Why not route traffic through the VPN via your router? Should be pretty easy with Mikrotik
deleted by creator
FWIW, I have used openwrt on my main router for almost 10 years, with no issues.
The problem seems to be your router. If you can install OpenWRT at all (check the supported devices), I would be surprised if it wasn’t more reliable that whatever OEM router software is already on there. The upshot is you can trust your router.
I agree, I have an ASUS router with Merlin FW and there is multiple VPN client on it and it can handle all this automatically.
The proper way to do it is connect your router to the vpn, most routers have support for it these days.
If you want to do it the harder way, connect one machine to your vpn provide on one wg network and create a second wg network for your local devices which routes all traffic (not just http) through the one device thats connected to your VPN provider. Basically make youe own home vpn server and connect to that.
Using just squid for http to relay the vpn in addition to being fragile and breaking sometimes is also just not really giving you the full vpn coverage, your ip is going to be leaking all over the place.
btw wireproxy also supports http proxy. i’m not sure how efficient it is, but i use it daily for having different vpns on each firefox container tab.
I dunno if this is a proper way… However I remember I did a similar thing to route all my traffic from all my devices to protonVPN’s free tier.
I can’t remember exactly how, but IIRC 2 wg connections where used (wg0 and wg-ext) and with some iptables rules I was able to route all traffic from wg0 to wg-ext without issues.
While I can’t exactly remember how, I think I still have the config files arround if you’re interested I can dig into my old backups :)
You need a router or a proxy. A proxy would be annoying, so a router is preferred.
If you don’t have control of your edge router, just get a cheap Pi-type device, install OpenWRT, setup your VPN connections, then create a route on your network to point at this new device for whatever you need it for.
If you simply want to use it at-will for certain things, you can put a proxy on it.
As to your other issues, it sounds like your WG connection is just dropping, in which case it won’t automatically reconnect by default. OpenWRT has plugins that can monitor that and reconnect when it drops, or you can script it pretty quickly as well.
deleted by creator
You will need to set up IP masquerading.
The default gateway for the new device needs to be your existing router in order to get to the internet. Then when you create a new WG connection, you ensure all traffic that gets passed to this new device forwards through the Wire guard tunnel.
PC > WG-router > existing-router > internet
deleted by creator
I have two routers set up like this. The untrusted ISP router is plugged into the wall with untrusted devices (e.g., work laptops, guest devices) connected to it. Its IP is 192.168.20.1 and untrusted devices use that IP as gateway.
Then there’s a trusted router that trusted devices connect to with IP 192.168.1.1. I have it connected to the untrusted router’s wifi as WAN but you could also just connect its physical WAN port to an untrusted router LAN port. Trusted devices uses 192.168.1.1 as their gateway and the trusted router tunnels all connections over the untrusted router to the VPN provider.
Only the trusted router needs Wireguard. The trusted devices think they are just on a regular LAN, which keeps their configuration simpler.
Pretty much got it. Any other static routes you setup will be static to the new router only, but otherwise that’s pretty much it. Devices with static IPs don’t participate in DHCP, so it won’t cause a conflict. Just make sure DHCP is disabled on the new device.
No particular experience with the VPN issue so feel free to completely ignore this idea, but if you do have to stick with something resembling your current solution it could make sense to put it in a VM or container so that the process of rebuilding it is not so burdensome.
If you can run WireGuard on all your devices, you may wanna set up a multihop node that forward outbound traffic to the VPN tunnel via that hub
