Flint 4 Dual PPPoE Multi-WAN and WireGuard Design Review

Router
1

Title: Flint 4 Dual PPPoE Multi-WAN and WireGuard Design Review

Hello GL.iNet team,

I would appreciate guidance on the recommended design for my Flint 4 homelab. The network is operational and stable; this is not a troubleshooting request.

Current setup:

  • GL.iNet Flint 4 as the Internet edge router

  • Two independent PPPoE WAN connections

  • Multi-WAN enabled

  • Grandstream GWN7821P managed switch

  • Proxmox VE with an OPNsense VM

  • Synology NAS

  • Grandstream access points

  • Home Assistant and other internal services

  • WireGuard for remote access, including a GL.iNet travel router when away from home

My goal is to keep the benefits of Multi-WAN for normal LAN traffic while maintaining predictable egress behavior for WireGuard clients.

Desired behavior:

  • General LAN traffic, browsing, downloads, updates, and IoT traffic can use both WAN connections through Multi-WAN.

  • WireGuard clients using full tunnel should normally exit through one preferred residential WAN and therefore retain one public IP address during a session.

  • This is important for remote work and services that can be affected by an unexpected public-IP change, including streaming services.

  • If the preferred WAN fails, general Internet access should continue through the remaining WAN. I understand that an active VPN or streaming session may need to reconnect after a real WAN failure; I mainly want to avoid IP changes during normal healthy Multi-WAN operation.

The architecture I am considering is:

  • Keep the WireGuard endpoint and WireGuard full-tunnel egress associated with WAN 1.

  • Allow ordinary LAN traffic to remain eligible for Multi-WAN load balancing across WAN 1 and WAN 2.

  • Use WAN 2 as failover when WAN 1 is unavailable.

I would appreciate clarification on the following:

  1. Is this the recommended design for Flint 4 and KMWAN?

  2. What is the supported way to keep WireGuard server traffic and full-tunnel client egress on one preferred WAN: policy-based routing, WAN binding, or another mechanism?

  3. Does KMWAN provide session persistence, sticky connections, or connection affinity relevant to long-lived WireGuard-originated sessions?

  4. What should I expect from an active WireGuard session if the preferred WAN fails?

  5. When WAN 1 returns, what is the recommended behavior for returning VPN traffic to the preferred WAN without unnecessarily disrupting users?

  6. Would GL.iNet recommend keeping these routing decisions on the Flint 4, or moving any advanced policy-routing functions to my downstream OPNsense VM?

  7. Is there an official reference architecture or documentation for dual PPPoE WAN, Multi-WAN, WireGuard server operation, and deterministic VPN egress?

I can provide sanitized screenshots of the Multi-WAN and WireGuard configuration if needed. I have removed credentials, public IP addresses, keys, and configuration exports from the attached topology.

Thank you for any guidance or documentation you can share.