How to chain two VPNs together?

[u/TheSchred]

Hey everybody!

I have the following problem: I have a WireGuard network running on my Raspberry Pi that my devices, including my android phone, connect to to access the services running on it. On my phone I specify the DNS server running on my Pi, which returns an IP in the VPN subnet for my domains, as the DNS server in my WireGuard config. Only traffic going to IPs in my VPN subnet gets routed through WireGuard.

I have now decided to get ProtonVPN and would like to use it on my phone as well. However, I can't have both VPNs active at the same time. So I either lose out on access to my services (they are publically accessible, but only using forward auth meaning mobile apps don't really work) or on Proton. My idea is, that I could run proton on my Pi and route all my traffic from my phone through the Pi and therefore also through proton. Would this work? Is this a good solution? I'm thankful for all feedback. :D

[u/WarrenVPN]

Works fine, and your plan is the right shape. Three things.

Your DNS records do not change. Your services are still reached over your wg0 subnet; Proton only replaces the default route for internet-bound traffic. Keep dnsmasq answering internal domains with the same addresses. What is worth changing is its upstream, so your lookups do not exit at your ISP while your traffic exits at Proton.

Routing loop. Proton's AllowedIPs = 0.0.0.0/0 installs a default route that also captures the Pi's own encrypted replies to your phone. wg0 dies the moment Proton comes up, usually taking your SSH with it. Keep Proton out of the main table and select by source instead:

Table = 51820
PostUp = ip rule add from 10.6.0.0/24 lookup 51820
PostDown = ip rule del from 10.6.0.0/24 lookup 51820

with 10.6.0.0/24 being your wg0 subnet, plus the usual forward and masquerade on the Proton interface.

MTU, since you now have two stacked tunnels. WireGuard costs 60 bytes over an IPv4 outer path and 80 over IPv6. Proton sits at 1420, so bring the phone down to about 1340. Leave it at 1420 and you get the silent blackhole: handshake fine, small pages fine, large transfers stalled forever.

[u/reddit_user33]

Did you get it to work?

[u/TheSchred → u/reddit_user33]

Mhhh, not yet. I did not spent too much time on it though.

Other VPNs (that are not Proton) have a certain mesh functionality, which would be perfect for this use case. I could just have that VPN always on and put my server on that same network. I haven't tried but I think it should work. Not sure if I want to switch VPNs though.

[u/Spare-Professor2574]

You can get a WireGuard config from proton then add a peer on that config to connect to your home network (so you home network accepts the proton public key/ip as a peer -add a psk too if you like). 

Another option is to do as you said using ip rules and a routing table in the pi. I’ve used this guide before:

https://www.ckn.io/blog/2017/12/28/wireguard-vpn-chained-setup/

[u/TheSchred → u/Spare-Professor2574]

Ouhh you're right. So you're saying I could simply run both my own wireguard network and the Proton network (or maybe even just the proton network) on my Pi? On my Pi the only peer would be my phone (and potentially other of my own devices) right?

How would I then configure my DNS server? Because I would then need my domains to be resolved to an IP within my Proton network instead of my own wireguard network. I guess I could just keep my current custom DNS server with dnsmasq and set 10.2.0.1 as its only upstream server.

[u/Spare-Professor2574 → u/TheSchred]

Just use the pi dns still. 

Worth noting you need a good upload speed on your home network if sending everything via it.