VPN based on addresses requested, or other solutions please!

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2
Author Message
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Wed May 06, 2009 0:29    Post subject: Reply with quote
Paste the output from iptables -t mangle -vnL FORWARD
_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
Sponsor
j0ly
DD-WRT Novice


Joined: 31 Aug 2008
Posts: 29

PostPosted: Wed May 06, 2009 0:41    Post subject: Reply with quote
Code:
root@neighbornet2:~# iptables -t mangle -vnL FORWARD
Chain FORWARD (policy ACCEPT 1845 packets, 316K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  209 64737 IMQ        0    --  vlan1  *       0.0.0.0/0            0.0.0.0/0           IMQ: todev 0
root@neighbornet2:~#
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Wed May 06, 2009 0:56    Post subject: Reply with quote
The rules are there, be sure to do it through telnet while testing. There's also a slight change needed to the rules.

iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE
iptables -t mangle -A FORWARD -j ROUTE --oif eth1 --continue
iptables -t mangle -I FORWARD -d hulu.com -j ROUTE --oif tun0

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
j0ly
DD-WRT Novice


Joined: 31 Aug 2008
Posts: 29

PostPosted: Wed May 06, 2009 1:11    Post subject: Reply with quote
Still seems to be the same. ipchicken.com shows the vpn ip, as well as utrace.de


Code:
root@neighbornet2:~# iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE
root@neighbornet2:~# iptables -t mangle -A FORWARD -j ROUTE --oif eth1 --continu
e
root@neighbornet2:~# iptables -t mangle -I FORWARD -d hulu.com -j ROUTE --oif tu
n0
root@neighbornet2:~# iptables -t mangle -vnL FORWARD
Chain FORWARD (policy ACCEPT 22944 packets, 8606K bytes)
 pkts bytes target     prot opt in     out     source               destination         
   55  8817 IMQ        0    --  vlan1  *       0.0.0.0/0            0.0.0.0/0           IMQ: todev 0
root@neighbornet2:~#
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Wed May 06, 2009 1:49    Post subject: Reply with quote
The rules are still missing. What build are you using? (please don't say you've ignored my sig this entire time)
_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
j0ly
DD-WRT Novice


Joined: 31 Aug 2008
Posts: 29

PostPosted: Wed May 06, 2009 4:06    Post subject: Reply with quote
Firmware: DD-WRT v24-sp2 (04/30/09) vpn,

I just updated to this version now, and it looks like it corrected alot of the issues with the iptables not showing up properly.

However, that being said, it is still not working.

If i use the command
Code:
iptables -A POSTROUTING -t nat -o tun0 -j MASQUERADE

I am able to get outbound, none ofthe previously suggested commands seem to work for any traffic. They all go through the VPN and do not display in my browser (ie, if I traceroute to say google while telnet'd in to the router, it shows it going through witopia).

The commands do now show up in the command

Code:
iptables -t mangle -vnL FORWARD

Code:

root@DD-WRT:~# iptables -t mangle -vnL FORWARD
Chain FORWARD (policy ACCEPT 320 packets, 42855 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ROUTE      0    --  *      *       0.0.0.0/0            216.207.68.32       ROUTE oif:tun0
    0     0 ROUTE      0    --  *      *       0.0.0.0/0            216.207.68.82       ROUTE oif:tun0
   81  9350 ROUTE      0    --  *      *       0.0.0.0/0            0.0.0.0/0           ROUTE oif:eth1 continue
   74  8970 ROUTE      0    --  *      *       0.0.0.0/0            0.0.0.0/0           ROUTE oif:eth1 continue
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Wed May 06, 2009 5:04    Post subject: Reply with quote
Try this to stop the vpn traffic. There's going to be further trouble later on because hulu has distributed content servers and every nslookup for hulu.com returns a different address...

iptables -t mangle -A POSTROUTING -j ROUTE --oif eth1 --continue

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
uncle bob
DD-WRT User


Joined: 31 Aug 2008
Posts: 148

PostPosted: Wed May 06, 2009 15:52    Post subject: Reply with quote
you should use routing based on source ip for what you trying achieve because when Apple finds some part of traffic goes thru US IP other part thru Canadian they will likely notify your financial institution and problems will start. Google for ip rule from ip ... sth like that

Other thing is your VPN provider Witopia is not good for the objective either because they set reverse dns with their name. So even if you set source based routing Apple or whatever other picky party very likely will notify xyz to check on you. AFAIK Witopia anonymizes all traffic and will not give your identity without court order. Of course this very fine for some other applications but not if you purchase movies from Apple trust me.
j0ly
DD-WRT Novice


Joined: 31 Aug 2008
Posts: 29

PostPosted: Thu May 07, 2009 2:42    Post subject: Reply with quote
phuzi0n,

The last command freezes up the router completely after entering it.

Just to recap, I am using the following commands, entered via telnet after the VPN is setup on the router through the services/vpn tab.

Code:
iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE
iptables -t mangle -A FORWARD -j ROUTE --oif eth1 --continue
iptables -t mangle -I FORWARD -d hulu.com -j ROUTE --oif tun0


and when i enter the last suggested line, that kills my router.

Code:
iptables -t mangle -A POSTROUTING -j ROUTE --oif eth1 --continue
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Thu May 07, 2009 4:15    Post subject: Reply with quote
Yeah, I learned of some problems with the route target and masquerading so this probably isn't a good way to go about it. Somewhere in your vpn configuration you set the vpn as your gateway, you ought to start by undoing that. After that you can try the rule to route for hulu through the tunnel but since their dns is wacky you'll have to track down all their ip's.
_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
neilio
DD-WRT Novice


Joined: 24 Jun 2009
Posts: 7

PostPosted: Wed Jun 24, 2009 14:52    Post subject: Reply with quote
I would *love* to get this working, either via the IP / server that is being accessed, or by the local machine that's making the request.

I've got Witopia working just great on the router for all traffic, but have no idea where to start to get this working just for a select # of servers or for a specific machine on my network.

Anyone?
Goto page Previous  1, 2 Display posts from previous:    Page 2 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum