OpenWrt Multi-WAN with mwan3-nft: Requirements and Preparation

Multi-WAN allows a router to use several Internet connections for load balancing or failover. On newer OpenWrt releases, mwan3-nft is the nftables-compatible branch, but several requirements must be checked before installation.¹

Version requirements

The OpenWrt documentation currently states that the nftables version of mwan3 is supported only on OpenWrt 25.12 or newer. Although OpenWrt has used firewall4 and nftables since 22.03, compatibility with older releases has not been verified.¹

Check the installed version first:

1

ubus call system board

On older OpenWrt releases, follow the documentation for the matching mwan3 branch instead of mixing packages and configurations from different firewall generations.

Prepare the WAN connections

Each WAN must work independently before policy routing is introduced:

1. Create the required WAN interfaces.
2. Configure VLANs if the modem or ISP requires a VLAN ID.
3. Set different metrics for the WAN interfaces.
4. Verify that each WAN receives an address and reaches the Internet independently.
5. Confirm that the default routing table contains valid routes.

A VLAN-capable router is recommended because LAN ports can be reassigned as WAN ports or multiple connections can be separated on the same physical infrastructure.¹

Installation requires caution

The current documentation says that mwan3-nft is not yet in the official package feeds. Installation may require manually obtaining an APK package from a release. This is different from installing the regular mwan3 package through the normal package interface.

Do not run an unverified installation script. Check the release, verify the router architecture, and keep console access available in case the package interrupts networking.

If an image builder automatically installs a package named mwan3, it may install the older iptables version. Do not accidentally include that package in an image when the nftables branch is intended; install and verify the correct package after booting.

Configuration concepts

mwan3-nft classifies packets with firewall marks and uses policy-routing rules and separate routing tables for the selected interfaces. The main components are:

• Interface: describes each WAN and its health checks.
• Member: combines an interface with a metric or weight.
• Policy: selects one WAN, balances several WANs, or provides failover.
• Rule: determines which traffic uses a policy.
• IP set: groups destination addresses when a policy needs to match them.

For simple failover, start with one policy containing a primary and backup WAN. Add load balancing or split tunneling only after the basic path is stable.

Test before applying real traffic rules

Before sending production traffic through a new policy:

1
2
3

ip rule show
ip route show table all
logread -e mwan3

Use a LAN client to check the public IP, DNS, and data transfer. Temporarily disconnect the primary WAN to confirm that traffic moves to the backup connection.

A router still responding to ping is not enough. Also check active connections, DNS, internal services, and recovery when the primary WAN returns.

Keep internal traffic on the correct path

LAN networks, homelab servers, Proxmox, OpenHAB, and management services should normally not be sent through a WAN policy. Internal-network rules must be evaluated before rules that select a WAN.

Record internal subnets, gateways, and rule priority before enabling load balancing. A syntactically valid rule in the wrong order can block access to the router or LAN services.

Experimental-status note

The OpenWrt documentation says that the nftables branch still needs testing feedback before it is included in the official feed. Treat mwan3-nft as a component that needs careful validation, not as a universal package for every router.

Back up the configuration, keep physical or UART access available for important devices, and record the package version so that rollback is possible.

Conclusion

OpenWrt Multi-WAN can provide failover, load balancing, and policy-based routing. The difficult parts are preparing each WAN and keeping internal traffic from being routed incorrectly. With mwan3-nft, pay particular attention to the OpenWrt 25.12+ requirement and the fact that the package is not yet in the official feed.

Official source