It is possible using what is called source based routing / policy based routing.
In a nutshell you need to create a second routing table on Server 1, where you set Server 2 as the default gateway.
I assume you are running a Linux distribution on the server and using the iproute2 package.
In that case you will have the file /etc/iproute2/rt_tables.
The content of the file will be something similar to this:
#
# reserved values
#
255 local
254 main
253 default
0 unspec
#
# local
#
#1 inr.ruhep
This file ties into the command: ip rules show, that can give output like:
lasse@vps3:~$ ip rule show
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
The number in front of the rules depicts priority. The lower the number the more important is the rule.
The table local contains a list of all subnets that are directly connected to the server.
So by following the logic of ip rule show it litterally says:
"No matter where the package originates from:
1st check if the destination address a local address (aka directly connected to server).
2nd is the destination subnet listed in the
main routing table.
If all else fails check the default routing table (aka use the default gateway).
In other words we decide where a ip package has to go based on the destination address of the ip package.
Note though I have seen that the default route is being added to the main routing table, but it really shouldn't, since that rule belongs in the default routing table. The reason will be apparent further down.
--
In contrast to this we have source based routing (also know as policy based routing).
Here we decide where a package has to go, based on where the ip package originated.
Fortunately it isn't hard to implement.
In /etc/iproute2/rt_tables we need to add another entry like:
200 vpn
We can then call ip rule with the command:
ip rule add from all to 0.0.0.0/0 iif wg0 lookup vpn
What this command does is telling Server 1 that it has to use the vpn routing table for all traffic using the inbound interface wg0 and going to anywhere else.
The command ip rule show should now show:
lasse@vps3:~$ ip rule show
0: from all lookup local
32765: from all to 0.0.0.0/0 iif wg0 lookup vpn
32766: from all lookup main
32767: from all lookup default
But the vpn routing table is empty, so we do not know how to forward the packages. Therefore let us do just that.
If we assume the VPN ip of the Mulvad gateway is 10.67.221.1 then you just need to call the command
ip route add default via 10.67.221.1 table vpn
And that is basically it, since any packages going from the client to the internet will be matched against the vpn table, while any ip package originating from Mulvad connection will be matched against the local and main routing table.
However:
If you want to use want to use the VPN connection to connect to the network behind Your device you will need to add a static route to the vpn routing table and most likely also add the same rule to the main routing table.
The syntax is simple since it is just a slight expansion on the ip route add command. In essence you just need to add the table vpn to the end of the statement to add it to the VPN routing table and table main if you want to add it to the main routing table.
See my add default route above for example.
I hope this helps to get you started.
