Suppose I have two servers, gateway which is publicly visible to the internet and appserver which is hidden behind a nat/firewall. Also suppose that each of these two servers has two interfaces connected to entirely separate internet uplinks (see diagram bellow).
I want to set up two independent Wireguard tunnels between the two servers with the goal of keeping the servers connected if one of them fails:
| Internet |
[ gateway ] | | [appserver]
| |
(wg0) <-----> (ens1) < - - - - > (ens1) <----> (wg0)
| |
| |
| |
(wg1) <-----> (ens2) < - - - - > (ens2) <----> (wg1)
| |
| |
By default, Wireguard seems to route all traffic through the system's default gateway. So when appserver attempts to connect to gateway, it only uses one of the two interfaces:
| Internet |
[ gateway ] | | [appserver]
| |
(wg0) <--+--> (ens1) < - - - - > (ens1) <--+--> (wg0)
| | | |
| | | |
| | | |
(wg1) <--+ (ens2) X (ens2) +--> (wg1)
| |
| |
Since some network tools allow setting a specific network interface to use when sending network traffic, can Wireguard also do the same thing? That is, only send traffic over ens1 or ens2 regardless of default route metrics? If not, how can I set up Linux's networking systems to do this instead?
