Routing home router VPN traffic through an external VPN client for public Wi-Fi

Router
1

Flint 2 with 4.9.1

​Hi everyone,

​I have a WireGuard server set up on my home GL.iNet router, and I connect to it from my phone when I'm on public or restrictive Wi-Fi networks.

​What I want to achieve is this: when my phone connects back to my home router's VPN, I want my internet traffic to exit through an external VPN provider (or another external server) that my home router is connected to, so that my IP and location match that external VPN's country rather than my home ISP.

​How can I properly configure this traffic chaining or routing on the GL.iNet router so that client traffic coming into the home WireGuard server gets pushed out through the external VPN client interface?

​Thanks for any guidance!

3

Hi,

This setup can be achieved on Flint 2 with firmware 4.9.1 by creating a VPN tunnel specifically for traffic coming from the WireGuard Server.

  1. Please add and connect the external VPN provider configuration under VPN Client Profile.
  2. Then go to VPN → VPN Dashboard, create a new tunnel using this VPN profile, and configure the traffic source as:
    From → Specified Connection Types → WireGuard Server
    image
    image1482×675 53.5 KB

    With this configuration, when your phone connects to the Flint 2 WireGuard Server, its Internet traffic will then be forwarded through the external VPN Client tunnel.

If you would also like to prevent the WireGuard Server clients from falling back to the home ISP connection when the external VPN disconnects, you can enable the Kill Switch for this tunnel.

image
image678×479 19.8 KB

2 Likes
4

Following up on the previous setup where I route my home WireGuard server traffic through an external VPN client on my GL.iNet router:

​I don't want all devices connected to the WireGuard server to exit through the external VPN. Instead, I only want specific devices (identified by their IP or static IP address) to use the external VPN tunnel, while other devices should route normally through my standard home ISP connection.

​How can I configure policy-based routing on GL.iNet firmware 4.9.1 so that it applies only to specific source IPs coming from the WireGuard server, rather than all traffic types?

​Thanks for any help

5

Hi,

Thanks for the clarification.
In this case, you may need to create a separate VPN tunnel for the remote WireGuard clients.
Then create an "empty" VPN tunnel, and then use the WireGuard peer's virtual IP address to route its traffic into that tunnel.

  1. You can use a phone or another device that supports a private/randomized MAC address. Connect it to the router once so that it appears in the client list, then change its randomized MAC address and reconnect it.

    image
    image778×649 32.8 KB

  2. Please change From from Specified Connection Types → WireGuard Server to Specified Devices, and select a spare/test device as a placeholder.

    image
    image1274×556 39.4 KB

  3. Check the peer IP and VPN mark.
    After the External VPN Tunnel is connected, check the WireGuard peer IP and routing policy through SSH:

wg show
ip -4 rule show | grep fwmark
ip -4 route show table all | grep -E '^default|wgclient|ovpn|tun'

For example, the output may show:

WireGuard peer IP: 10.0.0.2/32
fwmark 0x1000/0xf000 lookup 1001
default dev wgclient1 table 1001

In this example, 0x1000/0xf000 is the mark for the External VPN Tunnel. If your router shows a different peer IP, mark, or table, use the values from its actual output.

  1. Add the rule.
    Back up the current policy script:
cp -p /etc/firewall.vpn_server_policy.sh \
      /etc/firewall.vpn_server_policy.sh.bak

Run the following command once to add the persistent rule:

cat >> /etc/firewall.vpn_server_policy.sh <<'EOF'

# Route WireGuard Server peer 10.0.0.2 through the External VPN tunnel
iptables -w -t mangle -D PREROUTING \
    -i wgserver \
    -s 10.0.0.2/32 \
    -m comment --comment WG_PEER_TO_EXTERNAL_VPN \
    -j MARK --set-xmark 0x1000/0xf000 2>/dev/null

iptables -w -t mangle -A PREROUTING \
    -i wgserver \
    -s 10.0.0.2/32 \
    -m comment --comment WG_PEER_TO_EXTERNAL_VPN \
    -j MARK --set-xmark 0x1000/0xf000

EOF

chmod +x /etc/firewall.vpn_server_policy.sh

Replace 10.0.0.2/32 and 0x1000/0xf000 if your actual peer IP or External VPN mark is different.
Apply the configuration with:

/etc/init.d/firewall restart
  1. Check the result
    Confirm that the rule has been loaded:
iptables-save -c -t mangle | grep WG_PEER_TO_EXTERNAL_VPN

Traffic from 10.0.0.2 should now use the External VPN Tunnel automatically whenever the peer connects to the WireGuard Server. Other WireGuard peers without this rule will continue to use the normal WAN.
To route another peer through the same External VPN Tunnel, add another pair of -D and -A rules using that peer’s fixed WireGuard IP address.
6. Restore the original configuration
If you need to remove this customization, restore the backup and restart the firewall:

cp -p /etc/firewall.vpn_server_policy.sh.bak \
      /etc/firewall.vpn_server_policy.sh

/etc/init.d/firewall restart