Selfhosted @lemmy.world Coldus12 @reddthat.com 1y ago

Using another VPN on top of my VPN?

My question is fairly straightforward: I've got wireguard set up on my home network, and I'm really happy with it, but I also got a paid VPN service as well for privacy reasons.

The paid VPN i got is Mozilla VPN (which in theory uses wireguard as well).

My goal would be that I have my own VPN through which I can access my home network, and the paid VPN on top of it, which "forwards" the outbound traffic.

Is there a way to do this? Anyone has any experience with this?

4 comments

It's extremely easy to do if both the server and client are using wireguard. Just add FwMark = 42 to both interfaces (the exact numeric value doesn't matter). This way, internet requests will go through the paid VPN provider and local requests will be working too.

If not, good luck with iptables.
Not too hard to do with wireguard. You have to split traffic, because if you tunnel all traffic to the paid VPN, you can only access it by pointing at the IP address of that paid VPN so it doesn't really help. If youre using firefox VPN, it's just a private labelled Mullvad VPN, so no port forwarding so this wouldn't work at all.

So what you have to do is allow your home machine running the wireguard server you use to connect to your home network accept direct connections from your devices. Then all outbound connections tunnel to your paid VPN. It's a bit convoluted but there are plenty of walkthroughs online as to how to set up your firewall and network rules and wireguard configs to do it. You'll be working with iptables and then traffic splitting with wireguard.
What is this, a low stakes Inception remake?
If you have a router like OPNsense/PFsense (but I think that OpenWRT can do that too, I've never used it) you can forward all your home traffic to Mozilla VPN so that when you connect home with your home VPN you can reach your LAN services and at the same time Internet through Mozilla VPN.

But if you have a routed Android smartphone (or a PC), you should enable both VPN allowing LAN only traffic through your home VPN and all the rest (you can use this to calculate the subnets) through Mozilla VPN.