Appreciate the link. I’ll dig into it further.
It ought to be possible, however, to route by domain. Use the ipset capability of dnsmasq to record the affected ip addresses in an ipset table and apply a fwmark to those addresses.
We can incorporate the fwmark in the iptables and ip rules to separate the special domain traffic from the rest and route accordingly.
This was the basis of the vpn-policy-routing package mentioned in the OP. (See here.)
But that package was just doesn’t quite seem to work with GL-iNet’s implementation of wireguard. The /etc/init.d/wireguard script forces all traffic to wg0 and uses iptables to block lan-wan and forwarding output, leaving wg0 as the only output interface. Then it adds two routes which effectively become a default route to wg0.
Changing those routes don’t help. Adding a route to a specific ip address still forces the traffic over WG. If I disable the wg script disables, then everything goes to the wan interface and nothing to wg0.
I’m just not getting something right about how wg manipulates iptables and routing to achieve the “route-all” and how I can modify it so it could route based on an fwmark.