WireGuard/IPSec Server appears to bind to primary WAN only — no way to select interface on dual-WAN setups

Routers
1

Hi all,

I have a Route10 with two active WAN interfaces (WAN1 physical port, largely idle, and WAN2 carrying my actual internet connection via a custom VLAN interface). When I configured the WireGuard Remote User VPN Server (Control → VPN tab, following the standard help article), the client always sent handshake-initiation packets correctly, but never received any response — from both LAN and external networks, with the server, firewall rule (UDP/51820, zone WAN), and DDNS endpoint all verified correct multiple times.

After extensive troubleshooting, my working theory is that the WireGuard server binds to whatever Control considers the “primary” WAN interface (network.wan), rather than to the interface that’s actually carrying the public IP and internet traffic (wan2 in my case). Since the Route10 explicitly supports Multi-WAN, it seems like a real gap that VPN services (WireGuard, and presumably IPSec/L2TP too) don’t offer a way to pick which WAN interface they should listen on.

Has anyone else run a VPN server successfully on a secondary/non-primary WAN interface? And is there a UCI-level workaround (e.g. manually rebinding the WireGuard listener to a specific interface) that doesn’t get wiped on reboot/reprovision?

Happy to share full diagnostic details (firewall rules, UCI config, packet captures) if useful — support confirmed this setup is outside their officially supported scope (front-end-only config), so I’m hoping the community has run into this.

Thanks!

2

I believe its because the default ddns hostname points to WAN1, if you put a 0. in front of DDNS hostname, for example 0.‘YourDDNSHostname’.ddns.manage.alta.inc, that will use the primary and will work in a failover condition. I believe you can also use 1. and 2. to specify WAN1 and WAN2 (or it might be something with the interfaces, i don’t remember 100% - hopefully someone can correct me here).