Split Traffic Between WAN and OpenVPN

Installing and Using OpenWrt Network and Wireless Configuration
1

I try to setup an old laptop as OpenWrt router to split list of destination IP addresses via VPN but all rest from normal WAN. My setup is like this:
The Ethernet port: eth0 is WAN
WIFI is off
USB ethernet dongle on a USB port as eth1 is LAN
OpenVPN (Surfshark) is always connected VPN server, e.g. a UK site, tun0

I setup mwan3 to route the traffic. But seems all traffic go to OpenVPN tun0.

Ping thru eth0 (wan) is 5.452ms

root@OpenWrt:~# ping -c 1 -I eth0 www.google.com
PING www.google.com (172.217.6.36): 56 data bytes
64 bytes from 172.217.6.36: seq=0 ttl=115 time=5.452 ms

Ping thru tun0(OpenVPN) is 268.147ms

root@OpenWrt:~# ping -c 1 -I tun0 www.google.com
PING www.google.com (172.217.6.36): 56 data bytes
64 bytes from 172.217.6.36: seq=0 ttl=60 time=268.147 ms

Ping directly is 269.591ms

root@OpenWrt:~# ping www.google.com
PING www.google.com (172.217.6.36): 56 data bytes
64 bytes from 172.217.6.36: seq=0 ttl=60 time=269.591 ms

Newbie here so this may not be right way to check. Used Surfshark IP address checker shows my external IP is thru VPN at UK site.

/etc/config/network
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fde0:8b70:62a8::/48'

config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'
        option force_link '1'
        option metric '0'

config interface 'lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ipaddr '192.168.2.1'
        option device 'eth1'

config interface 'surfsharktun'
        option proto 'none'
        option device 'tun0'
        option delegate '0'
        option metric '20'

/etc/config/mwan3
config globals 'globals'
        option mmx_mask '0x3F00'

config interface 'wan'
        option enabled '1'
        list track_ip '8.8.4.4'
        list track_ip '8.8.8.8'
        list track_ip '208.67.222.222'
        list track_ip '208.67.220.220'
        option family 'ipv4'
        option reliability '2'

config interface 'surfsharktun'
        list track_ip '8.8.4.4'
        list track_ip '8.8.8.8'
        list track_ip '208.67.222.222'
        list track_ip '208.67.220.220'
        option family 'ipv4'
        option reliability '1'
        option enabled '1'
        option initial_state 'online'
        option track_method 'ping'
        option count '1'
        option size '56'
        option max_ttl '60'
        option check_quality '0'
        option timeout '4'
        option interval '10'
        option failure_interval '5'
        option recovery_interval '5'
        option down '5'
        option up '5'

config member 'wan1'
        option interface 'wan'

config member 'ukvpn1'
        option interface 'surfsharktun'
        option metric '2'
        option weight '2'

config policy 'wan_only'
        option last_resort 'unreachable'
        list use_member 'wan1'

config policy 'ukvpn_only'
        list use_member 'ukvpn1'
        option last_resort 'unreachable'

config rule 'default_rule'
        option dest_ip '0.0.0.0/0'
        option proto 'all'
        option sticky '0'
        option family 'ipv4'
        option use_policy 'wan_only'

config policy 'wan_to_ukvpn'
        list use_member 'wan1'
        list use_member 'ukvpn1'
        option last_resort 'unreachable'

I first try to force all traffic thru WAN even after VPN is connected. Seems I can ping thru wan but all traffic from lan is thru tun0.

Another question is from Status->Routes I can see tun0's metric is 0, not 20 as I set in /etc/config/network. How can set tun0's metric to higher number? I thought it was the reason why traffic go to tun0 but even I set wan's metric to 0 (from 10) still traffic all go thru tun0.

2

That's not what mwan3 is for. Use vpn-policy-routing instead.

3

Your mwan configuration has a lot of mistakes.
Other than that, while mwan3 was created mostly for load balancing and failover, it certainly can do policy based routing, if configured properly. However if you are not experienced, you might find vpn-pbr easier to configure.