Origin: a suggestion by forum user jul8mbq9 in the public OpenWrt thread (https://forum.nym.com/t/open-call-bring-nymvpn-to-openwrt/1945/272). An idea, not a bug report.
Ask: run both modes at once on the router. Fast mode (two-hop WireGuard) for everyday traffic, and the mixnet (five-hop) for selected clients or applications that need the extra privacy, such as wallets.
Today the daemon runs one tunnel in one mode for the whole LAN. The existing split-tunnelling controls only decide what leaves the tunnel: the legacy PBR mode, managed exclusions, and inbound exemptions. Nothing routes one LAN client through a different tunnel than another.
Shape of the work, if we take it on:
- two tunnels up at the same time (a WireGuard pair and a mixnet client) with separate tunnel devices and routing tables
- a policy that assigns traffic to a tunnel; on a router the natural key is the LAN client (source address or MAC, or a firewall zone), not the application, which the router cannot see
- kill-switch semantics for both tunnels: a client assigned to the mixnet must not fall back to the fast tunnel when the mixnet is down
- CLI, rpcd and LuCI controls for the assignment, and a status view showing both tunnels
Open questions: whether the daemon can hold a mixnet client and a WireGuard pair concurrently at all, the CPU and memory cost on typical routers, and how a per-client mapping should be expressed in UCI. Per-application selection stays a device-side concern.
Origin: a suggestion by forum user jul8mbq9 in the public OpenWrt thread (https://forum.nym.com/t/open-call-bring-nymvpn-to-openwrt/1945/272). An idea, not a bug report.
Ask: run both modes at once on the router. Fast mode (two-hop WireGuard) for everyday traffic, and the mixnet (five-hop) for selected clients or applications that need the extra privacy, such as wallets.
Today the daemon runs one tunnel in one mode for the whole LAN. The existing split-tunnelling controls only decide what leaves the tunnel: the legacy PBR mode, managed exclusions, and inbound exemptions. Nothing routes one LAN client through a different tunnel than another.
Shape of the work, if we take it on:
Open questions: whether the daemon can hold a mixnet client and a WireGuard pair concurrently at all, the CPU and memory cost on typical routers, and how a per-client mapping should be expressed in UCI. Per-application selection stays a device-side concern.