WireGuard option 'tunlink' does not work

[Livy]

I have a router with multiple WAN connections, with one of them being a connection to a private corporate network which blocks virtually any connection to the Internet.

I create a WireGuard tunnel from that router to my home router, and by default, OpenWrt creates a route to my home router address via the corporate network gateway, and it blocks the WireGuard connection.

With the unrestricted PPPoE connection to my ISP being defined in myisp uci section, I tried to edit WireGuard peer with option tunlink, but it still binds my home router IP address to the corporate network gateway:

config device 'veth0'
	option name 'veth0'
	option type 'macvlan'
	option ifname 'eth0.<some_vid>'

config interface 'corporate'
	option device 'veth0'
	option proto 'static'
	option ipaddr '172.16.0.1'
	option netmask '255.255.255.0'
	option gateway '172.16.0.254'
	option metric '500'

config interface 'myisp'
	option device 'eth0.<another_vid>'
	option proto 'pppoe'
	option username '<user_name>'
	option password '<password>'

config interface 'vpn'
	option proto 'wireguard'
	option listen_port '51820'
	option private_key '<private_key>'
	list addresses '192.168.1.1/24'

config wireguard_vpn 'home'
	option description 'My home router'
	option public_key '<public_key>'
	option preshared_key '<pre_shared_key>'
	list allowed_ips '192.168.1.2/32'
	option route_allowed_ips '1'
	option endpoint_host '<home_router_ip_addr>'
	option endpoint_port '51820'
	option tunlink '@myisp'

I also tried myisp instead of @myisp but it does not work either. The result is always like this:

root@OpenWrt:~# ip route show
[...]
<home_router_ip_addr> via 172.16.0.254 dev veth0 proto static metric 500
[...]

I know I can remove the option gateway in the configuration of the corporate interface. But that gateway still allows some basic Internet services and I want to keep it as the last resort in case all WANs are down. Also, my configuration has a lot of WAN connections, and by removing that gateway, OpenWrt will fallback to a another random one for the WireGuard connection. I want it to use the specific myisp interface only.

I am using the latest version 22.03.2.

[psherman]

@Livy

	option tunlink '@myisp'

I don't see any indication that this option is supported for Wireguard (both as a regular Wireguard config option nor as an option for the way that OpenWrt deals with the protocol).

The only thing I see about using tunlink is with respect to GRE protocols, and I don't think that applies to Wireguard:

Tunneling interface protocols

EDIT: I was mistaken... see the next post from @Livy .

[Livy]

In fact it does.

I think this is the commit: https://github.com/openwrt/openwrt/commit/47b2ee2d9a9a1790f9bf8a528640c333af39e4ba

[psherman]

Cool. I stand corrected, and I've learned something.

[mk24]

Binding a service to a particular interface does not mean that packets will be routed to it. That is determined by the routing table(s). The firewall must also permit it. The option to bind to a particular interface is seldom necessary when a proper firewall is in place.

Probably the policy routing package or even a simple /32 route can be used to send packets to your house public IP (which would be the encrypted packets) via a particular WAN. Another approach would be to have the corporate connection only handle corporate LAN IPs.

Note that what you are doing presents a big security risk to the company. Any malware on your router or PC would have access to corporate secrets as well as unrestricted use of the Internet.

[Livy]

Binding a service to a particular interface does not mean that packets will be routed to it.

I can see this option works very well with GRE tunnel. I have been using it for a while.

even a simple /32 route can be used to send packets to your house public IP (which would be the encrypted packets) via a particular WAN

In reality, my home router does not have static IP address and needs to use DDNS. I don't think DDNS domain name will work with static route.

Note that what you are doing presents a big security risk to the company. Any malware on your router or PC would have access to corporate secrets as well as unrestricted use of the Internet.

My home network is more secured than this so called "corporate" network. The fact that it allows anything to connect to it is undeniable proof of its security status. And I don't type doas apk add malware.exe nor sudo apt install malware.exe on my PC. In short, I know what I am doing, and have to configure the firewall properly to block unauthorized access from this unsecured network to my home network.

[trendy]

tunlink option will change this:

netstat -lnp | grep 51820
udp        0      0 0.0.0.0:51820            0.0.0.0:*                           -
udp        0      0 :::51820                 :::*                                -

into that:

netstat -lnp | grep 51820
udp        0      0 myisp.ipv4:51820            0.0.0.0:*                           -
udp        0      0 myisp:ipv6:51820            :::*                                -

Other than that you can make an ip rule to route-lookup all packets from port 51820 to 51820 via the myisp routing table.

[Livy]

The Wiki is wrong. That option should belong to config interface section, as it does with GRE interfaces.