[fawkesguy]

Hello everyone,



I'm running DD-WRT on x86 hardware (v24-sp2 (03/19/12) std (SVN revision 18777). OpenVPN is configured and connects to my VPN provider without issue. Here's what I'm trying to achieve:



All devices on my network go through my DD-WRT router. Let's say I want one device on my network to bypass the VPN. If I put 192.168.1.100 in the "Policy Based Routing" box on the OpenVPN configuration screen, that IP bypasses the VPN, as it should.



What I would like to do is set it up so if the VPN goes down, all VPN traffic will stop, while still allowing the non-VPN traffic through the router. Here is what I have in my firewall:



iptables -I FORWARD -i br0 -o tun1 -j ACCEPT
iptables -I FORWARD -i tun1 -o br0 -j ACCEPT
iptables -I INPUT -i tun1 -j REJECT
iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE


Now, if I add the rule " iptables -I FORWARD -i br0 -o eth0 -j DROP" that will stop all traffic that is non-VPN. That would be fine if I didn't want a few devices to bypass the VPN. If I use that rule, the IP address I add in the "Policy Based Routing" box is blocked.

What rules do I need to set to allow traffic to bypass the VPN and stay up if the VPN drops, but that will also block the other clients on my network if the VPN drops?



I hope that makes sense. Any help would be greatly appreciated.



Thank you!

[Sash]

upgrade 1st.
2nd wiki: openvpn for general info

and u want to do something like

[fawkesguy]

Sash,

"iptables -I FORWARD ! -o tun1 -s IP -j DROP"

That was very helpful, thank you.

[luba]

[netguru76]

Hi,

pls help, because i think i made a big mistake.

To block all NON - VPN (tun0) traffic i should use

"iptables -I FORWARD ! -o tun0 -j DROP"

, right ?

I used this line (network range LAN):

"iptables -I FORWARD ! -o tun0 -s 192.168.178.0/24 -j DROP"

thinking this should be the right command to say that my complete network should only use tun0 or nothing.

reading this thread again lets me know, that this is a big mistake? so my complete network is filterd and able to use other routes than tun0???

Is that right?

[mirazmac]

I also faced the same problem. But neer got any solution

[Sash]

ddwrt always listens on the emergency ip

[Matlock]

Hey everyone- found this thread and it's certainly helpful but my setup is slighlty different in that I am leveraging policy based routing to forward only certain devices/ip addresses through the vpn tunnel and the rest of my network bypasses the vpn using my isp.

What would the command look like for this setup?

Thanks for the help
Matlock

[outernational]

192.168.1.50 is a device which I don't care if it goes thru the VPN or not. In fact I'd rather have it not go thru the VPN at all (reducing the processing load on the router), so whatever is easier:

A) 192.168.1.50 doesn't go thru VPN & all other IPs lose WAN connection when the VPN disconnects/drops*

OR

B) 192.168.1.50 goes thru VPN but remains connected when the VPN disconnects/drops* & all other IPs lose WAN connection when the VPN disconnects/drops*

*for whatever reason

I tried to save this as a firewall command

[jeanericblass]

However i got the solution after reading your problem from vpnranks articles.

[cbarrett]

I am using the iptables rule suggested in this thread as follows to block traffic not traveling through the VPN.

[Biycchu]

Thank for this info