I have HAP AC2 with ROS 7.2.1 connected to two ISPs, so I have two WANs.
There are static public IPs on each of those WANs. I have 2 default gateways in routing table with different distances.
There is a Wireguard “server” set up on this router. It’s used both for site-to-site connections and for road warriors (devices with access to the Internet via mobile networks).
Another complication is that one of the WG servers works on UDP/53 to let some of clients to bypass some ISPs’ blocks. Needless to say I also have DNS server that serves DNS zone
What I want is to dedicate one WAN for all Wireguard traffic and another one for all other traffic.
I’ve tried to set up routing marking and dedicated routing tables together with routing rules but found that WG originated reply packet is always sourced with IP of WAN with lower distance.
Then I’ve realized that Wireguard works as a kernel driver, not user space application, and now I’m trying to understand if it possible at all to reach what I want without second router?
How do you identify which users or subnets is for wireguard internet traffic ??
Do you mean all internet traffic (all users should go out wireguard or only for the users or subnets from question 1?
I have one WG interface for outgoing internet traffic (for blocking override). I use huge routing table to forward users’ traffic via this interface.
Second WG interface listens on UDP/53, it’s for experiments now, but I plan to use it in the future as a main gate for road warriors.
WG-spider is used for site-to-site tunnels, several locations are connecting to this interface, I use it to have access to remote sites.
The traffic is forwarded to WG interfaces using pure routing table.
Regarding ISP. I have one 300Mbps WAN with strict and unpredictable blocking rules, I want to use it for state internet resources, in-country streaming services, etc
Second ISP is 100Mbps and I want to dedicate it to WG traffic.
Let’s assume first ISP has IP_A and second IP_B.
In routing table I have two default route records, route via WAN_A has less distance than via WAN_B.
What I see in packet sniffer - my router receives packet from remote to WAN_B, but the reply is sent with source IP = WAN_B.
So my question is - how to force wireguard to answer from the same address it’s received request to?
Well, I kind of solved it.
Only one client is now using “wrong” WAN, all other work fine, reply from WG on MT is sent via same interface as the request.
“Kind of” is because Remote1 still get answered from wrong IP - 1.1.2.1 instead of 1.1.1.1, that’s why there is “in-interface-list=wan” instead of “in-interface=WAN-eth1” in firewall filter rule.
Glitch here is that all this marking stuff is not working if packets are not dst-nat’ed, i.e. if packets go to wireguard directly, without passing destination port rewrite.
The overall explanation is poor and convoluted.
No network diagram.
No clear set of user requirements…
No config on MT device
/export file=anynameyouwish
Two WAN, clear,
Static public IPs on WANs clear, (so good candidates to be servers for any wirguard tunnels).
You use the wireguard tunnel for several purposes,
a. mobile remote clients access the server to go out your internet???
b. mobile remote clients access the server to reach subnets behind your router??
c. You have one or both ISPs that blocks at your end or prevent incoming or outgoing use of MOST ports??
d. Your mobile clients use ISPs that block or prevent use of most ports??
e. What are the site to site connetions for wireguard that you speak of?? Is it to other work sites, or homes etc… and are they always acting as client for initial connection?
f. For site to site connections, do the remote sites need access to your local subnets
g. For site to site connections, do the remote siteds need access to your internet
h. For site to site connections do you need access to remote sites subnets
I. For site to site connections do you need access to remote sites internet.
J. If one of your ISPs is a bitch, then is not useful at all, for either Wireguard tunnels or regular internet access ???
Dear sir or madam,
I’m very sorry for upsetting you by poor and convoluted explanation of what I need, but I’ve already achieved my goal, thanks to Cisco courses finished in 1997 and packet flow diagram, of course.
Thank you very much for your time.
We need better routing rules. It looks like Linux can use also protocol and ports as conditions, so I suppose RouterOS could do it to, but it’s not exposed to users. Then it would be possible to just use one routing rule for each WG instance and avoid mangle rules and srcnat.
