Nov 9, 2026, 3:45 PM

I'm now using a separate, secondary WireGuard tunnel to connect one of my machines to my personal VPN. This secondary tunnel uses a cellular connection instead of the main LAN interface.

To do that, we need some policy routing. I've added

FwMark = 0x02000000

(arbitrary number really) to the wg-quick config, then something like in the screenshot to the Netplan config.

And that's it!

#WireGuard #Netplan #iproute2 #Linux #PolicyRouting

Screenshot of YAML code:

congstar:
set-name: congstar
match:
macaddress: ac:00:33:11:22:33
dhcp4: true
dhcp6: true
# Don't use this as our main uplink.
dhcp4-overrides:
route-metric: 150
dhcp6-overrides:
route-metric: 150
# Use this as the default route for some packets only.
routes:
- to: default
via: 192.168.125.1
metric: 80
table: 33554432 # aka sec-uplink-1 (0x02000000); Netplan doesn't support hex values
routing-policy:
- to: 0.0.0.0/0 # Netplan requires this to be set
mark: 33554432 # If we match this mark …
table: 33554432 # … look up routing in this table.