Hello everyone, I'm Stefano from Italy, a Software Engineer passionate about networking.
I have an openwrt router with 3 interface configured: one for LAN and two for WAN (the WAN interfaces are physically connected to two ISP routers).
I recently configured mwan3 in order to have automatic failover (not load balancing) over the second WAN if the first one stops working, and it's working fine.
Now, I want to route all my traffic over VPN using the wireguard protocol. I have installed all the wireguard-related packages and configured the link.
In mwan3 i have created 2 rules:
Route traffic to the egress wireguard endpoint through the failover policy.
Route all other traffic (0.0.0.0/0) through the wireguard interface
It seems to work ok, but when the main WAN goes off, the tunnel stops working.
What is the best way to configure a wireguard tunnel over a faileover (or load balanced) mwan3 setup?
I had some initial problems if the connection with metric 21 went down and then up again, the Wireguard tunnel needed to be reestablished. I made script that was run with some delay👍🏻
I have solved it!
Here is the solution for others:
set the wireguard interface with a higher metric then the real wan interfaces in "network > interfaces" (example main wan = 10, other wan = 20, wireguard = 30)
setup the 3 interfaces (main wan, other wan, wireguard) in "network > multiwan manager > interface" and the 3 members in "network > multiwan manager > member". The trick here is to set the "Flush conntrack table" option to both "connected" and "disconnected" for the two real wan interfaces.
setup a real policy for the 2 real interfaces (failover or loadbalanced. i only tested failover) and a dummy policy for the wireguard interface in "network > multiwan manager > policy"
this is the second trick: create a first rule that routes all traffic with the destination address of your wireguard peer (vpn endpoint) to the failover policy, then create a second rule that routes all traffic (destination address 0.0.0.0/0) to the dummy wireguard policy
finally, set a keepalive interval for your peer in "network > interfaces > wireguard interface > peer" (for example 10 seconds)
Now, when my router boots, the wireguard tunnel is enstablished through the main wan. As soon as the main wan goes down, within a minute (you can tune the mwan3 parameters to shorten this interval) the tunnel is re-enastablished through the backup wan. When the main wan goes back, within a minute the tunnel is re-enstablished through the main wan.