Hello!
I just can’t get my head around this. I’ve implemented ProtonVPN into my Mikrotik Router via Wireguard, so the LAN devices are connected to ProtonVPN automatically.
Now I have an AWS EC2 instance that acts as a Wireguard Server and I can connect to the VPN from my Computer using the public IP of the EC2.
SSH is only reachable through the private IP of the EC2, which is in a 172.31.0.0/16 network.
The problem is that when I try to SSH into the EC2 the authentication works but the key exchange gets no response because obviously the answer gets lost somewhere in the ProtonVPN Wireguard interface on the Router.
I would like to exclude the IP from the ProtonVPN - but which one? The public IP of the EC2? The private IP? Both? I really can’t get my head around that.
However, I tried to exclude the public IP with mangle rules and a new routing table but I’m not even sure if my rules were correct or the public IP is not the right one to exlcude.
Alright, from what I’ve analyzed with torch I think I really only need the public IP.
So I’ve added a new table called aws, created a rule that this table uses the WAN gateway and added a mangle rule with that IP as dst and mark-routing to a new routing mark. Moved the rule to the top.
Still torch shows that this IP is routed to the WG interface of ProtonVPN. Clearly I miss something here lol
Thanks for offering your help. It has resolved itself because I found a solution that works for me: I had an old USB Wifi Adapter in my archive that is now working as the wifi interface to a network that is connected to the aws vpn.
Today morning the solution suddenly came to my mind: I just had to add the public IP to the protonVPN mangle rules as ! dst-address.
Also I removed the aws_vpn table and just added a connection mark mangle rule for this public IP, moved it above the protonVPN mangle rule and finally added a nat rule that masquerades this IP with ether1 as out interface.
What you left is just unclear guidance, since you never provided a diagram or export, one will never know if your solution is actually the right approach or efficient approach.
Hello, how are you? I have tried by all means to configure wireguard on an RB 750 updated to the latest stable version and I have not been able to. What I want to do is simple that all communication from my port 1 goes directly to protonvpn, using the default configuration and I couldn’t. Could you help me please.
Thank you! I’ve been wrestling with this all morning and when I read your post I was like “HECK YEAH!” and also like "How did I not realize this sooner?
For anyone else who finds this and needs more context - I set up a wireguard interface to mullvad using a combination of
But after mashing up all of the above I couldn’t figure out how to whitelist my local devices, specifically the router, on the VLANs which are tied into Mullvad. The comment here, to just add a !DST-Address rule in the mangle was super helpful-I spent all morning trying to figure out how to create a seperate set of routing rules to exempt that traffic.