Hello all!
I’ve got a VPN bridge project I’m trying to get working and could use some expert eyes.
Network setup:
- Raspberry Pi 5 (DietPi, fresh install)
- Two NICs:
- Onboard 1GbE (eth0, Port #4, static IP: 172.22.10.2)
- Realtek 5GbE USB (eth1, SFP+ Port #6, static IP: 172.22.10.3)
- UniFi Cloud Gateway Fiber: 172.22.10.1
I would like:
ALL traffic from my network (172.22.10.0/24) on the UCG-Fiber is policy routed (PBR) to the Pi’s eth1. The Pi should then VPN (WireGuard to IVPN) that traffic and send it back to the UCG-Fiber for WAN routing.
In short:
- eth0 = LAN/management/Samba only
- eth1 = dedicated VPN bridge for traffic from PBR
- NO cross-talk, failover, or interface “auto-helpfulness” by Linux. Each interface should be completely independent.
The issue:
I set up a basic Samba share on the Pi and mount \172.22.10.2\Richard in Windows. When transferring files, I get 2.5Gbps speeds—even though eth0 is 1GbE.
Turns out, Linux is routing SMB traffic across whatever NIC is available, not just eth0 (even though I’m specifying the eth0 IP).
Here’s what I’ve tried:
- Set interface metrics: eth0 lower (higher priority), eth1 higher (lower priority), and also tested removing the gateway from eth1.
- Tried explicitly setting the “Local” IP in the WireGuard config to 172.22.10.3, hoping it would force WireGuard to only use eth1.
- Still, WireGuard refuses to connect (0 KB received, 1 KB sent), and
curl ifconfig.mealways returns my public IP (not the VPN). - My goal is:
- eth0 = all DietPi/Samba/management/software traffic
- eth1 = only VPN traffic, only what comes from UCG-Fiber PBR
- No automatic failover or route leaking between interfaces.
I need help with:
How do I absolutely segregate eth0 and eth1 so eth1 is a pure VPN bridge, and eth0 is used for everything else? Is this possible in DietPi? What am I missing with routing, policy, or iptables/nftables?
I eventually want to aggregate 2-3 WireGuard connections, but for now just want to get a single connection working as proof-of-concept.
Other info:
- No VLANs, no fancy firewall rules
- NextDNS CLI for DNS on UCG-Fiber
- Tried advanced ip rule/ip route policy routing: Custom tables to force specific traffic via eth1 without success.
This is what I have in my /etc/network/interfaces:
# Drop-in configs
source interfaces.d/*
# Ethernet eth0 (primary)
allow-hotplug eth0
iface eth0 inet dhcp
metric 100
# Ethernet eth1 (Realtek USB, secondary, ISOLATED)
allow-hotplug eth1
iface eth1 inet static
address 172.22.10.3
netmask 255.255.255.0
# WiFi (disabled by default)
#iface wlan0 inet dhcp
# address 192.168.0.100
# netmask 255.255.255.0
# gateway 192.168.0.1
# dns-nameservers 9.9.9.9 149.112.112.112
# wireless-power off
# wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
root@DietPi:~# ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 2c:cf:67:3a:a2:61 brd ff:ff:ff:ff:ff:ff
inet 172.22.10.2/24 brd 172.22.10.255 scope global dynamic eth0
valid_lft 24634sec preferred_lft 24634sec
root@DietPi:~# ip addr show eth1
5: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:e0:4c:56:15:63 brd ff:ff:ff:ff:ff:ff
inet 172.22.10.3/24 brd 172.22.10.255 scope global eth1
valid_lft forever preferred_lft forever
root@DietPi:~# ip route
default via 172.22.10.1 dev eth0 metric 100
172.22.10.0/24 dev eth1 proto kernel scope link src 172.22.10.3
172.22.10.0/24 dev eth0 proto kernel scope link src 172.22.10.2
185.XXX.XX.41 dev eth1 scope link src 172.22.10.3
root@DietPi:~# ip rule
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
Any tips and tricks will be super appreciated!
Thanks in advance!