VPN Cascading and Multi-VPN Routing Support in WireGuard WebAdmin?

[KianBrown1553]

What I'm Trying to Achieve

Hey there, I'm hoping to get some help with a specific setup using WireGuard WebAdmin. My main goal is to create a VPN cascade where traffic flows like this:
User > My VPS (running WireGuard WebAdmin) > A second VPN connection (e.g., a commercial VPN service like ProtonVPN or others) > The Internet.

https://docs.gl-inet.com/router/en/4/tutorials/how_to_use_vpn_cascading_on_glinet_routers/
Here is what I want to achieve.

Basically, I want users to connect to my VPS via WireGuard, and then have their traffic routed through another VPN service for extra privacy, geolocation spoofing, or other benefits. On top of that, I’d love to know if I can set up multiple external VPNs (e.g., ProtonVPN, NordVPN, or any commercial provider) and route traffic through them based on specific rules. For example, I might want some users’ traffic to go through ProtonVPN, others through NordVPN, or even bypass the second VPN entirely, depending on conditions like user IP or destination.

What I Need Help With

I’m not sure how to make this work with WireGuard WebAdmin, so I’m reaching out to see if you can point me in the right direction. Here’s what I’m hoping to figure out:

How to set up a second WireGuard interface (let’s call it wg1) on my VPS to connect to a commercial VPN provider (e.g., using ProtonVPN’s WireGuard config or similar).

How to route traffic from my main WireGuard interface (where users connect) through this second interface (wg1) so it hits the external VPN before going out to the internet.

Whether it’s possible to configure multiple external VPNs (e.g., one interface for ProtonVPN, another for NordVPN) and create rules to decide which traffic goes through which VPN. For instance, routing based on user IP, destination domain, or even a manual toggle in the WebAdmin interface.

Any firewall rules, NAT settings, or other tweaks needed to make this setup reliable and secure.

If WireGuard WebAdmin doesn’t currently support managing multiple interfaces or custom routing rules like this, I’d love to know if it’s something that could be added down the line. It’d be awesome to have a UI where I can manage these VPN connections and set routing policies easily.

My Setup and Context

VPS Environment: I’m running a Linux VPS (Ubuntu) with WireGuard WebAdmin installed.

Why I Want This: I’m trying to build a flexible VPN setup where I can chain my VPS with commercial VPNs for privacy or to access region-locked content. The ability to choose different VPNs based on rules would make it super versatile.

My Skill Level: Total noob (Had to get chat GPT to help me write this.)

Thank you for taking your time to read this :)

[eduardogsilva]

Hello @KianBrown1553

Sure you can use wireguard_webadmin as your primary WireGuard server and route all client traffic through an external VPN (or multiple VPNs) on the host. The key change is that, instead of merely binding SSH/WebAdmin/WG ports to your public interface, you should use source‑based policy routing so replies to those services never go out via the VPN.

Key Steps

1. Install wireguard_webadmin

   • Deploy via docker-compose as usual. This sets up your main interface wg0 for client connections.

2. Connect the Host to an External VPN

   • Configure your VPS’s VPN client (e.g., ProtonVPN) so the host’s default route points through that tunnel.
   • Add a killswitch to block all other outbound traffic if the VPN goes down (suggestion).

3. Keep Management Services and wireguard service Reachable with Source‑based Policy Routing
   You will need to setup a source based routing policy

4. (Optional) Multiple External VPNs

   • Create extra WireGuard interfaces (e.g. wg1, wg2) for each provider.
   • Use policy routing or packet‑marking rules to send selected client traffic into the desired external tunnel.

Final Tips

• Test management access (SSH, WebAdmin, wg0) after putting the VPN and policy routing in place.
• Keep a console‑based fallback ready in case of misconfiguration.
• Document the ip rule/ip route commands so other users can reproduce the setup.

Cheers!!

[KianBrown1553]

Thank you for the response!

Could you please give me a basic setup for option2? How would I go about "Configure your VPS’s VPN client (e.g., ProtonVPN) so the host’s default route points through that tunnel."

And for step 3 how would I be able to connect to my VPS after i run ProtonVPN on the server.
As this will then make the public IP the proton IP. So I I will lose ssh access in turn also the web panel.

IS there a simple way to route all traffic from the docker container to wg1 for example on the host VPS? As i don't know how i would go about doing that.

Thank you once again :) PS I'm really bad at explaining clearly what my goals are.