Selfhosted

If you use an app like RethinkDNS, it will allow you to run multiple, simultaneous VPN connections and then choose how you want to route your traffic.

I have the same situation as you. I run two VPN connections. One to home and one to a VPS. I route all traffic to 10/8 to the home VPN, certain apps to my VPS VPN and then the rest of the traffic via the local connection.

RethinkDNS also does local DNS filtering and allows you to specify which DNS service to use. I run my own DoT service that backs off to the PiHole at home.

I have done what you are looking for on OPNsense. And I'm pretty sure it can also be done with OpenWRT.

You will need to setup multi WAN and setup some static routes and use your RoadWarrior setup.

Aka you want this:

Phone › Via Wireguard › OpenWRT › Via Wireguard › VPN provider

I don't have a guide on how to do it but I will try to find one and update this comment if I do. But here are some Guides that might help you in creating it!

Multi WAN Guide

MullvadVPNs OpenWRT Guide for Wireguard (Should work with other providers)

OpenWRT Wireguard Guides

I'm also including the guide to setup Roadwarrior & External VPN provider for OPNsense so you can get a idea of how it should be done and work

OPNsense guide I used to create my Wireguard WAN

OPNsense guide I also used for Wireguard WAN

OPNsense Guide I used for my Roadwarior Setup

I have not used such a configuration, but I believe that it's fine to have multiple WireGuard VPNs concurrently up, at least from a Linux client standpoint. I have no idea whether your phone's client permits that

it could well be that it can't do it.

Your routing table would have the default route go to a host on one of them (and your Internet-bound traffic would go there), but you should be able to have it be either. Or neither

I've set up a WireGuard configuration with a Linux client where the default route wasn't over the WireGuard VPN, and only traffic destined for the LAN at the other end of the WireGuard VPN traversed the WireGuard VPN.

From Linux's standpoint, a WireGuard VPN is just like another NIC on the host. You say "all traffic destined for this address range heads out this NIC". Just that the NIC happens to be virtual and to be software that tunnels the traffic.

EDIT:

It sounds like this is an Android OS-level limitation:

https://android.stackexchange.com/questions/261526/are-there-technical-limitation-to-multiple-vpns

In the Android VPN development documentation you can find a clear statement regarding the possibility to have multiple VPNs active at the same time:

There can be only one VPN connection running at the same time. The existing interface is deactivated when a new one is created.

That same page does mention that you can have apps running in different profiles using different VPNs at the same time. That might be an acceptable workaround for you.

I just route everything through my home connection.

I create an work profile in my android phone with Insular app from f-Droid (but there is alternatives from Google play too). And connect tailscale to home server there and put all necessary app here too. Basic profile has commercial VPN with split tunneling per app.

But I check threads and there are better alternatives.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

5 acronyms in this thread; the most compressed thread commented on today has 15 acronyms.

[Thread #225 for this comm, first seen 9th Apr 2026, 08:00] [FAQ] [Full list] [Contact] [Source code]

I use Tailscale with an exit node container that forwards all traffic to the commercial VPN via a wireguard config. This "hopping" solution serves me well enough, and works for Android too.

If you want to simultaneously have two VPN interfaces, you may wanna consult this and this guide. The principle should apply with non-Tailscale wireguards too I think

I am running tailscale to access my homelab and my exit node and I use wireguard protonVPN connection for that exit node. It involved messing with nftables, check this for more info. In theory, you could do the same with two wireguard connections. One connection in and one as an exit. Maybe easier solution would be having these on separate machines/vms. Having the exit vpn on the openWRT as default for all connections and then the connection in on a separate container or vm, and it would exit through the router. I am not sure but I think the wireguard then naturally exits trough the router (gateway).

I‘m using two different setups:

Phone with wireguard app:

• VPN client installed on my router
• WireGuard server Running on Router
• Phone connects to the routers wireguard server and from there my phone is routed through the VPN client for web traffic (but I’m not using OpenWRT so you have to check if this is possible for you)

Laptop with wireguard app and VPN installed as browser extension:

• WireGuard app is configured to only route traffic to my local subnets through the wireguard VPN.
• Web browser is encrypted through the VPN extension.

Really depends on what you need. For me this setup fits my bill.

But there’s also tailscale (which you can also selfhost: headscale)

Additionally you could also set up your own independent wireguard server to get more granular control for routing and firewalling. But you would need a device that’s running 24/7 (same for headscale). A raspberry pi would probably be enough for that.