Route all traffic via VPN (except initial connection)

[CGGXANNX]

This is a case of reaching the router's local address(es) in main from other VRF and in particular is similar to the case of checking for updates when WAN is in another VRF:

How to keep CHR renewal when main VRF does not have internet access (but a different VRF has)?

MikroTik can probably easily add the setting option to select the VRF to Update Check / License / IP Cloud. They have added the option to choose the VRF to more and more RouterOS services with each update. And the "Check For Updates" menu recently gained a few more options already, so adding one more will not break the UI. I've thought about your idea of the tunnel and came up with this implementation that appears to be working. The idea is to abuse MACVLAN interfaces for a light weight "tunne…

(and also with the small improvement from this post).

NOTE: The "tunnel" with bridge and MACVLANs is the same setup as this post. The additional stuffs are:

• The special default route (dst-address=0.0.0.0/0) in main.
• The fake IP address on the MACVLAN interface (an IP address not assigned to the interface, however the router answers ARP request for the address).
• The SRCNAT rule changing the source address to the fake IP address for outgoing traffic to the internet from the router in main.

Screenshot of working example:

The WAN is in the VRF wan and we are pinging with src-address=10.20.40.1 which is the address assigned to ether4 in main.

The ARP entry and NAT rule for the fake 172.18.0.10 address: