VPN Configuration

HI,

Corner-case question.

I have an Inseego MiFi hotspot acting as my internet - USB WAN tethered to the Surf Soho. Internet service is through Calyx via T-mobile.

I have an Open VPN client on the soho to get around video throttling on TMo (paid ProtonVPN service).

All household TVs/streaming devices are on an isolated VLAN (IOT) that uses the proton VPN over the USB WAN.

I run Zwift on AppleTV (over the VPN). There is a Zwift “companion” application that runs on my Android phone - which allows you to perform certain actions in Zwift - but the phone MUST be on the same network/SSID as the AppleTV device.

If I created the following outbound policy - would this allow my Android to communicate with the AppleTV without going over the VPN? And force all other traffic (to streaming services etc) over the VPN? Logic being if on IOT VLAN and destination is on same 192.168.53.0 subnet, go over USB WAN; if IOT VLAN to any other destination, go over VPN.

If not - any other workaround?

This won’t work as what you are saying is push any traffic which has a destination of 192.168.53.0/24 to out of the USB WAN and on to the internet.
What you need to do is have the phone on the same vlan (I am assuming that they need to be on the same L2 network) as the apple tv but assign it an ip address (via the client list) so that you know its IP address. Then configure an outbound policy for the phone which pushes all traffic from its source IP (192.168.53.X) to the USB wan.
The phone being on the same subnet as the apple tv will allow the app to interact as needed while the internet traffic will use different exit points.

This won’t work as what you are saying is push any traffic which has a destination of 192.168.53.0/24 to out of the USB WAN and on to the internet.
What you need to do is have the phone on the same vlan (I am assuming that they need to be on the same L2 network) as the apple tv but assign it an ip address (via the client list) so that you know its IP address. Then configure an outbound policy for the phone which pushes all traffic from its source IP (192.168.53.X) to the USB wan.
The phone being on the same subnet as the apple tv will allow the app to interact as needed while the internet traffic will use different exit points.

Appreciate the response. I’ll give that a shot…