No inbound connection when Wireguard tunnel is established

Hi all,
I have a router at home. Network is just 2 computer and a phone. Nothing fancy about the router configuration. Mostly default configuration (except for wifi name, password, etc.).
I created an interface to established a Wireguard tunnel to a Wireguard server that not local (the other end of the country).
When I start the interface, all trafic goes through the Wireguard tunnel. ipv4 AND ipv6 (you can see my other post about that).
Problem is : when the tunnel is established, all the inbound connections don't work anymore. You can't ping the IP of the router, my web server hosted behind the router doesn't work anymore, I can't ssh to the router from outside anymore (yes, I've allowed ssh from wan).
From the local network, I can still ping and ssh the router.

With the help of tcpdump and netcat, I think what's going on is that I can see that the packet arrives on the interface wan, but when netcat tries to answer, the packet goes to the vpn. And then get lost.

Is there a way to configure the router for redirect trafic initiated by the local network to go through Wireguard, but answer to trafic initiated by the outside world goes the "normal" way ?

This is fully expected if you have all traffic going through the tunnel. To fix this, you need to use Policy Based Routing. This allows you to specify that inbound connections (via your regular wan) should have the return traffic routed via the wan and not the WG tunnel.

1 Like