You don't need two Ethernet interfaces. Define a host route via
192.168.1.1 to the public IP of the VPN server, and point the default route to the remote end of the tunnel (
192.168.99.2). Make the default route on the other devices on your LAN point to
192.168.1.54. Remember to enable packet forwarding on your PC (
sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1).
EDIT: You cannot achieve the solution you are looking for with IPv4 classic routing, since classic routing is only concerned with where a packet is going, not its history, like which interface it was received on, or the source address. You will have to use Policy Routing to be able to classify packets based on the interface they were received on. Based on this classification you can then use an alternate routing table for routing, which, for example, defines a default route through your VPN tunnel.
To use policy routing, you should add an entry (vpn) to
# reserved values
This gives the name
vpn to routing table number 1.
Next, add the following policy rule:
ip rule add unicast iif eth1 table vpn
This rule effectively says "if the packet comes in on interface
eth1, use routing table
You can check the rules with
ip rule show:
ip rule show
0: from all lookup local
32765: from all iif eth1 lookup vpn
32766: from all lookup main
32767: from all lookup default
The rules are applied in ascending order, until a rule matches. If a packet is received on interfave
eth1, rule 32765 matches, else the next rules are tried.
You can now add routes to the
vpn routing table. For example, to add a default route to your tunnel:
ip route add default dev wg0 via 192.168.99.2 table vpn
To print the
vpn routing table, use
ip route show table vpn
Now, I haven't been able to actually test this, so there may be errors or some details missing. For more information on policy routing, see https://www.policyrouting.org or https://linux-ip.net.