb -m mark --mark 0x0/0x3f00 -m comment --comment wanb -j MARK --set-xmark 0x300/0x3f00
[5912:689482] -A mwan3_ifaces_in -m mark --mark 0x0/0x3f00 -j mwan3_iface_in_wan
[5702:650670] -A mwan3_ifaces_in -m mark --mark 0x0/0x3f00 -j mwan3_iface_in_wanb
[0:0] -A mwan3_policy_balanced -m mark --mark 0x0/0x3f00 -m statistic --mode random --probability 0.39999999991 -m comment --comment "wanb 2 5" -j MARK --set-xmark 0x300/0x3f00
[0:0] -A mwan3_policy_balanced -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_policy_wan_only -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[132:28118] -A mwan3_policy_wan_wanb -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_policy_wanb_only -m mark --mark 0x0/0x3f00 -m comment --comment "wanb 2 2" -j MARK --set-xmark 0x300/0x3f00
[1:60] -A mwan3_policy_wanb_wan -m mark --mark 0x0/0x3f00 -m comment --comment "wanb 2 2" -j MARK --set-xmark 0x300/0x3f00
[0:0] -A mwan3_rules -s 172.20.128.0/19 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[1:60] -A mwan3_rules -d 193.122.6.168/32 -m mark --mark 0x0/0x3f00 -m comment --comment bypass_dyndns -j LOG --log-prefix "MWAN3(bypass_dyndns)" --log-level 5
[1:60] -A mwan3_rules -d 193.122.6.168/32 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[0:0] -A mwan3_rules -s 172.20.192.0/19 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[132:28118] -A mwan3_rules -m mark --mark 0x0/0x3f00 -j mwan3_policy_wan_wanb
COMMIT
# Completed on Mon Apr 11 13:18:08 2022

trendy · April 11, 2022, 1:53pm

You'd need to open many different connections, like a torrent. You cannot get an aggregate of both connections with one connection only.

I don't see the the rule for matching the wireguard source port though.

Knogle · April 11, 2022, 2:01pm

Ahhh sorry sent you the wrong output. Now i have it.
Do i have to create SNAT rule maybe, to rewrite the source ip of Wireguard to it's interface address in order to match the traffic?

package mwan3

config rule 'wg_dev'
	option src_port '51822'
	option proto 'udp'
	option sticky '0'
	option use_policy 'wanb_wan'

config rule 'bypass_devnet'
	option family 'ipv4'
	option src_ip '172.20.128.0/19'
	option proto 'all'
	option sticky '0'
	option use_policy 'wanb_wan'

config rule 'bypass_dyndns'
	option family 'ipv4'
	option proto 'all'
	option sticky '0'
	option use_policy 'wanb_wan'
	option dest_ip '193.122.6.168'
	option logging '1'

config rule 'default_gst_v4'
	option family 'ipv4'
	option proto 'all'
	option sticky '0'
	option use_policy 'wanb_wan'
	option src_ip '172.20.192.0/19'
	option dest_ip '0.0.0.0/0'

config rule 'default_rule_v4'
	option family 'ipv4'
	option dest_ip '0.0.0.0/0'
	option proto 'all'
	option sticky '0'
	option use_policy 'wan_wanb'

config rule 'default_rule_v6'
	option dest_ip '::/0'
	option family 'ipv6'
	option proto 'all'
	option sticky '0'
	option use_policy 'wan_wanb'

config globals 'globals'
	option mmx_mask '0x3F00'
	option logging '1'
	option loglevel 'notice'

config interface 'wan'
	option enabled '1'
	list track_ip '8.8.4.4'
	list track_ip '8.8.8.8'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option family 'ipv4'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option check_quality '1'
	option failure_latency '1000'
	option failure_loss '40'
	option recovery_latency '500'
	option recovery_loss '10'
	option timeout '4'
	option interval '3'
	option failure_interval '5'
	option recovery_interval '5'
	option up '3'
	option down '3'
	option reliability '1'

config interface 'wan6'
	list track_ip '2001:4860:4860::8844'
	list track_ip '2001:4860:4860::8888'
	list track_ip '2620:0:ccd::2'
	list track_ip '2620:0:ccc::2'
	option family 'ipv6'
	option enabled '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option timeout '4'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option check_quality '1'
	option failure_latency '1000'
	option failure_loss '40'
	option recovery_latency '500'
	option recovery_loss '10'
	option interval '3'
	option up '3'
	option reliability '1'

config interface 'wanb'
	list track_ip '8.8.4.4'
	list track_ip '8.8.8.8'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option family 'ipv4'
	option reliability '1'
	option enabled '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option check_quality '0'
	option timeout '4'
	option interval '10'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'

config interface 'wanb6'
	list track_ip '2001:4860:4860::8844'
	list track_ip '2001:4860:4860::8888'
	list track_ip '2620:0:ccd::2'
	list track_ip '2620:0:ccc::2'
	option family 'ipv6'
	option reliability '1'
	option enabled '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option check_quality '0'
	option timeout '4'
	option interval '10'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'

config member 'wan_m1_w3'
	option interface 'wan'
	option metric '1'
	option weight '3'

config member 'wan_m2_w3'
	option interface 'wan'
	option metric '2'
	option weight '3'

config member 'wanb_m1_w2'
	option interface 'wanb'
	option metric '1'
	option weight '2'

config member 'wanb_m2_w2'
	option interface 'wanb'
	option metric '2'
	option weight '2'

config member 'wan6_m1_w3'
	option interface 'wan6'
	option metric '1'
	option weight '3'

config member 'wan6_m2_w3'
	option interface 'wan6'
	option metric '2'
	option weight '3'

config member 'wanb6_m1_w2'
	option interface 'wanb6'
	option metric '1'
	option weight '2'

config member 'wanb6_m2_w2'
	option interface 'wanb6'
	option metric '2'
	option weight '2'

config policy 'wan_only'
	list use_member 'wan_m1_w3'
	list use_member 'wan6_m1_w3'

config policy 'wanb_only'
	list use_member 'wanb_m1_w2'
	list use_member 'wanb6_m1_w2'

config policy 'balanced'
	list use_member 'wan_m1_w3'
	list use_member 'wanb_m1_w2'
	list use_member 'wan6_m1_w3'
	list use_member 'wanb6_m1_w2'

config policy 'wan_wanb'
	list use_member 'wan_m1_w3'
	list use_member 'wanb_m2_w2'
	list use_member 'wan6_m1_w3'
	list use_member 'wanb6_m2_w2'

config policy 'wanb_wan'
	list use_member 'wan_m2_w3'
	list use_member 'wanb_m1_w2'
	list use_member 'wan6_m2_w3'
	list use_member 'wanb6_m1_w2'

trendy · April 11, 2022, 4:05pm

No it's not necessary. Post the iptables-save -c -t mangle as well.

Knogle · April 11, 2022, 4:08pm

Alright, here you go.

# Generated by iptables-save v1.8.7 on Mon Apr 11 18:07:39 2022
*mangle
:PREROUTING ACCEPT [124506:115674502]
:INPUT ACCEPT [33165:43026110]
:FORWARD ACCEPT [91281:72565605]
:OUTPUT ACCEPT [17069:2124939]
:POSTROUTING ACCEPT [108351:74690576]
:mwan3_connected - [0:0]
:mwan3_hook - [0:0]
:mwan3_iface_in_wan - [0:0]
:mwan3_iface_in_wanb - [0:0]
:mwan3_ifaces_in - [0:0]
:mwan3_policy_balanced - [0:0]
:mwan3_policy_wan_only - [0:0]
:mwan3_policy_wan_wanb - [0:0]
:mwan3_policy_wanb_only - [0:0]
:mwan3_policy_wanb_wan - [0:0]
:mwan3_rules - [0:0]
[124909:116179892] -A PREROUTING -j mwan3_hook
[454:24616] -A FORWARD -o bonding-i0.2100 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[438:23576] -A FORWARD -i bonding-i0.2100 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[1:44] -A FORWARD -o pppoe-wanb -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[1:44] -A FORWARD -i pppoe-wanb -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[17124:2139718] -A OUTPUT -j mwan3_hook
[140357:115003135] -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark 0x3f00/0x3f00
[141983:118315854] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j CONNMARK --restore-mark --nfmask 0x3f00 --ctmask 0x3f00
[1477:119130] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_ifaces_in
[1433:117278] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_connected
[30:1544] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_rules
[142033:118319610] -A mwan3_hook -j CONNMARK --save-mark --nfmask 0x3f00 --ctmask 0x3f00
[140242:118133722] -A mwan3_hook -m mark ! --mark 0x3f00/0x3f00 -j mwan3_connected
[0:0] -A mwan3_iface_in_wan -i bonding-i0.2100 -m set --match-set mwan3_connected src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[40:1680] -A mwan3_iface_in_wan -i bonding-i0.2100 -m mark --mark 0x0/0x3f00 -m comment --comment wan -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_iface_in_wanb -i pppoe-wanb -m set --match-set mwan3_connected src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[4:172] -A mwan3_iface_in_wanb -i pppoe-wanb -m mark --mark 0x0/0x3f00 -m comment --comment wanb -j MARK --set-xmark 0x300/0x3f00
[1477:119130] -A mwan3_ifaces_in -m mark --mark 0x0/0x3f00 -j mwan3_iface_in_wan
[1437:117450] -A mwan3_ifaces_in -m mark --mark 0x0/0x3f00 -j mwan3_iface_in_wanb
[0:0] -A mwan3_policy_balanced -m mark --mark 0x0/0x3f00 -m statistic --mode random --probability 0.39999999991 -m comment --comment "wanb 2 5" -j MARK --set-xmark 0x300/0x3f00
[0:0] -A mwan3_policy_balanced -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_policy_wan_only -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[30:1544] -A mwan3_policy_wan_wanb -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_policy_wanb_only -m mark --mark 0x0/0x3f00 -m comment --comment "wanb 2 2" -j MARK --set-xmark 0x300/0x3f00
[0:0] -A mwan3_policy_wanb_wan -m mark --mark 0x0/0x3f00 -m comment --comment "wanb 2 2" -j MARK --set-xmark 0x300/0x3f00
[0:0] -A mwan3_rules -p udp -m multiport --sports 51822 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[0:0] -A mwan3_rules -s 172.20.128.0/19 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[0:0] -A mwan3_rules -d 193.122.6.168/32 -m mark --mark 0x0/0x3f00 -m comment --comment bypass_dyndns -j LOG --log-prefix "MWAN3(bypass_dyndns)" --log-level 5
[0:0] -A mwan3_rules -d 193.122.6.168/32 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[0:0] -A mwan3_rules -s 172.20.192.0/19 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[30:1544] -A mwan3_rules -m mark --mark 0x0/0x3f00 -j mwan3_policy_wan_wanb
COMMIT
# Completed on Mon Apr 11 18:07:39 2022

trendy · April 11, 2022, 4:13pm

Looks fine, try to use it because currently has 0 hits.

Knogle · April 11, 2022, 4:23pm

Thanks a lot! Now it looks like that.
Unfortunately traffic flow is not as expected.
When i connect with VPN targeting my WAN ip address it works fine, i got responses. (Even though i got the policy for WANB).
When i connect targeting WANB ip address traffic is going being redirected to the WANB interface again instead of being processed. I think the reason is, clients as well as the server use port 51822 therefore the traffic is not passing as expected.
Do i have to further specify the mwan3 rule in order to circumvent any policing on incoming VPN traffic, but only the outgoing traffic?

Connecting through WAN

Attempted connection through WANB

# Generated by iptables-save v1.8.7 on Mon Apr 11 18:18:54 2022
*mangle
:PREROUTING ACCEPT [1923169:1785441335]
:INPUT ACCEPT [526477:672448170]
:FORWARD ACCEPT [1396614:1112906466]
:OUTPUT ACCEPT [273624:33628946]
:POSTROUTING ACCEPT [1670236:1146535260]
:mwan3_connected - [0:0]
:mwan3_hook - [0:0]
:mwan3_iface_in_wan - [0:0]
:mwan3_iface_in_wanb - [0:0]
:mwan3_ifaces_in - [0:0]
:mwan3_policy_balanced - [0:0]
:mwan3_policy_wan_only - [0:0]
:mwan3_policy_wan_wanb - [0:0]
:mwan3_policy_wanb_only - [0:0]
:mwan3_policy_wanb_wan - [0:0]
:mwan3_rules - [0:0]
[1923572:1785946725] -A PREROUTING -j mwan3_hook
[618:33720] -A FORWARD -o bonding-i0.2100 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[594:32100] -A FORWARD -i bonding-i0.2100 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[1:44] -A FORWARD -o pppoe-wanb -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[1:44] -A FORWARD -i pppoe-wanb -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[273679:33643725] -A OUTPUT -j mwan3_hook
[2162094:1811870661] -A mwan3_connected -m set --match-set mwan3_connected dst -j MARK --set-xmark 0x3f00/0x3f00
[2184536:1818514507] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j CONNMARK --restore-mark --nfmask 0x3f00 --ctmask 0x3f00
[23874:1897191] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_ifaces_in
[23109:1862537] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_connected
[325:25051] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_rules
[2197251:1819590450] -A mwan3_hook -j CONNMARK --save-mark --nfmask 0x3f00 --ctmask 0x3f00
[2147359:1814975675] -A mwan3_hook -m mark ! --mark 0x3f00/0x3f00 -j mwan3_connected
[8:1144] -A mwan3_iface_in_wan -i bonding-i0.2100 -m set --match-set mwan3_connected src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[567:24213] -A mwan3_iface_in_wan -i bonding-i0.2100 -m mark --mark 0x0/0x3f00 -m comment --comment wan -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_iface_in_wanb -i pppoe-wanb -m set --match-set mwan3_connected src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[190:9297] -A mwan3_iface_in_wanb -i pppoe-wanb -m mark --mark 0x0/0x3f00 -m comment --comment wanb -j MARK --set-xmark 0x300/0x3f00
[23874:1897191] -A mwan3_ifaces_in -m mark --mark 0x0/0x3f00 -j mwan3_iface_in_wan
[23299:1871834] -A mwan3_ifaces_in -m mark --mark 0x0/0x3f00 -j mwan3_iface_in_wanb
[0:0] -A mwan3_policy_balanced -m mark --mark 0x0/0x3f00 -m statistic --mode random --probability 0.39999999991 -m comment --comment "wanb 2 5" -j MARK --set-xmark 0x300/0x3f00
[0:0] -A mwan3_policy_balanced -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_policy_wan_only -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[318:24391] -A mwan3_policy_wan_wanb -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_policy_wanb_only -m mark --mark 0x0/0x3f00 -m comment --comment "wanb 2 2" -j MARK --set-xmark 0x300/0x3f00
[7:660] -A mwan3_policy_wanb_wan -m mark --mark 0x0/0x3f00 -m comment --comment "wanb 2 2" -j MARK --set-xmark 0x300/0x3f00
[2:296] -A mwan3_rules -p udp -m multiport --sports 51822 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[0:0] -A mwan3_rules -s 172.20.128.0/19 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[1:60] -A mwan3_rules -d 193.122.6.168/32 -m mark --mark 0x0/0x3f00 -m comment --comment bypass_dyndns -j LOG --log-prefix "MWAN3(bypass_dyndns)" --log-level 5
[1:60] -A mwan3_rules -d 193.122.6.168/32 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[4:304] -A mwan3_rules -s 172.20.192.0/19 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wanb_wan
[318:24391] -A mwan3_rules -m mark --mark 0x0/0x3f00 -j mwan3_policy_wan_wanb
COMMIT
# Completed on Mon Apr 11 18:18:54 2022

trendy · April 11, 2022, 9:44pm

What is the output of ip -4 addr; ip -4 route list table all; ip -4 ru ?

Knogle · April 11, 2022, 10:13pm

Alright! Here you go.

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 10.10.10.10/32 brd 255.255.255.255 scope global lo
       valid_lft forever preferred_lft forever
15: br-Perf: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.7.1/24 brd 192.168.7.255 scope global br-Perf
       valid_lft forever preferred_lft forever
17: bonding-i0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.3.1/24 brd 192.168.3.255 scope global bonding-i0
       valid_lft forever preferred_lft forever
    inet 10.192.0.1/32 brd 255.255.255.255 scope global bonding-i0
       valid_lft forever preferred_lft forever
19: bonding-i0.110@bonding-i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 172.20.32.1/19 brd 172.20.63.255 scope global bonding-i0.110
       valid_lft forever preferred_lft forever
20: bonding-i0.200@bonding-i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.200.1/24 brd 192.168.200.255 scope global bonding-i0.200
       valid_lft forever preferred_lft forever
21: bonding-i0.320@bonding-i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 172.20.192.1/19 brd 172.20.223.255 scope global bonding-i0.320
       valid_lft forever preferred_lft forever
23: bonding-i0.340@bonding-i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 172.20.224.1/19 brd 172.20.255.255 scope global bonding-i0.340
       valid_lft forever preferred_lft forever
24: bonding-i0.2100@bonding-i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.178.39/24 brd 192.168.178.255 scope global bonding-i0.2100
       valid_lft forever preferred_lft forever
36: tun2: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    inet 10.8.0.1/24 scope global tun2
       valid_lft forever preferred_lft forever
43: GuestHub: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 10.20.192.1/24 brd 10.20.192.255 scope global GuestHub
       valid_lft forever preferred_lft forever
45: Hub: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 10.0.0.1/24 brd 10.0.0.255 scope global Hub
       valid_lft forever preferred_lft forever
56: bonding-i0.4@bonding-i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 172.20.128.1/19 brd 172.20.159.255 scope global bonding-i0.4
       valid_lft forever preferred_lft forever
359: pppoe-wanb: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc fq_codel state UNKNOWN group default qlen 3
    inet 89.0.79.218 peer 195.14.226.125/32 scope global pppoe-wanb
       valid_lft forever preferred_lft forever
365: devnethub: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 10.20.128.1/24 brd 10.20.128.255 scope global devnethub
       valid_lft forever preferred_lft forever
default via 192.168.178.1 dev bonding-i0.2100 table 1 proto static src 192.168.178.39 metric 1 
10.0.0.0/24 dev Hub table 1 proto kernel scope link src 10.0.0.1 
10.0.0.3 dev Hub table 1 proto static scope link 
10.0.0.4 dev Hub table 1 proto static scope link 
10.0.0.5 dev Hub table 1 proto static scope link 
10.8.0.0/24 dev tun2 table 1 proto kernel scope link src 10.8.0.1 
10.20.128.0/24 dev devnethub table 1 proto kernel scope link src 10.20.128.1 
10.20.128.2 dev devnethub table 1 proto static scope link 
10.20.128.3 dev devnethub table 1 proto static scope link 
10.20.128.4 dev devnethub table 1 proto static scope link 
10.20.128.5 dev devnethub table 1 proto static scope link 
10.20.128.6 dev devnethub table 1 proto static scope link 
10.20.128.7 dev devnethub table 1 proto static scope link 
10.20.192.0/24 dev GuestHub table 1 proto static scope link 
10.20.192.2 dev GuestHub table 1 proto static scope link 
10.20.192.3 dev GuestHub table 1 proto static scope link 
10.20.192.4 dev GuestHub table 1 proto static scope link 
10.20.192.5 dev GuestHub table 1 proto static scope link 
87.78.69.250 via 192.168.178.1 dev bonding-i0.2100 table 1 proto static metric 1 
89.0.31.248 via 192.168.178.1 dev bonding-i0.2100 table 1 proto static metric 1 
89.1.165.118 via 192.168.178.1 dev bonding-i0.2100 table 1 proto static metric 1 
172.20.32.0/19 dev bonding-i0.110 table 1 proto kernel scope link src 172.20.32.1 
172.20.128.0/19 dev bonding-i0.4 table 1 proto kernel scope link src 172.20.128.1 
172.20.192.0/19 dev bonding-i0.320 table 1 proto kernel scope link src 172.20.192.1 
172.20.224.0/19 dev bonding-i0.340 table 1 proto kernel scope link src 172.20.224.1 
192.168.1.0/24 dev Hub table 1 proto static scope link 
192.168.3.0/24 dev bonding-i0 table 1 proto kernel scope link src 192.168.3.1 
192.168.7.0/24 dev br-Perf table 1 proto kernel scope link src 192.168.7.1 
192.168.11.0/24 dev Hub table 1 proto static scope link 
192.168.88.0/24 dev Hub table 1 proto static scope link 
192.168.162.0/24 dev Hub table 1 proto static scope link 
192.168.163.0/24 dev Hub table 1 proto static scope link 
192.168.165.0/24 dev Hub table 1 proto static scope link 
192.168.178.0/24 dev bonding-i0.2100 table 1 proto static scope link metric 1 
192.168.188.0/24 dev Hub table 1 proto static scope link 
192.168.200.0/24 dev bonding-i0.200 table 1 proto kernel scope link src 192.168.200.1 
default via 195.14.226.125 dev pppoe-wanb table 3 proto static metric 2 
10.0.0.0/24 dev Hub table 3 proto kernel scope link src 10.0.0.1 
10.0.0.3 dev Hub table 3 proto static scope link 
10.0.0.4 dev Hub table 3 proto static scope link 
10.0.0.5 dev Hub table 3 proto static scope link 
10.8.0.0/24 dev tun2 table 3 proto kernel scope link src 10.8.0.1 
10.20.128.0/24 dev devnethub table 3 proto kernel scope link src 10.20.128.1 
10.20.128.2 dev devnethub table 3 proto static scope link 
10.20.128.3 dev devnethub table 3 proto static scope link 
10.20.128.4 dev devnethub table 3 proto static scope link 
10.20.128.5 dev devnethub table 3 proto static scope link 
10.20.128.6 dev devnethub table 3 proto static scope link 
10.20.128.7 dev devnethub table 3 proto static scope link 
10.20.192.0/24 dev GuestHub table 3 proto static scope link 
10.20.192.2 dev GuestHub table 3 proto static scope link 
10.20.192.3 dev GuestHub table 3 proto static scope link 
10.20.192.4 dev GuestHub table 3 proto static scope link 
10.20.192.5 dev GuestHub table 3 proto static scope link 
172.20.32.0/19 dev bonding-i0.110 table 3 proto kernel scope link src 172.20.32.1 
172.20.128.0/19 dev bonding-i0.4 table 3 proto kernel scope link src 172.20.128.1 
172.20.192.0/19 dev bonding-i0.320 table 3 proto kernel scope link src 172.20.192.1 
172.20.224.0/19 dev bonding-i0.340 table 3 proto kernel scope link src 172.20.224.1 
192.168.1.0/24 dev Hub table 3 proto static scope link 
192.168.3.0/24 dev bonding-i0 table 3 proto kernel scope link src 192.168.3.1 
192.168.7.0/24 dev br-Perf table 3 proto kernel scope link src 192.168.7.1 
192.168.11.0/24 dev Hub table 3 proto static scope link 
192.168.88.0/24 dev Hub table 3 proto static scope link 
192.168.162.0/24 dev Hub table 3 proto static scope link 
192.168.163.0/24 dev Hub table 3 proto static scope link 
192.168.165.0/24 dev Hub table 3 proto static scope link 
192.168.188.0/24 dev Hub table 3 proto static scope link 
192.168.200.0/24 dev bonding-i0.200 table 3 proto kernel scope link src 192.168.200.1 
195.14.226.125 dev pppoe-wanb table 3 proto kernel scope link src 89.0.79.218 
default via 192.168.178.1 dev bonding-i0.2100 proto static src 192.168.178.39 metric 1 
default via 195.14.226.125 dev pppoe-wanb proto static metric 2 
10.0.0.0/24 dev Hub proto kernel scope link src 10.0.0.1 
10.0.0.3 dev Hub proto static scope link 
10.0.0.4 dev Hub proto static scope link 
10.0.0.5 dev Hub proto static scope link 
10.8.0.0/24 dev tun2 proto kernel scope link src 10.8.0.1 
10.20.128.0/24 dev devnethub proto kernel scope link src 10.20.128.1 
10.20.128.2 dev devnethub proto static scope link 
10.20.128.3 dev devnethub proto static scope link 
10.20.128.4 dev devnethub proto static scope link 
10.20.128.5 dev devnethub proto static scope link 
10.20.128.6 dev devnethub proto static scope link 
10.20.128.7 dev devnethub proto static scope link 
10.20.192.0/24 dev GuestHub proto static scope link 
10.20.192.2 dev GuestHub proto static scope link 
10.20.192.3 dev GuestHub proto static scope link 
10.20.192.4 dev GuestHub proto static scope link 
10.20.192.5 dev GuestHub proto static scope link 
87.78.69.250 via 192.168.178.1 dev bonding-i0.2100 proto static metric 1 
89.0.31.248 via 192.168.178.1 dev bonding-i0.2100 proto static metric 1 
89.1.165.118 via 192.168.178.1 dev bonding-i0.2100 proto static metric 1 
172.20.32.0/19 dev bonding-i0.110 proto kernel scope link src 172.20.32.1 
172.20.128.0/19 dev bonding-i0.4 proto kernel scope link src 172.20.128.1 
172.20.192.0/19 dev bonding-i0.320 proto kernel scope link src 172.20.192.1 
172.20.224.0/19 dev bonding-i0.340 proto kernel scope link src 172.20.224.1 
192.168.1.0/24 dev Hub proto static scope link 
192.168.3.0/24 dev bonding-i0 proto kernel scope link src 192.168.3.1 
192.168.7.0/24 dev br-Perf proto kernel scope link src 192.168.7.1 
192.168.11.0/24 dev Hub proto static scope link 
192.168.88.0/24 dev Hub proto static scope link 
192.168.162.0/24 dev Hub proto static scope link 
192.168.163.0/24 dev Hub proto static scope link 
192.168.165.0/24 dev Hub proto static scope link 
192.168.178.0/24 dev bonding-i0.2100 proto static scope link metric 1 
192.168.188.0/24 dev Hub proto static scope link 
192.168.200.0/24 dev bonding-i0.200 proto kernel scope link src 192.168.200.1 
195.14.226.125 dev pppoe-wanb proto kernel scope link src 89.0.79.218 
broadcast 10.0.0.0 dev Hub table local proto kernel scope link src 10.0.0.1 
local 10.0.0.1 dev Hub table local proto kernel scope host src 10.0.0.1 
broadcast 10.0.0.255 dev Hub table local proto kernel scope link src 10.0.0.1 
broadcast 10.8.0.0 dev tun2 table local proto kernel scope link src 10.8.0.1 
local 10.8.0.1 dev tun2 table local proto kernel scope host src 10.8.0.1 
broadcast 10.8.0.255 dev tun2 table local proto kernel scope link src 10.8.0.1 
local 10.10.10.10 dev lo table local proto kernel scope host src 10.10.10.10 
broadcast 10.20.128.0 dev devnethub table local proto kernel scope link src 10.20.128.1 
local 10.20.128.1 dev devnethub table local proto kernel scope host src 10.20.128.1 
broadcast 10.20.128.255 dev devnethub table local proto kernel scope link src 10.20.128.1 
broadcast 10.20.192.0 dev GuestHub table local proto kernel scope link src 10.20.192.1 
local 10.20.192.1 dev GuestHub table local proto kernel scope host src 10.20.192.1 
broadcast 10.20.192.255 dev GuestHub table local proto kernel scope link src 10.20.192.1 
local 10.192.0.1 dev bonding-i0 table local proto kernel scope host src 10.192.0.1 
local 89.0.79.218 dev pppoe-wanb table local proto kernel scope host src 89.0.79.218 
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
broadcast 172.20.32.0 dev bonding-i0.110 table local proto kernel scope link src 172.20.32.1 
local 172.20.32.1 dev bonding-i0.110 table local proto kernel scope host src 172.20.32.1 
broadcast 172.20.63.255 dev bonding-i0.110 table local proto kernel scope link src 172.20.32.1 
broadcast 172.20.128.0 dev bonding-i0.4 table local proto kernel scope link src 172.20.128.1 
local 172.20.128.1 dev bonding-i0.4 table local proto kernel scope host src 172.20.128.1 
broadcast 172.20.159.255 dev bonding-i0.4 table local proto kernel scope link src 172.20.128.1 
broadcast 172.20.192.0 dev bonding-i0.320 table local proto kernel scope link src 172.20.192.1 
local 172.20.192.1 dev bonding-i0.320 table local proto kernel scope host src 172.20.192.1 
broadcast 172.20.223.255 dev bonding-i0.320 table local proto kernel scope link src 172.20.192.1 
broadcast 172.20.224.0 dev bonding-i0.340 table local proto kernel scope link src 172.20.224.1 
local 172.20.224.1 dev bonding-i0.340 table local proto kernel scope host src 172.20.224.1 
broadcast 172.20.255.255 dev bonding-i0.340 table local proto kernel scope link src 172.20.224.1 
broadcast 192.168.3.0 dev bonding-i0 table local proto kernel scope link src 192.168.3.1 
local 192.168.3.1 dev bonding-i0 table local proto kernel scope host src 192.168.3.1 
broadcast 192.168.3.255 dev bonding-i0 table local proto kernel scope link src 192.168.3.1 
broadcast 192.168.7.0 dev br-Perf table local proto kernel scope link src 192.168.7.1 
local 192.168.7.1 dev br-Perf table local proto kernel scope host src 192.168.7.1 
broadcast 192.168.7.255 dev br-Perf table local proto kernel scope link src 192.168.7.1 
broadcast 192.168.178.0 dev bonding-i0.2100 table local proto kernel scope link src 192.168.178.39 
local 192.168.178.39 dev bonding-i0.2100 table local proto kernel scope host src 192.168.178.39 
broadcast 192.168.178.255 dev bonding-i0.2100 table local proto kernel scope link src 192.168.178.39 
broadcast 192.168.200.0 dev bonding-i0.200 table local proto kernel scope link src 192.168.200.1 
local 192.168.200.1 dev bonding-i0.200 table local proto kernel scope host src 192.168.200.1 
broadcast 192.168.200.255 dev bonding-i0.200 table local proto kernel scope link src 192.168.200.1 
0:	from all lookup local
1001:	from all iif bonding-i0.2100 lookup 1
1003:	from all iif pppoe-wanb lookup 3
2001:	from all fwmark 0x100/0x3f00 lookup 1
2003:	from all fwmark 0x300/0x3f00 lookup 3
2061:	from all fwmark 0x3d00/0x3f00 blackhole
2062:	from all fwmark 0x3e00/0x3f00 unreachable
3001:	from all fwmark 0x100/0x3f00 unreachable
3003:	from all fwmark 0x300/0x3f00 unreachable
32766:	from all lookup main
32767:	from all lookup default

trendy · April 12, 2022, 12:38pm

I don't see any issues there. I suggest you try the workaround for OpenVPN from the wiki. If that won't help, we can invite the developers to have a look.

Knogle · April 22, 2022, 10:07am

Thanks a lot.
I have tried that approach, unfortunately it didn't work.
Furthermore i've tried to fw-mark the Wireguard traffic and match it according to it on mwan3.
Same behaviour.
I am now using wanb_wan policy instead of wan_wanb. Also tried balanced, but Wireguard only works through wan.
OpenVPN etc. works fine through wanb as well as wan.
I'll try to change the gateway metric, so wanb is 1, and wan is 2. I think Wireguard somehow uses the default routing table, instead of the mwan3 one.

EDIT:
Changing the metric, so wanb has a metric of 1, and wan of 2 allows Wireguard to work now through wanb's IP address.