The Goal: A VPN chain
I'm attempting to achieve a VPN chain. The first server is my own VPS, while the second one is from Mullvad VPN. I use my VPS for multiple purposes and I would like to only redirect the WireGuard traffic. All of the remaining traffic is not supposed to go through Mullvad.
Client to VPN Server 1
The connection between the client and my VPS already works. This is the WireGuard configuration file for the server (wg0.conf
):
[Interface]
PrivateKey = ********************************************
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = ********************************************
AllowedIPs = 10.0.0.2/32
And here is the client configuration file. All of the clients traffic goes through the VPN.
[Interface]
Address = 10.0.0.2/32
ListenPort = 51820
PrivateKey = ********************************************
[Peer]
PublicKey = ********************************************
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = ***.***.***.***:51820
VPN Server 1 to VPN Server 2 (Mullvad)
This is the Mullvad configuration file (wg1.conf
). The problem is, it tunnels all of the servers traffic through Mullvad.
[Interface]
PrivateKey = ********************************************
Address = 10.67.221.119/32,fc00:bbbb:bbbb:bb01::4:dd76/128
DNS = 100.64.0.7
PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
[Peer]
PublicKey = ********************************************
AllowedIPs = 0.0.0.0/0,::0/0
Endpoint = ***.***.***.***:51820
I guess, I'm looking for a way to only route the traffic from wg0
to wg1
. All of the remaining traffic should be excluded.