Routing Issues with Dual WiFi Hotspots: One Wireguard VPN, One Direct
In this article, we will discuss the common routing issues that arise when using dual WiFi hotspots, one connected to a Wireguard VPN and the other connected directly to the internet. We will cover key concepts, provide subtitles, use H2, H3, and other HTML tags, and include code blocks where necessary.
Environment
In this scenario, we have a Linux-based system with the following network interfaces:
wlan0: Used for the non-VPN hotspot (MyHotspot)wlan1: Connected to the internetwlan2: Used for the VPN hotspot (MyHotspot-VPN)au-syd-wg-002: Wireguard VPN interface
Common Routing Issues
When running dual WiFi hotspots with different connection types, there are several common routing issues that can arise:
- Traffic Leaks: This occurs when some traffic is directed over the VPN while other traffic takes the direct route.
- Slow Speeds: The system may experience slow speeds if it is routing traffic inefficiently.
- Poor Connectivity: Devices connected to the wrong hotspot may experience poor connectivity or be unable to access certain resources.
Routing Strategies
To overcome these issues, we need to employ proper routing strategies. One such strategy is to use ip rule and ip route commands to route traffic:
# Clear existing rules
sudo ip rule flush
# Add a rule for VPN traffic
sudo ip rule add from / table
# Add a rule for direct traffic
sudo ip rule add iif wlan0 table priority 100
# Create the VPN table
sudo ip route add table default via
# Create the direct table
sudo ip route add table default via
Replace the placeholders with the appropriate values based on your environment. For example:
sudo ip rule add from 10.6.0.0/24 table vpn table
sudo ip route add table vpn default via 10.6.0.1
sudo ip rule add iif wlan0 table direct priority 100
sudo ip route add table direct default via 192.168.1.1
Security Considerations
When using the above method, it's important to ensure that both tables (vpn and direct) are secure. You can use iptables or nftables to enforce security policies:
sudo iptables -t filter -A FORWARD -i wlan0 -o -j DROP
sudo iptables -t filter -A FORWARD -i -o wlan0 -m state --state ESTABLISHED,RELATED -j
References
Routing traffic with dual WiFi hotspots that use different connection types, such as a Wireguard VPN and a direct connection to the internet, can be complex. However, using ip rule and ip route commands, along with proper security policies, can help ensure that traffic is routed efficiently and securely.