[scar1943]

Greetings!

Been using dd-wrt and monitoring these forums for years, but its the first time I've become frustrated enough to ask for assistance from you wise folk.

Interesting exploit my sons have found which I really need to resolve. Bear with me for its a somewhat complex situation they've discovered. They have a few video games (mmo online type) that do not work through my vpn router. I set up a non vpn router for those few games which is a simple wifi AP connected directly to the ISP cable modem. Now since the cabled connection which they have through the VPN Modem is far friskier, they would rather use the wired connection vs the WIFI. What they have done is find that if they continue to use the ISP wifi ip address assigned to them, switch back to the wired VPN router (and turning off their WIFI), the traffic then seems to bypass VPN through the router, and they can play via the wired VPN connection using the ISP dhcp address assigned by the ISP. Seems sneaky, or I'm not clearly understanding whats going on under the hood of that bait and switch idea. Does anyone understand whats going on, if so, please help me understand and how it can be blocked (I don't want any non-vpn activity on the vpn router).

This is my current firewall script:

# Nordvpn Killswitch
WAN_IF=`nvram get wan_iface`
iptables -I FORWARD -i br0 -o $WAN_IF -j REJECT --reject-with icmp-host-prohibited
iptables -I FORWARD -i br0 -p tcp -o $WAN_IF -j REJECT --reject-with tcp-reset
iptables -I FORWARD -i br0 -p udp -o $WAN_IF -j REJECT --reject-with udp-reset
# deny all action outside VPN
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -I FORWARD -i br0 -o vlan2 -j DROP
iptables -I INPUT -i tun0 -j REJECT
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

WRT3200ACM older chip set. r37582 OpenVPN via nordvpn provider.

What do you folks think?

[SurprisedItWorks]

Bit of a long shot, but I did just discover, with help from the forum (https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=317397), that the third NordVPN kill-switch firewall rule, the udp one, as written does nothing. If you check the firewall using the CLI, you'll discover that rule did not get entered. The problem is the udp-reset, which apparently is not a thing. A working alternative rule is

iptables -I FORWARD 3 -i br0 -p udp -o $WAN_IF -j REJECT

which is just your rule without the --reject-with udp-reset . As it happens, I just emailed NordVPN support yesterday to notify them of the error in their post on setting up the dd-wrt OpenVPN client for NordVPN using the GUI.

I'll be impressed and amazed if this fixes the problem, but you have nothing to lose.

One option is to use logreject instead of REJECT in that one rule, perhaps temporarily during your testing phase. (You can't use logreject in the others because it's not compatible with the --reject-with thing.) With logreject in the firewall, you can enable Syslogd and Klogd under System Logging on the GUI>Services>Services page and then watch what happens in the log file, if anything, when your kids have a go at their exploit. There's a crude log-viewing window in GUI>Status>Syslog, or sometimes I just use tail -f /tmp/var/log/messages in the CLI, watch the log play out until I'm tired of it, then type a control-C to exit the tail.

[scar1943]

[SurprisedItWorks]

Interesting. Unfortunately, I'm an iptables newbie. To my networking-noob mind it looks like you should be getting the blocking you seek because of your

iptables -I FORWARD -i br0 -o vlan2 -j DROP

assuming your wan is vlan2 rather than the default eth0. (You set up vlans at some point?)

I did just discover a curiosity, that this udp rule we've been discussing shows in my iptables -vL FORWARD output as if it were entered with --reject-with icmp-port-unreachable, but I didn't add such an option.

In any case, this is over my head for sure and calls for someone with more of a networking clue. I'd suggest posting it in the Advanced Networking forum. Gurus seem to cruise that forum more regularly than they do our marvell forum.

[scar1943]