On Sun, Apr 05, 2020 at 07:37:18PM +0200, vr...@tuta.io wrote: > Hi everyone! > I have some tiny proposal for wg-quick utility: adding priority for iproute2 > routing rules > > For linux.bash this should be as easy as this: > https://gitea.tort.icu/vrein/wireguard-tools/commit/0947dc76770a5d81ba39340ebe9189b80a92584c
While I don't think it'd be a bad idea to support configurable rule priorities if they're useful to someone, they shouldn't be neccessary for the use case you described -- you can avoid the separate routing rules for wg1 altogether. All you should need to do is to add "FwMark = 51820" (or some other arbitrary value, as long as it's identical for both wg tunnels) to the config files of both wg interfaces. Then you end up with these ip rules (taken from your post rather than an actual test): 0: from all lookup local 32764: from all lookup main suppress_prefixlength 0 32765: not from all fwmark 0xca6c lookup 51820 32766: from all lookup main 32767: from all lookup default Furthermore, wg-quick would add an "0.0.0.0/0 dev wg0" route to table 51820, and "10.5.0.0/24 dev wg1" to the main table. This would result in encrypted traffic using the routes in the main table, traffic to 10.5.0.0/24 the wg1 tunnel, and everything else the wg0 tunnel, exactly as intended by you. > PS: > Somehow, connectivity with both A and B peers were worked in single wg0 > interface some time ago, > but after few updates this feature stopped working. It should indeed be possible to have both of these peers on the same wg interface. If you're running into issues with that, please elaborate on them here or pay us a visit on IRC (#wireguard on Freenode). Luis