Page MenuHomeVyOS Platform

Routing networks through multiple wireguard tunnels not properly working when using WAN load balancing
Open, LowPublic

Description

Example scenario for an IPv4 only case:
3 VyOS machines are being connected together in a star-topology manner, called VyOS1, VyOS2 and VyOS3, so that VyOS2 lies in between the two others which do not have a direct tunnel connection to eachother.
For simplicity, static routes are being used to enable traffic exchange between clients behind VyOS1 and VyOS3 for source and destination IP ranges, as well as the wireguard tunnel ranges.

So the traffic is being sent in the following manner, e.g. using an ICMP command:
[Client]<-LAN->[VyOS1]<-wg->[VyOS2]<-wg->[VyOS3]<-LAN->[Client]
This works flawlessly in both directions when using NAT with any given WAN interface on VyOS1 and VyOS3.

It does not work when using a wan load balance configuration on VyOS1 and VyOS3 (not tested if problem occurs when only one of those two use a load balancer)

What does work:
[VyOS1]<-wg->[VyOS2]<-wg->[VyOS3]

and one-way: [VyOS1]<-wg->[VyOS2]<-wg->[VyOS3]<-LAN->[Client]
or [Client]<-LAN->[VyOS1]<-wg->[VyOS2]<-wg->[VyOS3]
when initiating the traffic from a VyOS router but NOT from a client.

It seems that the dynamic NAT Table used from the WAN load balancer does not apply the proper routing when tunneling into WireGuard tunnels.

Using

set load-balancing wan sticky-connections inbound

and

set load-balancing wan rule <rulenumber> failover

does not help.

Details

Difficulty level
Unknown (require assessment)
Version
1.4.0 epa3
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

Provide the full (minimal) set of commands to reproduce.