Simple script for Policy Based OpenVPN Routing [WORKING]

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Goto page Previous  1, 2, 3, 4, 5
Author Message
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3781
Location: Netherlands

PostPosted: Thu Aug 08, 2019 11:51    Post subject: Reply with quote
The first posting details how to do that:

Quote:
Destination based routing is standard for OVPN, in the additional config you can enter destinations by IP address or URL and specify whether these should be routed through WAN or VPN e.g:
Code:
route 209.222.18.222 255.255.255.255 vpn_gateway # DNS server PIA
route 209.222.18.218 255.255.255.255 vpn_gateway # DNS server PIA
route 204.11.35.98 255.255.255.255 vpn_gateway #whatsmyip.org
route 95.85.16.212 255.255.255.255 net_gateway # ipleak.net
route 23.239.16.110 255.255.255.255 vpn_gateway #dnsleaktest.com
route 212.58.0.0 255.255.0.0 vpn_gateway #BBC
route amazon.com 255.255.255.255 net_gateway # Routing by URL only with 255.255.255.255


It also details that that is impossible with the standard PBR in DDWRT.

You can use the script as described in the first posting but Netflix uses so many different and changing IP's that it is very difficult.

Look for a dedicated thread regarding Netflix, you probably need ipset.

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Sponsor
portsup
DD-WRT User


Joined: 20 Oct 2018
Posts: 58

PostPosted: Thu Aug 08, 2019 13:03    Post subject: Reply with quote
Not impossible with standard PBR you just need to script the ip commands to set the routing. All the standard PBR is is a set of routing commands anyway.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3781
Location: Netherlands

PostPosted: Thu Aug 08, 2019 13:08    Post subject: Reply with quote
portsup wrote:
Not impossible with standard PBR you just need to script the ip commands to set the routing. All the standard PBR is is a set of routing commands anyway.


True but not with the route commands from the VPN

Edit: must even have a script for that lying somehwere Smile

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
MesMurized
DD-WRT Novice


Joined: 08 Aug 2017
Posts: 9

PostPosted: Tue Sep 10, 2019 0:22    Post subject: Reply with quote
Thanks @egc. Stock method does exactly what I needed. A major learning curve for me - but successful.

Q? Since stock reroutes to WAN, is there a need to have the script running all the time? I can't ever remember my WAN IP changing unless the cable modem is powered cycled.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3781
Location: Netherlands

PostPosted: Tue Sep 10, 2019 9:14    Post subject: Reply with quote
MesMurized wrote:
Thanks @egc. Stock method does exactly what I needed. A major learning curve for me - but successful.

Q? Since stock reroutes to WAN, is there a need to have the script running all the time? I can't ever remember my WAN IP changing unless the cable modem is powered cycled.


If you do not add: pull-filter ignore "redirect-gateway" so that the WAN is used as default for the alternate routing table, it usually is not necessary to run the script more then once.

I have made some modifications that the script runs only once when you specify SLEEP=0.
You can download the new script from the first posting. I have not tested it yet

Make sure that when you insert the script in the Startup command you add "SLEEP 60" before the script to make sure everything is up

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
MesMurized
DD-WRT Novice


Joined: 08 Aug 2017
Posts: 9

PostPosted: Wed Sep 11, 2019 22:11    Post subject: Reply with quote
@egc 5.08 working great. Thanks
Had to exclude the added PBR entry from the VPN kill switch:

WAN_IF=`nvram get wan_iface`
iptables -I FORWARD ! -s 192.168.1.86 -i br0 -o $WAN_IF -j REJECT --reject-with icmp-host-prohibited
iptables -I FORWARD ! -s 192.168.1.86 -i br0 -p tcp -o $WAN_IF -j REJECT --reject-with tcp-reset
iptables -I FORWARD ! -s 192.168.1.86 -i br0 -p udp -o $WAN_IF -j REJECT --reject-with udp-reset


This works, but only for a single IP. I could use a netmask, but I prefer to not rearrange my DHCP assignments.

Any other suggestions for multiple IPs?
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3781
Location: Netherlands

PostPosted: Thu Sep 12, 2019 8:31    Post subject: Reply with quote
The trick is to make clever use of netmask/CIDR notation: https://www.ipaddressguide.com/cidr

That is why I keep my DHCP at 192.168.1.64 - 127 because it is 192.168.1.64/26

For my static leases I use 16 - 31 which is 192.168.1.16/28 and 160 - 191 which is 192.168.1.160/27.

But indeed you have to restructure things Sad

The coming weeks (if I can find the time) I will make a simple script to automate the kill switch, so stay tuned Smile

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
MesMurized
DD-WRT Novice


Joined: 08 Aug 2017
Posts: 9

PostPosted: Fri Sep 13, 2019 5:22    Post subject: Reply with quote
Sounds great @egc.

FYI: !!Maybe!! (Was surprised VPN kill must be executed before pbr, else important table 11 entries are deleted. Easy fix: place pbr script after kill in firewall startup

Update: Using 192.168.1.16/31 for 2 excluded IPs. Works great. Thanks again

Update to running pbr in rc_firewall. Not a good idea. rc_firewall runs 3 times for me: at startup, after getting WAN ip, and after getting tun1 ip. Still works, but not ideal

Update @?#!: On second thought, since iptables screws with the routing table AND it runs with an OpenVPN ip change maybe pbr should run again... I'm still working on a fail-safe solution to keeping it running all the time.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3781
Location: Netherlands

PostPosted: Thu Sep 19, 2019 10:25    Post subject: Reply with quote
New version is up with as add-on an automatic kill script, see the second posting for details.

Tested on R7800 and R7000 but as there are many setups/routers, always check if it works as intended from CLI with:
Code:
iptables -vnL FORWARD


When in doubt or if you have questons feel free to post or PM me.

The script is in beta so there is definetely room for improvement Smile

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Goto page Previous  1, 2, 3, 4, 5 Display posts from previous:    Page 5 of 5
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum