I have 3 NIC in my system: eth0 (, eth1(, wg0 (VPN,

I'm looking for a way to route all eth1 traffic (tcp and udp) over wg0 (Wireguard VPN).

What I am trying to achieve is that on my phone/tablet/apple tv/etc I set eth1 address as Router, so all traffic should be redirected trough VPN.

On the remote side (it's a VPS) I have eth0 (main internet) and wg0 (

All what I currently did is that I successfully set up Wireguard interfaces on the both side (I can ping each other).

Route table:

default via dev eth0 onlink dev eth0  proto kernel  scope link  src dev eth1  proto kernel  scope link  src dev wg0  proto kernel  scope link  src 

1 Answer 1


You don't need two Ethernet interfaces. Define a host route via to the public IP of the VPN server, and point the default route to the remote end of the tunnel ( Make the default route on the other devices on your LAN point to Remember to enable packet forwarding on your PC (sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1).

EDIT: You cannot achieve the solution you are looking for with IPv4 classic routing, since classic routing is only concerned with where a packet is going, not its history, like which interface it was received on, or the source address. You will have to use Policy Routing to be able to classify packets based on the interface they were received on. Based on this classification you can then use an alternate routing table for routing, which, for example, defines a default route through your VPN tunnel.

To use policy routing, you should add an entry (vpn) to /etc/iproute2/rt_tables:

# reserved values
255     local
254     main
253     default
0       unspec
# local
1       vpn

This gives the name vpn to routing table number 1.

Next, add the following policy rule:

ip rule add unicast iif eth1 table vpn

This rule effectively says "if the packet comes in on interface eth1, use routing table vpn".

You can check the rules with ip rule show:

ip rule show
0:      from all lookup local 
32765:  from all iif eth1 lookup vpn 
32766:  from all lookup main 
32767:  from all lookup default

The rules are applied in ascending order, until a rule matches. If a packet is received on interfave eth1, rule 32765 matches, else the next rules are tried.

You can now add routes to the vpn routing table. For example, to add a default route to your tunnel:

ip route add default dev wg0 via table vpn

To print the vpn routing table, use

ip route show table vpn

Now, I haven't been able to actually test this, so there may be errors or some details missing. For more information on policy routing, see https://www.policyrouting.org or https://linux-ip.net.

  • Can you be a little bit more specific about routing? I have two interface, because there are other services running on this server (.54) which must be not affected in any way. "Define a host route" you mean I should create a static routing in my router (1.1) to the remote side 99.2? I can create a static routing for whole network only 99.0/24.
    – user66638
    Dec 15, 2017 at 21:30
  • Point the default route to the remote end of the tunnel ( --> I want to redirect only the eth1 traffic, not the whole network on the server.
    – user66638
    Dec 15, 2017 at 21:52
  • 1
    Packet forwarding is based on routes, not interfaces. Routing tables are per host. Using basic routing, any packet received on any interface is subject to a routing decision based on the destination address. Please give more detail on what you want to achieve. Policy based routing might be the solution to your problem. Dec 16, 2017 at 11:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .