Wireguard - Direct one networks traffic over the tunnel

Hi Community,

I first off want to say how really awesome VyOS is and I am learning a lot from it. I originally started off with EdgeOS but then quickly found VyOS and not long after I completely switched to using it for my home routing.

What have I done so far:

  1. I have four VyOS VM’s in multiple physical locations. What I want to focus on is only two of them so we’ll call my Primary router (HomeVyOS) and we’ll call the Secondary router (CloudVyOS).
  2. I have created the wireguard interfaces and have the CloudVyOS setup as the VPN server. HomeVyOS then connects to CloudVyOS. (I have the other two VyOS routers connecting to the server as well and I can pass traffic across all of them internally as if its one big private network) :slight_smile:

What I want to do and have not figured out.

  1. I want to direct one of the many networks on my HomeVyOS to send all of its internet traffic over the wireguard tunnel as if the CloudVyOS is my gateway to the internet.
  2. I then also would like to use the CloudVyOS as my public IP and entry point for some things I want to over to any one of the other VyOS routers. (Think of it as a big mess network that all connects to one central point which then handles all of the routing.)

So far my attempts to make this work have been not successful so I want to start from scratch so I have no static routes other than for each VyOS routers internal networks so that they can communicate across the tunnel.

Any help would be appreciated so I can wrap my head around this and get this working.

Just going to add as I have been googling for hours now.

I keep finding write ups on how to do this with EdgeRouters but they use the following command which I cannot seem to find the equivalent command in VyOS.

set firewall modify

They use this to modify traffic packets as it passes through the firewall in order to allow routing to work.

You need to combine your WG set up with policy based routing. More information here;



Did you manage to get anything working with WG + PBR?

@phillipmcmahon - I have had no such luck so far with the policy based routing.

I do apologize for the delayed response as I have been away for a couple days so I have not been able to work on this as much as I would have liked.

I’ll post what my config looks like for the policy routing later and maybe we can figure out what I am doing wrong here.

No need for the apology :slight_smile: just checking in to see if you’d had any luck.

I’ll try converting my ER config to Vyos with WG and PBR in the meantime.