Multihomed server issue

Wang Jian larkwang at
Thu Aug 3 05:00:51 CEST 2017

2017-08-01 19:28 GMT+08:00 Wang Jian <larkwang at>:
> 2017-08-01 11:06 GMT+08:00 Jason A. Donenfeld <Jason at>:
>> On Tue, Aug 1, 2017 at 4:01 AM, Wang Jian <larkwang at> wrote:
>>> 2017-07-31 23:34 GMT+08:00 Jason A. Donenfeld <Jason at>:
>>>> On Fri, Jul 28, 2017 at 2:51 AM, Wang Jian <larkwang at> wrote:
>>>>> The solution can be one of:
>>>>> 1. server can RTS (response to source), or can bind to arbitary
>>>>> address for outgoing
>>>> The server does already respond to source.
>>> Sorry, I didn't make it clear. By saying RTS, I mean response to
>>> source link, that is,
>>> using called address and incoming link.
>> You're still unclear to me. What?
> Let's say server has multiple interfaces, eth0, eth1, ... ethN, with
> IP0, IP1, ... IPn,
> If an incoming request is to eth1, to IP1, then the server's response
> packet will go out from eth1, and source is IP1.
> In some cases, it can be done using policy routing, but other cases not. I know
> a FreeBSD based VPN implements so called RTS.
> In my case, the server looks like
> eth0 =                    (default route, via
> eth1.100 =         (policy routing: when source address
> is,  route via
> eth1.200 =         (policy routing: when source address
> is,  route via
> dummy0 =
> dummy1 =
> When a wireguard client contacts, the server responses UDP packet
> with source address but not the desired, because
> of default route.
> I have mailed you my network setup privately. Sorry for inconvenience.

I managed to handle this issue for one public address

FwMark = 600
PostUp = ip rule add pref 20000 fwmark 600 table 600; ip route add
table 600 default via src

With this workaround, for a wireguard interface, only one public address can
be used. We do need multiple public addresses for a reason: some clients
connect to one public address while other clients connect to another public

We can use multple wg interfaces to address the limitation. But I do wish that
server can deduce public address which the client connects to, and use the
public address to response to the client, then the configuration will be
simple and straightforward.

More information about the WireGuard mailing list