Sstrhsrtj

I have 3 NIC in my system: eth0 (192.168.1.54), eth1(192.168.1.55), wg0 (VPN, 192.168.99.1)

I'm looking for a way to route all eth1 traffic (tcp and udp) over wg0 (Wireguard VPN).

What I am trying to achieve is that on my phone/tablet/apple tv/etc I set eth1 address as Router, so all traffic should be redirected trough VPN.

On the remote side (it's a VPS) I have eth0 (main internet) and wg0 (192.168.99.2).

All what I currently did is that I successfully set up Wireguard interfaces on the both side (I can ping each other).

Route table:

default via 192.168.1.1 dev eth0 onlink 

192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.54 

192.168.1.0/24 dev eth1  proto kernel  scope link  src 192.168.1.55 

192.168.99.0/24 dev wg0  proto kernel  scope link  src 192.168.99.1 

You don't need two Ethernet interfaces. Define a host route via 192.168.1.1 to the public IP of the VPN server, and point the default route to the remote end of the tunnel (192.168.99.2). Make the default route on the other devices on your LAN point to 192.168.1.54. Remember to enable packet forwarding on your PC (sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1).

EDIT: You cannot achieve the solution you are looking for with IPv4 classic routing, since classic routing is only concerned with where a packet is going, not its history, like which interface it was received on, or the source address. You will have to use Policy Routing to be able to classify packets based on the interface they were received on. Based on this classification you can then use an alternate routing table for routing, which, for example, defines a default route through your VPN tunnel.

To use policy routing, you should add an entry (vpn) to /etc/iproute2/rt_tables:

#

# reserved values

#

255     local

254     main

253     default

0       unspec

#

# local

#

1       vpn

This gives the name vpn to routing table number 1.

Next, add the following policy rule:

ip rule add unicast iif eth1 table vpn

This rule effectively says "if the packet comes in on interface eth1, use routing table vpn".

You can check the rules with ip rule show:

ip rule show

0:      from all lookup local 

32765:  from all iif eth1 lookup vpn 

32766:  from all lookup main 

32767:  from all lookup default

The rules are applied in ascending order, until a rule matches. If a packet is received on interfave eth1, rule 32765 matches, else the next rules are tried.

You can now add routes to the vpn routing table. For example, to add a default route to your tunnel:

ip route add default dev wg0 via 192.168.99.2 table vpn

To print the vpn routing table, use

ip route show table vpn

Now, I haven't been able to actually test this, so there may be errors or some details missing. For more information on policy routing, see https://www.policyrouting.org or https://linux-ip.net.