The router is relying solely on "l3mdev-table," while this works for traffic on VRF-bound interfaces, but it doesn't handle the fwmark case where WireGuard's encapsulated packets need to be steered into the correct table.
Sample Config:
vyos@vyos# compare commands set interfaces wireguard wg99 address '172.27.42.2/30' set interfaces wireguard wg99 fwmark '101' set interfaces wireguard wg99 peer CFBOM address '100.96.0.2' set interfaces wireguard wg99 peer CFBOM allowed-ips '0.0.0.0/0' set interfaces wireguard wg99 peer CFBOM port '10006' set interfaces wireguard wg99 peer CFBOM public-key 'XXXXXXXXXX' set interfaces wireguard wg99 port '49501' set interfaces wireguard wg99 private-key 'XXXXXXXXXX' set interfaces wireguard wg99 vrf 'TEST' set vrf name TEST table '101'
vyos@vyos:~$ ip rule show 1000: from all lookup [l3mdev-table] 2000: from all lookup [l3mdev-table] unreachable 32765: from all lookup local 32766: from all lookup main 32767: from all lookup default vyos@vyos:~$ cat /etc/iproute2/rt_tables.d/vyos-vrf.conf ### Autogenerated by vrf.py ### # # Routing table ID to name mapping reference # id vrf name comment
This causes the router to ignore the fwmark command in wireguard, leading the traffic to go through the default vrf table:
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes 20:53:49.130739 bond1 Out IP 172.20.178.3.49501 > 100.96.0.2.10006: UDP, length 92 20:53:49.130743 eth4 Out IP 172.20.178.3.49501 > 100.96.0.2.10006: UDP, length 92 20:53:54.250435 bond1 Out IP 172.20.178.3.49501 > 100.96.0.2.10006: UDP, length 92 20:53:54.250440 eth4 Out IP 172.20.178.3.49501 > 100.96.0.2.10006: UDP, length 92 20:54:00.010271 bond1 Out IP 172.20.178.3.49501 > 100.96.0.2.10006: UDP, length 92 20:54:00.010275 eth4 Out IP 172.20.178.3.49501 > 100.96.0.2.10006: UDP, length 92 20:54:05.050433 bond1 Out IP 172.20.178.3.49501 > 100.96.0.2.10006: UDP, length 92 20:54:05.050437 eth4 Out IP 172.20.178.3.49501 > 100.96.0.2.10006: UDP, length 92 20:54:10.262267 bond1 Out IP 172.20.178.3.49501 > 100.96.0.2.10006: UDP, length 92 20:54:10.262271 eth4 Out IP 172.20.178.3.49501 > 100.96.0.2.10006: UDP, length 92
Workaround, if I have to make the above config work:
sudo ip rule add fwmark 0x65 table 101 priority 1998
Build:
vyos@vyos:~$ show version Version: VyOS 1.5.0 Release train: circinus Release flavor: kvm Built by: VyOS Inc. Built on: Mon 30 Mar 2026 15:13 UTC Build UUID: 8fc890cf-a392-4c1b-a7a2-700d311cd0c7 Build commit ID: cb47cdb72c6d08