So I'm playing around with the new vpn dashboard, but I noticed that wgserver can only be single inside the gl ui.
So I decided to make my second wgserver instance with luci-proto-wireguard.
The tunnel works also for wan, but it fails for me when I want to cascade it to wgclient1 through the dashboard, I have tried various things including adding fw mark 8000 in my second wgserver instance, that seem to change behaviour from firewall drop to reject, the fw zone is forwarded to wgclient1.
Even when I lookup ip route I see a route that the second wgserver goes automatically over wan even though I explicitly unchecked peer routing in my peers so this seem to be added by something, if I manual remove this and make a rule so that the wgservers ip goes over device of wgclient1 it also fails.
I think I'm close to a working setup, but I'm missing a certain mark or table.
If we understand correctly, your goal is to make the WireGuard Server created by luci-proto-wireguard also support VPN cascading, correct?
Let me see if I can set up a similar environment and test it.
It may take some time, but I will try to get back to you next week with the results.
Some unverified assumptions:
In v4.9, if you want to route traffic from a specific interface through the VPN Client, it appears that you may need to add the following configuration:
This is correct, basically I try to have a wifivpn from luci-proto-wireguard instance and then route over wgclient1.
I got it for wan working so the tunnel works, but it ignores when I set the policy for interfaces.
Edit:
I noticed the edit I gonna try this
Edit 2:
It seems it needs a little bit more configuration, it is now dropping connections, but wifivpn was not in the append_source_if list before, while in the ui it was set.
Edit 3:
After cleaning my orphaned firewall traffic rules with experimentation marks, the dropping behaviour was gone, however it just went through wan which is still unexpected.
So i was searching a little more on the forums to other issues, but this seem to solve it:
# check table of wgclient1 from
ip ru
uci set network.wifivpn_routing=rule
uci set network.wifivpn_routing.src=10.39.95.0/24
uci set network.wifivpn_routing.lookup=1001 # <- is wg table
uci set network.wifivpn_routing.priority=1000
uci commit network
/etc/init.d/network reload
Now what I don't know yet is if I need to touch config route_policy at all maybe only the rule is sufficient enough but as for now I have both setup and this works
Edit 4:
No, I think it is still relevant to edit the append_source_if rule, however the created rule which I made works, the policy software has issues detecting this tunnel and does not apply the necessary marks, it confirms it when I have a simple policy to route some domains to wan, but it never does.
it would be nice if some implementation code can be added in the future to still catch up this luci tunnel.
We checked, and it looks like we only need to add the VPN-related mark to the forwarding traffic of the firewall zone associated with luci-proto-wireguard:
uci -q delete firewall.wgserver1_mark
uci set firewall.wgserver1_mark='rule'
uci set firewall.wgserver1_mark.name='Mark wgserver1 ingress'
uci set firewall.wgserver1_mark.src='wgserver1'
uci set firewall.wgserver1_mark.dest='*'
uci set firewall.wgserver1_mark.proto='all'
uci set firewall.wgserver1_mark.family='ipv4'
uci set firewall.wgserver1_mark.target='MARK'
uci set firewall.wgserver1_mark.set_mark='0x1000/0xf000'
uci commit firewall
service firewall restart
