Mwan3: how to route one client using one vpn interface (wireguard)?

I would like to learn how to use mwan3 with vpn connections. I'm using OpenWrt 22.05

The escenario is:
I have a streaming stick, with lan ip 192.168.20.215
I would like to watch netflix from mexico.
I have a commercial vpn subscription and it provides configuration files for wireguard. The vpn company has a vpn server in mexico.

I added wireguard following the wiki guide.

Now I have a network interface called wg_mexico and I would like to use mwan3 to route the client traffic.

I know it is possible using policy based routing or pbr package. But I need mwan3 to load balance two internet connections.

A small extract from my mwan3 config

config interface 'wg_mexico'
	list track_ip '1.0.0.1'
	list track_ip '1.1.1.1'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option family 'ipv4'
	option reliability '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option timeout '4'
	option interval '10'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'
	option enabled '1'


config member 'wg_mexico_m1_wA'
	option interface 'wg_mexico'
	option metric '10'
	option weight '10'


config policy 'wg_mexico_only'
	list use_member 'wg_mexico_m1_wA'
	option last_resort 'blackhole'

#the next rule is the first one in mwan3 web gui
config rule 'mbp_wg_mexico'
	option proto 'all'
	option src_ip '192.168.20.215'
	option sticky '0'
	option use_policy 'wg_mexico_only'
	option family 'ipv4'

#default rule for https
#default rule for ipv4

What would be the steps to achieve it?

Provided that the stick doesn't get IPv6, this is enough to make it work with mwan3.
Make sure the rule for this is higher than the others to have precedence.

1 Like

it's the first on the list for rules
but either mwan ignores it or the client loses internet connection

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export mwan3; \
uci export firewall; \
nft list ruleset; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ip -6 addr ; ip -6 ro li tab all ; ip -6 ru; \
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
1 Like

{
	"kernel": "5.15.134",
	"hostname": "openwrt",
	"system": "MediaTek MT7621 ver:1 eco:3",
	"model": "Linksys EA7300 v1",
	"board_name": "linksys,ea7300-v1",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.0",
		"revision": "r23497-6637af95aa",
		"target": "ramips/mt7621",
		"description": "OpenWrt 23.05.0 r23497-6637af95aa"
	}
}
package network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd5e:3c1e:0409::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config device
	option name 'lan1'
	option macaddr '60:38:e0:2d:92:34'

config device
	option name 'lan2'
	option macaddr '60:38:e0:2d:92:34'

config device
	option name 'lan3'
	option macaddr '60:38:e0:2d:92:34'

config device
	option name 'lan4'
	option macaddr '60:38:e0:2d:92:34'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.20.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns_search 'lan'

config device
	option name 'wan'
	option macaddr '60:38:e0:2d:92:34'

config interface 'wan'
	option device 'br-wan'
	option proto 'dhcp'
	option metric '10'

config interface 'wan6'
	option device 'br-wan'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option metric '10'


config interface 'eth1'
	option proto 'dhcp'
	option device 'eth1'
	option type 'bridge'

config device
	option name 'br-wan'
	option type 'bridge'
	list ports 'wan'

config device
	option type 'bridge'
	option name 'br-wanb'
	list ports 'lan1'

config interface 'wanb'
	option proto 'dhcp'
	option device 'lan1'
	option metric '20'

config interface 'tun0_vpn'
	option proto 'none'
	option device 'tun0'

config interface 'wg_disney'
	option proto 'wireguard'
	option private_key 'openwrt'
	list addresses '10.100.68.111/32'
	list dns '10.100.0.1'
	option metric '5'
	option auto '0'
	option nohostroute '1'

config wireguard_wg_disney
	option description 'Imported peer configuration'
	option public_key 'openwrt'
	option preshared_key 'openwrt'
	list allowed_ips '0.0.0.0/0'
	option persistent_keepalive '25'
	option endpoint_host '10.10.10.10'
	option endpoint_port '8888'

config interface 'wg_mexico'
	option proto 'wireguard'
	option private_key 'openwrt'
	list addresses '10.102.240.175/32'
	list dns '10.100.0.1'
	option metric '7'
	option auto '0'
	option nohostroute '1'
	option defaultroute '0'

config wireguard_wg_mexico
	option description 'imported.conf'
	option public_key 'openwrt'
	option preshared_key 'openwrt='
	list allowed_ips '0.0.0.0/0'
	option persistent_keepalive '25'
	option endpoint_host '20.20.02.20'
	option endpoint_port '7777'

package mwan3

config globals 'globals'
	option mmx_mask '0x3F00'

config interface 'wan'
	list track_ip '1.0.0.1'
	list track_ip '1.1.1.1'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option family 'ipv4'
	option reliability '2'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option timeout '4'
	option interval '10'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'
	option enabled '1'

config interface 'wan6'
	list track_ip '2606:4700:4700::1001'
	list track_ip '2606:4700:4700::1111'
	list track_ip '2620:0:ccd::2'
	list track_ip '2620:0:ccc::2'
	option family 'ipv6'
	option reliability '2'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option timeout '4'
	option interval '10'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'

config interface 'wanb'
	list track_ip '1.0.0.1'
	list track_ip '1.1.1.1'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option family 'ipv4'
	option reliability '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option timeout '4'
	option interval '10'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'
	option enabled '1'

config interface 'wanb6'
	option enabled '0'
	list track_ip '2606:4700:4700::1001'
	list track_ip '2606:4700:4700::1111'
	list track_ip '2620:0:ccd::2'
	list track_ip '2620:0:ccc::2'
	option family 'ipv6'
	option reliability '1'

config member 'wan_m1_w3'
	option interface 'wan'
	option metric '1'
	option weight '3'

config member 'wan_m2_w3'
	option interface 'wan'
	option metric '2'
	option weight '3'

config member 'wanb_m1_w2'
	option interface 'wanb'
	option metric '1'
	option weight '2'

config member 'wanb_m1_w3'
	option interface 'wanb'
	option metric '1'
	option weight '3'

config member 'wanb_m2_w2'
	option interface 'wanb'
	option metric '2'
	option weight '2'

config member 'wan6_m1_w3'
	option interface 'wan6'
	option metric '1'
	option weight '3'

config member 'wan6_m2_w3'
	option interface 'wan6'
	option metric '2'
	option weight '3'

config member 'wanb6_m1_w2'
	option interface 'wanb6'
	option metric '1'
	option weight '2'

config member 'wanb6_m1_w3'
	option interface 'wanb6'
	option metric '1'
	option weight '3'

config member 'wanb6_m2_w2'
	option interface 'wanb6'
	option metric '2'
	option weight '2'

config policy 'wan_only'
	list use_member 'wan_m1_w3'
	list use_member 'wan6_m1_w3'

config policy 'wanb_only'
	list use_member 'wanb_m1_w2'
	list use_member 'wanb6_m1_w2'

config policy 'balanced'
	list use_member 'wan_m1_w3'
	list use_member 'wanb_m1_w3'
	list use_member 'wan6_m1_w3'
	list use_member 'wanb6_m1_w3'

config policy 'wan_wanb'
	list use_member 'wan_m1_w3'
	list use_member 'wanb_m2_w2'
	list use_member 'wan6_m1_w3'
	list use_member 'wanb6_m2_w2'

config policy 'wanb_wan'
	list use_member 'wan_m2_w3'
	list use_member 'wanb_m1_w2'
	list use_member 'wan6_m2_w3'
	list use_member 'wanb6_m1_w2'

config rule 'https'
	option sticky '1'
	option dest_port '443'
	option proto 'tcp'
	option use_policy 'balanced'

config rule 'default_rule_v4'
	option dest_ip '0.0.0.0/0'
	option use_policy 'balanced'
	option family 'ipv4'

config rule 'default_rule_v6'
	option dest_ip '::/0'
	option use_policy 'balanced'
	option family 'ipv6'

config rule 'mbp_wg_mexico'
	option proto 'all'
	option src_ip '192.168.20.215'
	option sticky '0'
	option use_policy 'wg_mexico_only'
	option family 'ipv4'

config member 'wg_disney_m1_wA'
	option interface 'wg_disney'
	option metric '10'
	option weight '10'

config policy 'wg_disney_only'
	list use_member 'wg_disney_m1_wA'
	option last_resort 'default'

config interface 'wg_disney'
	list track_ip '1.0.0.1'
	list track_ip '1.1.1.1'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option family 'ipv4'
	option reliability '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option timeout '4'
	option interval '10'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'

config member 'wg_mexico_m1_wA'
	option interface 'wg_mexico'
	option metric '10'
	option weight '10'

config policy 'wg_mexico_only'
	list use_member 'wg_mexico_m1_wA'
	option last_resort 'blackhole'

config interface 'wg_mexico'
	list track_ip '1.0.0.1'
	list track_ip '1.1.1.1'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option family 'ipv4'
	option reliability '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option timeout '4'
	option interval '10'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'

package firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'openwrt_upstream'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	list network 'wan'
	list network 'wan6'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wanb'
	list network 'tun0_vpn'
	list network 'wg_disney'
	list network 'wg_mexico'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config forwarding
	option src 'openwrt_upstream'
	option dest 'lan'

config forwarding
	option src 'lan'
	option dest 'openwrt_upstream'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/pbr.firewall.include'

config zone
	option name 'eth1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq '1'
	list network 'eth1'

config forwarding
	option src 'lan'
	option dest 'eth1'

table inet fw4 {
	chain input {
		type filter hook input priority filter; policy drop;
		iifname "lo" accept comment "!fw4: Accept traffic from loopback"
		ct state established,related accept comment "!fw4: Allow inbound established and related flows"
		tcp flags syn / fin,syn,rst,ack jump syn_flood comment "!fw4: Rate limit TCP syn packets"
		iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
		iifname "br-wan" jump input_openwrt_upstream comment "!fw4: Handle openwrt_upstream IPv4/IPv6 input traffic"
		iifname { "tun0", "lan1" } jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
		iifname "eth1" jump input_eth1 comment "!fw4: Handle eth1 IPv4/IPv6 input traffic"
		jump handle_reject
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
		iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
		iifname "br-wan" jump forward_openwrt_upstream comment "!fw4: Handle openwrt_upstream IPv4/IPv6 forward traffic"
		iifname { "tun0", "lan1" } jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
		iifname "eth1" jump forward_eth1 comment "!fw4: Handle eth1 IPv4/IPv6 forward traffic"
		jump handle_reject
	}

	chain output {
		type filter hook output priority filter; policy accept;
		oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
		ct state established,related accept comment "!fw4: Allow outbound established and related flows"
		oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
		oifname "br-wan" jump output_openwrt_upstream comment "!fw4: Handle openwrt_upstream IPv4/IPv6 output traffic"
		oifname { "tun0", "lan1" } jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
		oifname "eth1" jump output_eth1 comment "!fw4: Handle eth1 IPv4/IPv6 output traffic"
	}

	chain prerouting {
		type filter hook prerouting priority filter; policy accept;
		iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
	}

	chain handle_reject {
		meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
		reject comment "!fw4: Reject any other traffic"
	}

	chain syn_flood {
		limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
		drop comment "!fw4: Drop excess packets"
	}

	chain input_lan {
		jump accept_from_lan
	}

	chain output_lan {
		jump accept_to_lan
	}

	chain forward_lan {
		jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
		jump accept_to_openwrt_upstream comment "!fw4: Accept lan to openwrt_upstream forwarding"
		jump accept_to_eth1 comment "!fw4: Accept lan to eth1 forwarding"
		jump accept_to_lan
	}

	chain helper_lan {
	}

	chain accept_from_lan {
		iifname "br-lan" counter packets 10790 bytes 1934934 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
	}

	chain accept_to_lan {
		oifname "br-lan" counter packets 1582 bytes 141101 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
	}

	chain input_openwrt_upstream {
		jump accept_from_openwrt_upstream
	}

	chain output_openwrt_upstream {
		jump accept_to_openwrt_upstream
	}

	chain forward_openwrt_upstream {
		jump accept_to_lan comment "!fw4: Accept openwrt_upstream to lan forwarding"
		jump reject_to_openwrt_upstream
	}

	chain accept_from_openwrt_upstream {
		iifname "br-wan" counter packets 6971 bytes 1035207 accept comment "!fw4: accept openwrt_upstream IPv4/IPv6 traffic"
	}

	chain accept_to_openwrt_upstream {
		meta nfproto ipv4 oifname "br-wan" ct state invalid counter packets 559 bytes 46224 drop comment "!fw4: Prevent NAT leakage"
		oifname "br-wan" counter packets 22072 bytes 3540176 accept comment "!fw4: accept openwrt_upstream IPv4/IPv6 traffic"
	}

	chain reject_to_openwrt_upstream {
		oifname "br-wan" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject openwrt_upstream IPv4/IPv6 traffic"
	}

	chain input_wan {
		meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
		icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
		meta nfproto ipv4 meta l4proto igmp counter packets 227 bytes 7264 accept comment "!fw4: Allow-IGMP"
		meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
		ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . no-route, mld-listener-report . no-route, mld-listener-done . no-route, mld2-listener-report . no-route } counter packets 1137 bytes 81864 accept comment "!fw4: Allow-MLD"
		icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second counter packets 13 bytes 728 accept comment "!fw4: Allow-ICMPv6-Input"
		icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
		jump reject_from_wan
	}

	chain output_wan {
		jump accept_to_wan
	}

	chain forward_wan {
		icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
		icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
		meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
		udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
		jump reject_to_wan
	}

	chain accept_to_wan {
		meta nfproto ipv4 oifname { "tun0", "lan1" } ct state invalid counter packets 536 bytes 43961 drop comment "!fw4: Prevent NAT leakage"
		oifname { "tun0", "lan1" } counter packets 18555 bytes 3515664 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
	}

	chain reject_from_wan {
		iifname { "tun0", "lan1" } counter packets 11 bytes 707 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}

	chain reject_to_wan {
		oifname { "tun0", "lan1" } counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}

	chain input_eth1 {
		jump accept_from_eth1
	}

	chain output_eth1 {
		jump accept_to_eth1
	}

	chain forward_eth1 {
		jump accept_to_eth1
	}

	chain accept_from_eth1 {
		iifname "eth1" counter packets 0 bytes 0 accept comment "!fw4: accept eth1 IPv4/IPv6 traffic"
	}

	chain accept_to_eth1 {
		meta nfproto ipv4 oifname "eth1" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
		oifname "eth1" counter packets 0 bytes 0 accept comment "!fw4: accept eth1 IPv4/IPv6 traffic"
	}

	chain dstnat {
		type nat hook prerouting priority dstnat; policy accept;
	}

	chain srcnat {
		type nat hook postrouting priority srcnat; policy accept;
		oifname "br-wan" jump srcnat_openwrt_upstream comment "!fw4: Handle openwrt_upstream IPv4/IPv6 srcnat traffic"
		oifname { "tun0", "lan1" } jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
		oifname "eth1" jump srcnat_eth1 comment "!fw4: Handle eth1 IPv4/IPv6 srcnat traffic"
	}

	chain srcnat_openwrt_upstream {
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 openwrt_upstream traffic"
	}

	chain srcnat_wan {
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
	}

	chain srcnat_eth1 {
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 eth1 traffic"
	}

	chain raw_prerouting {
		type filter hook prerouting priority raw; policy accept;
	}

	chain raw_output {
		type filter hook output priority raw; policy accept;
	}

	chain mangle_prerouting {
		type filter hook prerouting priority mangle; policy accept;
		jump pbr_prerouting comment "Jump into pbr prerouting chain"
	}

	chain mangle_postrouting {
		type filter hook postrouting priority mangle; policy accept;
		jump pbr_postrouting comment "Jump into pbr postrouting chain"
	}

	chain mangle_input {
		type filter hook input priority mangle; policy accept;
		jump pbr_input comment "Jump into pbr input chain"
	}

	chain mangle_output {
		type route hook output priority mangle; policy accept;
		jump pbr_output comment "Jump into pbr output chain"
	}

	chain mangle_forward {
		type filter hook forward priority mangle; policy accept;
		iifname { "tun0", "lan1" } tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
		oifname { "tun0", "lan1" } tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
		jump pbr_forward comment "Jump into pbr forward chain"
	}

	chain pbr_forward {
	}

	chain pbr_input {
	}

	chain pbr_output {
	}

	chain pbr_prerouting {
	}

	chain pbr_postrouting {
	}
}
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
4: lan1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.100.59/24 brd 192.168.100.255 scope global lan1
       valid_lft forever preferred_lft forever
10: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.20.1/24 brd 192.168.20.255 scope global br-lan
       valid_lft forever preferred_lft forever
11: br-wan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.30.2/24 brd 192.168.30.255 scope global br-wan
       valid_lft forever preferred_lft forever
default via 192.168.30.1 dev br-wan table 1 proto static src 192.168.30.2 metric 10
192.168.20.0/24 dev br-lan table 1 proto kernel scope link src 192.168.20.1
192.168.30.0/24 dev br-wan table 1 proto static scope link metric 10
default via 192.168.100.1 dev lan1 table 3 proto static src 192.168.100.59 metric 20
192.168.20.0/24 dev br-lan table 3 proto kernel scope link src 192.168.20.1
192.168.100.0/24 dev lan1 table 3 proto static scope link metric 20
default via 192.168.30.1 dev br-wan proto static src 192.168.30.2 metric 10
default via 192.168.100.1 dev lan1 proto static src 192.168.100.59 metric 20
192.168.20.0/24 dev br-lan proto kernel scope link src 192.168.20.1
192.168.30.0/24 dev br-wan proto static scope link metric 10
192.168.100.0/24 dev lan1 proto static scope link metric 20
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
local 192.168.20.1 dev br-lan table local proto kernel scope host src 192.168.20.1
broadcast 192.168.20.255 dev br-lan table local proto kernel scope link src 192.168.20.1
local 192.168.30.2 dev br-wan table local proto kernel scope host src 192.168.30.2
broadcast 192.168.30.255 dev br-wan table local proto kernel scope link src 192.168.30.2
local 192.168.100.59 dev lan1 table local proto kernel scope host src 192.168.100.59
broadcast 192.168.100.255 dev lan1 table local proto kernel scope link src 192.168.100.59
0:	from all lookup local
1001:	from all iif br-wan lookup 1
1003:	from all iif lan1 lookup 3
2001:	from all fwmark 0x100/0x3f00 lookup 1
2003:	from all fwmark 0x300/0x3f00 lookup 3
2061:	from all fwmark 0x3d00/0x3f00 blackhole
2062:	from all fwmark 0x3e00/0x3f00 unreachable
3001:	from all fwmark 0x100/0x3f00 unreachable
3003:	from all fwmark 0x300/0x3f00 unreachable
32766:	from all lookup main
32767:	from all lookup default
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1504 state UP qlen 1000
    inet6 fe80::1cec:a3ff:feab:6610/64 scope link
       valid_lft forever preferred_lft forever
4: lan1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::6238:e0ff:fe2d:9234/64 scope link
       valid_lft forever preferred_lft forever
10: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fd6d:1b4a:9340:4::1/62 scope global dynamic noprefixroute
       valid_lft 35712sec preferred_lft 35712sec
    inet6 fd5e:3c1e:409::1/60 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fe80::6238:e0ff:fe2d:9234/64 scope link
       valid_lft forever preferred_lft forever
11: br-wan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fd6d:1b4a:9340:0:6238:e0ff:fe2d:9234/64 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fd6d:1b4a:9340::2/128 scope global dynamic noprefixroute
       valid_lft 35712sec preferred_lft 35712sec
    inet6 fe80::6238:e0ff:fe2d:9234/64 scope link
       valid_lft forever preferred_lft forever
12: phy0-ap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::6238:e0ff:fe2d:9235/64 scope link
       valid_lft forever preferred_lft forever
13: phy1-ap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::6238:e0ff:fe2d:9236/64 scope link
       valid_lft forever preferred_lft forever
14: phy1-ap1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::6038:e0ff:fe2d:9236/64 scope link
       valid_lft forever preferred_lft forever
fd6d:1b4a:9340::/48 from fd6d:1b4a:9340::2 via fe80::6238:e0ff:fe9f:5b51 dev br-wan table 2 proto static metric 512 pref medium
fd6d:1b4a:9340::/48 from fd6d:1b4a:9340::/64 via fe80::6238:e0ff:fe9f:5b51 dev br-wan table 2 proto static metric 512 pref medium
fd6d:1b4a:9340::/48 from fd6d:1b4a:9340:4::/62 via fe80::6238:e0ff:fe9f:5b51 dev br-wan table 2 proto static metric 512 pref medium
fd6d:1b4a:9340::/64 dev br-wan table 2 proto static metric 256 pref medium
fd5e:3c1e:409::/64 dev br-lan proto static metric 1024 pref medium
unreachable fd5e:3c1e:409::/48 dev lo proto static metric 2147483647 pref medium
fd6d:1b4a:9340::/48 from fd6d:1b4a:9340::2 via fe80::6238:e0ff:fe9f:5b51 dev br-wan proto static metric 512 pref medium
fd6d:1b4a:9340::/48 from fd6d:1b4a:9340::/64 via fe80::6238:e0ff:fe9f:5b51 dev br-wan proto static metric 512 pref medium
fd6d:1b4a:9340::/48 from fd6d:1b4a:9340:4::/62 via fe80::6238:e0ff:fe9f:5b51 dev br-wan proto static metric 512 pref medium
fd6d:1b4a:9340::/64 dev br-wan proto static metric 256 pref medium
unreachable fd6d:1b4a:9340::/64 dev lo proto static metric 2147483647 pref medium
fd6d:1b4a:9340:4::/64 dev br-lan proto static metric 1024 pref medium
unreachable fd6d:1b4a:9340:4::/62 dev lo proto static metric 2147483647 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev br-wan proto kernel metric 256 pref medium
fe80::/64 dev br-lan proto kernel metric 256 pref medium
fe80::/64 dev lan1 proto kernel metric 256 pref medium
fe80::/64 dev phy1-ap0 proto kernel metric 256 pref medium
fe80::/64 dev phy1-ap1 proto kernel metric 256 pref medium
fe80::/64 dev phy0-ap0 proto kernel metric 256 pref medium
local ::1 dev lo table local proto kernel metric 0 pref medium
anycast fd5e:3c1e:409:: dev br-lan table local proto kernel metric 0 pref medium
local fd5e:3c1e:409::1 dev br-lan table local proto kernel metric 0 pref medium
anycast fd6d:1b4a:9340:: dev br-wan table local proto kernel metric 0 pref medium
local fd6d:1b4a:9340::2 dev br-wan table local proto kernel metric 0 pref medium
local fd6d:1b4a:9340:0:6238:e0ff:fe2d:9234 dev br-wan table local proto kernel metric 0 pref medium
anycast fd6d:1b4a:9340:4:: dev br-lan table local proto kernel metric 0 pref medium
local fd6d:1b4a:9340:4::1 dev br-lan table local proto kernel metric 0 pref medium
anycast fe80:: dev eth0 table local proto kernel metric 0 pref medium
anycast fe80:: dev br-wan table local proto kernel metric 0 pref medium
anycast fe80:: dev br-lan table local proto kernel metric 0 pref medium
anycast fe80:: dev lan1 table local proto kernel metric 0 pref medium
anycast fe80:: dev phy1-ap0 table local proto kernel metric 0 pref medium
anycast fe80:: dev phy1-ap1 table local proto kernel metric 0 pref medium
anycast fe80:: dev phy0-ap0 table local proto kernel metric 0 pref medium
local fe80::1cec:a3ff:feab:6610 dev eth0 table local proto kernel metric 0 pref medium
local fe80::6038:e0ff:fe2d:9236 dev phy1-ap1 table local proto kernel metric 0 pref medium
local fe80::6238:e0ff:fe2d:9234 dev br-wan table local proto kernel metric 0 pref medium
local fe80::6238:e0ff:fe2d:9234 dev br-lan table local proto kernel metric 0 pref medium
local fe80::6238:e0ff:fe2d:9234 dev lan1 table local proto kernel metric 0 pref medium
local fe80::6238:e0ff:fe2d:9235 dev phy0-ap0 table local proto kernel metric 0 pref medium
local fe80::6238:e0ff:fe2d:9236 dev phy1-ap0 table local proto kernel metric 0 pref medium
multicast ff00::/8 dev eth0 table local proto kernel metric 256 pref medium
multicast ff00::/8 dev br-lan table local proto kernel metric 256 pref medium
multicast ff00::/8 dev br-wan table local proto kernel metric 256 pref medium
multicast ff00::/8 dev lan1 table local proto kernel metric 256 pref medium
multicast ff00::/8 dev phy1-ap0 table local proto kernel metric 256 pref medium
multicast ff00::/8 dev phy1-ap1 table local proto kernel metric 256 pref medium
multicast ff00::/8 dev phy0-ap0 table local proto kernel metric 256 pref medium
0:	from all lookup local
2061:	from all fwmark 0x3d00/0x3f00 blackhole
2062:	from all fwmark 0x3e00/0x3f00 unreachable
32766:	from all lookup main
4200000000:	from fd6d:1b4a:9340:4::1/62 iif br-lan unreachable
lrwxrwxrwx    1 root     root            16 Oct  9 15:45 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r--    1 root     root            47 Oct 19 01:05 /tmp/resolv.conf
-rw-r--r--    1 root     root           188 Oct 19 01:05 /tmp/resolv.conf.d/resolv.conf.auto

/tmp/resolv.conf.d:
-rw-r--r--    1 root     root           188 Oct 19 01:05 resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf.d <==
head: /tmp/resolv.conf.d: I/O error

==> /tmp/resolv.conf.d/resolv.conf.auto <==
# Interface lan
search lan
# Interface wan
nameserver 192.168.30.1
search lan
# Interface wan6
nameserver fd6d:1b4a:9340::1
# Interface wanb
nameserver 192.168.100.1
search routerlogin.net

I don't see anywhere a rule to match the source IP and mark the packet to use the correct policy.
Maybe it is still using iptables?
iptables-save -c

# Generated by iptables-save v1.8.8 on Today
*mangle
:PREROUTING ACCEPT [4017294:7914627795]
:INPUT ACCEPT [32848:4611255]
:FORWARD ACCEPT [3948798:7893064379]
:OUTPUT ACCEPT [31609:4465792]
:POSTROUTING ACCEPT [3979190:7897432777]
:mwan3_connected_ipv4 - [0:0]
:mwan3_custom_ipv4 - [0:0]
:mwan3_dynamic_ipv4 - [0:0]
:mwan3_hook - [0:0]
:mwan3_iface_in_wan - [0:0]
:mwan3_iface_in_wanb - [0:0]
:mwan3_ifaces_in - [0:0]
:mwan3_policy_balanced - [0:0]
:mwan3_policy_wan_only - [0:0]
:mwan3_policy_wan_wanb - [0:0]
:mwan3_policy_wanb_only - [0:0]
:mwan3_policy_wanb_wan - [0:0]
:mwan3_policy_wg_disney_only - [0:0]
:mwan3_policy_wg_mexico_only - [0:0]
:mwan3_rule_https - [0:0]
:mwan3_rules - [0:0]
[4024007:7916834752] -A PREROUTING -j mwan3_hook
[31914:4496657] -A OUTPUT -j mwan3_hook
[2687930:7069908504] -A mwan3_connected_ipv4 -m set --match-set mwan3_connected_ipv4 dst -j MARK --set-xmark 0x3f00/0x3f00
[0:0] -A mwan3_custom_ipv4 -m set --match-set mwan3_custom_ipv4 dst -j MARK --set-xmark 0x3f00/0x3f00
[0:0] -A mwan3_dynamic_ipv4 -m set --match-set mwan3_dynamic_ipv4 dst -j MARK --set-xmark 0x3f00/0x3f00
[4046025:7920499741] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j CONNMARK --restore-mark --nfmask 0x3f00 --ctmask 0x3f00
[62015:22603012] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_ifaces_in
[52222:21067475] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_custom_ipv4
[52222:21067475] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_connected_ipv4
[26351:5702037] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_dynamic_ipv4
[26351:5702037] -A mwan3_hook -m mark --mark 0x0/0x3f00 -j mwan3_rules
[4055921:7921331409] -A mwan3_hook -j CONNMARK --save-mark --nfmask 0x3f00 --ctmask 0x3f00
[3926353:7884450743] -A mwan3_hook -m mark ! --mark 0x3f00/0x3f00 -j mwan3_custom_ipv4
[3926353:7884450743] -A mwan3_hook -m mark ! --mark 0x3f00/0x3f00 -j mwan3_connected_ipv4
[1264294:829907677] -A mwan3_hook -m mark ! --mark 0x3f00/0x3f00 -j mwan3_dynamic_ipv4
[0:0] -A mwan3_iface_in_wan -i br-wan -m set --match-set mwan3_custom_ipv4 src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[9679:1514828] -A mwan3_iface_in_wan -i br-wan -m set --match-set mwan3_connected_ipv4 src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[0:0] -A mwan3_iface_in_wan -i br-wan -m set --match-set mwan3_dynamic_ipv4 src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[101:19898] -A mwan3_iface_in_wan -i br-wan -m mark --mark 0x0/0x3f00 -m comment --comment wan -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_iface_in_wanb -i lan1 -m set --match-set mwan3_custom_ipv4 src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[0:0] -A mwan3_iface_in_wanb -i lan1 -m set --match-set mwan3_connected_ipv4 src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[0:0] -A mwan3_iface_in_wanb -i lan1 -m set --match-set mwan3_dynamic_ipv4 src -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[13:811] -A mwan3_iface_in_wanb -i lan1 -m mark --mark 0x0/0x3f00 -m comment --comment wanb -j MARK --set-xmark 0x300/0x3f00
[61279:22453798] -A mwan3_ifaces_in -m mark --mark 0x0/0x3f00 -j mwan3_iface_in_wan
[51081:20845220] -A mwan3_ifaces_in -m mark --mark 0x0/0x3f00 -j mwan3_iface_in_wanb
[13002:2831796] -A mwan3_policy_balanced -m mark --mark 0x0/0x3f00 -m statistic --mode random --probability 0.50000000000 -m comment --comment "wanb 3 6" -j MARK --set-xmark 0x300/0x3f00
[12943:2823262] -A mwan3_policy_balanced -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_policy_wan_only -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_policy_wan_wanb -m mark --mark 0x0/0x3f00 -m comment --comment "wan 3 3" -j MARK --set-xmark 0x100/0x3f00
[0:0] -A mwan3_policy_wanb_only -m mark --mark 0x0/0x3f00 -m comment --comment "wanb 2 2" -j MARK --set-xmark 0x300/0x3f00
[0:0] -A mwan3_policy_wanb_wan -m mark --mark 0x0/0x3f00 -m comment --comment "wanb 2 2" -j MARK --set-xmark 0x300/0x3f00
[0:0] -A mwan3_policy_wg_disney_only -m mark --mark 0x0/0x3f00 -m comment --comment default -j MARK --set-xmark 0x3f00/0x3f00
[0:0] -A mwan3_policy_wg_mexico_only -m mark --mark 0x0/0x3f00 -m comment --comment blackhole -j MARK --set-xmark 0x3d00/0x3f00
[6150:463292] -A mwan3_rule_https -m mark --mark 0x0/0x3f00 -j mwan3_policy_balanced
[6150:463292] -A mwan3_rule_https -m mark ! --mark 0xfc00/0xfc00 -j SET --del-set mwan3_rule_ipv4_https src,src
[6150:463292] -A mwan3_rule_https -m mark ! --mark 0xfc00/0xfc00 -j SET --add-set mwan3_rule_ipv4_https src,src
[6150:463292] -A mwan3_rules -p tcp -m multiport --dports 443 -m mark --mark 0x0/0x3f00 -j mwan3_rule_https
[20201:5238745] -A mwan3_rules -m mark --mark 0x0/0x3f00 -j mwan3_policy_balanced
[0:0] -A mwan3_rules -s 192.168.20.215/32 -m mark --mark 0x0/0x3f00 -j mwan3_policy_wg_mexico_only
COMMIT
# Completed on Yesterday

I can just say that the rule is after the other rules (https, default_rule_v4, and default_rule_v6), which is also visible in the iptables output where the rule is also at the bottom without hits because the balanced policy gets everything.

1 Like

How can i make the rule higher?

Rearrange the order either from Luci or edit the /etc/config/mwan3

1 Like

the rule is at the top

You'll have to be more verbose to get some help.
Did you change the order and it is now at the top? Is it working now?

unfortunately, no

i tried changing the default rules for ipv4 traffic from balanced to wireguard interface and connectivity gets lost

if i use policy based routing package, it works like you might expect but I loose the load balancing from mwan3.

I guess mwan3 doesn't like wireguard.

This is expected as you don't have any static route for the wireguard endpoint.
Just change the order of the rules to bring the mbp_wg_mexico on top.