Hi @grang 

Thanks for posting in our business forum.

grang wrote

 

The issue I have is that I am unable to configure my router so that outgoing traffic goes through the wireguard tunnel only when wan 1 is down (ie when Wan 2 is actually used)

So far, outgoign traffic is going through wireguard in any case, which

-is limiting my bandwidth because my VPS server is limited in bandwidth.

-make me have to find a way to route incoming request to my LAN servers, through the VPS public IP (the one attached to my domain names based on DDNS) to either the WAN 1 router interface or WAN 2 router interface upon WAN 1 availability (which I did not manage to do so far)

 

WG does not support load balance. But it could be used if the other peer did not specify the remote Endpoint. That is to say the router sets the peer settings with a specific Endpoint to start the connection. Other peer does not have a specific Endponit.

Natively does not support load balance means it cannot fall back to WAN 2 when WAN 1 is down.

A diagram may be needed if we need to further discuss this. But my initial reaction to this is not possible.

Hi @grang 

Thanks for posting in our business forum.

grang wrote

  @Clive_A 

Thanks for your feedback, even if I am kind of stuck now...

The key point in my case is indeed to have WG used only when I use WAN 2, which is in my router setup, when WAN 1 is down.

 

So you should configure Link Backup to disable WAN 1 if WAN 2 is up. So that the WG would not pass the WAN that is down.

grang wrote

  @Clive_A 

Thanks for your feedback, even if I am kind of stuck now...

The key point in my case is indeed to have WG used only when I use WAN 2, which is in my router setup, when WAN 1 is down.

 

I was not expecting it to be impossible but rather that I did not find how to do it! (assuming that having 5G backup connection to temporarily take over a disrupted fiber connection was a pretty common use case and that CGNAT were most often blocking entrant connections to cellular endpoints)

 

Is there a way to suggest this feature for future evolutions? 

I guess such result could be achieved through different ways:

-options to "attach" wireguard to WAN interfaces directly in the wireguard menu

-possibility to define routing policies that refer to VPN (wireguard) interfaces

-perhaps others ways?

 

 

As for the remote WG peer, extra settings may be needed to maintain the connection if one of the WANs is down.

There does not seem to be a good way to fix what you need unless the PBR or the Load Balance is available for the VPN.