Deciding Gateway base on destination IP

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
Goto page 1, 2  Next
Author Message
icecold546
DD-WRT Novice


Joined: 18 Mar 2021
Posts: 13

PostPosted: Thu Mar 18, 2021 16:27    Post subject: Deciding Gateway base on destination IP Reply with quote
I have a Linksys 1900ACS V2 DD-WRT build 44715 router (setup as DHCP) connected to a network that has two potential ISP as sources.

ISP source 1: 192.168.1.1
ISP source 2: 192.168.1.88
DD-WRT WAN: 192.168.1.68

Router IP is 192.168.3.1

I want to route IP address 192.168.3.177 to 192.168.3.187 to use ISP source 1, while the rest defaults to ISP 2

I'm a noob at networking, so assistance is much appreciated
Sponsor
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Thu Mar 18, 2021 16:53    Post subject: Reply with quote
As configured, you can't control which of those gateways is used from the dd-wrt router. That decision has to be made by the upstream router (of course, w/ the dd-wrt router NAT'd over its WAN by default, that's problematic). All the dd-wrt router can do is choose among gateways defined within its own IP network (192.168.3.x) or directly accessible on the router itself (e.g., an OpenVPN client, or even an EoIP tunnel).

I suppose what you could do is configure a VPN between the dd-wrt router and the upstream router for these purposes. IOW, effectively pull that remote gateway *into* the dd-wrt router so it does in fact become available and subject to PBR (policy based routing). A bit of a heavy solution, but should work.

_________________
ddwrt-ovpn-split-basic.sh (UPDATED!) * ddwrt-ovpn-split-advanced.sh (UPDATED!) * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)


Last edited by eibgrad on Thu Mar 18, 2021 17:14; edited 1 time in total
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Thu Mar 18, 2021 17:01    Post subject: Reply with quote
P.S. Ideally, you'd want to disable NAT on the dd-wrt router, add a static route on the upstream router that points to the WAN ip of the dd-wrt router as the gateway to its local IP network (192.168.3.0/24), then implement PBR on that upstream router. Whether that's practical or even possible depends on the capabilities of that upstream router. If NOT, a VPN might be your only other option.
_________________
ddwrt-ovpn-split-basic.sh (UPDATED!) * ddwrt-ovpn-split-advanced.sh (UPDATED!) * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)
icecold546
DD-WRT Novice


Joined: 18 Mar 2021
Posts: 13

PostPosted: Thu Mar 18, 2021 17:29    Post subject: Reply with quote
So what you are saying is if I move one of the ISP to be connected via direct to the DD-WRT Router, it can be possible?

I.e.
IP Source #1: 192.168.1.1
IP Source #2: 192.168.3.2
DD-WRT WAN: 192.168.1.68
DD-WRT LAN: 192.168.3.1

If that was the setup, how would I configure this to work?

Thank you
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 6870
Location: Romerike, Norway

PostPosted: Thu Mar 18, 2021 17:43    Post subject: Reply with quote
Use PBR to have two routing tables.

https://forum.dd-wrt.com/wiki/index.php/Policy_Based_Routing

Table 1: route default via 192.168.1.1
Table 2: route default via 192.168.1.88
icecold546
DD-WRT Novice


Joined: 18 Mar 2021
Posts: 13

PostPosted: Thu Mar 18, 2021 17:47    Post subject: Reply with quote
@Per Yngve Berg,

I'm quite a novice, so if you could provide the script lines in exact words, that would be helpful.

I know I need to put in in DD-WRT administration/commands/save startup

Thank you
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Thu Mar 18, 2021 18:53    Post subject: Reply with quote
My bad, @Per Yngve Berg is right. For some reason, I was thinking a second gateway would require a second network interface, but duh, yeah, you could have multiple gateways available via the same network interface. Then use PBR to chose which *source* IPs use which gateway (you said destination IP, but I believe you meant source IP).
_________________
ddwrt-ovpn-split-basic.sh (UPDATED!) * ddwrt-ovpn-split-advanced.sh (UPDATED!) * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Thu Mar 18, 2021 21:38    Post subject: Reply with quote
I threw together a script based on your requirements and posted it on PasteBin.

https://pastebin.com/mR9g1tmi

It requires JFFS be available and enabled. Go to a shell (telnet/ssh) and copy/paste the script into the window, and it will create the necessary wanup script, then reboot. It will get executed immediately after the WAN is (re)initialized.

It assumes the current default gateway is 192.168.1.1. It works by copying the main routing table to an alternate table, w/o changes. All the source IPs you listed are then routed to that secondary table. The main routing table is modified w/ overrides that change the default gateway to 192.168.1.88 for all other source IPs.

For debugging purposes, it writes to the syslog so you can verify it ran and produced no errors.

Code:
cat /var/log/messages | grep alt-gtwy


Once working, you can disable debug mode.

If you want/need to fine tune it, there should be enough there to at least get you started.

Since the script is messing w/ the routing system, there's always the risk it could mess it up so badly it can't be rebooted, and will require a factory reset. For those reasons, MAKE SURE YOU HAVE A BACKUP OF THE CONFIG! That way you can easily recover using that backup.

If you want to be extra, extra cautious, there's a 'sleep 120' command in the script that's currently commented out, but could be uncommented. Should things go wrong, you could reboot and have 2 mins to get into the shell and delete the script from jffs (rm /jffs/etc/config/alt-gtwy.sh), then reboot. But of course, that will delay the effects of the script for those same 2 mins (which can be annoying). Once working, you can remove it.

_________________
ddwrt-ovpn-split-basic.sh (UPDATED!) * ddwrt-ovpn-split-advanced.sh (UPDATED!) * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Fri Mar 19, 2021 1:34    Post subject: Reply with quote
FYI.

I updated the script to support reentrancy. Because the router often calls the WAN up script several times before (re)initialization is complete, and the script runs asynchronously to the WAN up event, you can end up w/ several instances of the script running at the same time, and therefore there's an ever so slight chance one could clobber the other w/o serialization.

Not something you need to worry about, but just something I thought was worth adding so you don't even up w/ some weird problems down the road.

_________________
ddwrt-ovpn-split-basic.sh (UPDATED!) * ddwrt-ovpn-split-advanced.sh (UPDATED!) * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)
icecold546
DD-WRT Novice


Joined: 18 Mar 2021
Posts: 13

PostPosted: Fri Mar 19, 2021 1:40    Post subject: Reply with quote
@eibgrad,

Thanks for the script. Much appreciated and will give it a whirl. Just a few questions

1) I see from the script it assume the alt gateway is 192.168.1.88 (And I assume the other gateway is set from the DD-WRT Gateway portion in the setup/WAN Connection Type.
And I am right to assume all will default to 192.168.1.88 and only those 10 ips to 192.168.1.1 (which is set at the router side) or does it need to be flipped

2) you mentioned JFFS2 needs to be enabled. Am I right to assume it administration/management/JFFS2 support and enable JFFS2

Many Thanks!
icecold546
DD-WRT Novice


Joined: 18 Mar 2021
Posts: 13

PostPosted: Fri Mar 19, 2021 1:46    Post subject: Reply with quote
oh btw I only have 30mb on the JFFS2. Do i need to mount a USB drive to increase that?
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Fri Mar 19, 2021 2:33    Post subject: Reply with quote
icecold546 wrote:
1) I see from the script it assume the alt gateway is 192.168.1.88 (And I assume the other gateway is set from the DD-WRT Gateway portion in the setup/WAN Connection Type.
And I am right to assume all will default to 192.168.1.88 and only those 10 ips to 192.168.1.1 (which is set at the router side) or does it need to be flipped


It works as you describe, now and originally. It takes the main routing table (which presumably is pointing to 192.168.1.1, you never said specifically, but seemed highly likely) and copies it, in toto, to the alternate routing table. The main routing table is then modified w/ overrides to change its default gateway to 192.168.1.88. Any source IP in the list uses the alternate routing table as its default gateway (i.e., 192.168.1.1). Everything else uses the main routing table (i.e., 192.168.1.88 ).

Quote:
2) you mentioned JFFS2 needs to be enabled. Am I right to assume it administration/management/JFFS2 support and enable JFFS2


Yes.

icecold546 wrote:
oh btw I only have 30mb on the JFFS2. Do i need to mount a USB drive to increase that?


That's plenty. The generated wanup script (/jffs/etc/config/alt-gtwy.sh) is only 1.5K!

_________________
ddwrt-ovpn-split-basic.sh (UPDATED!) * ddwrt-ovpn-split-advanced.sh (UPDATED!) * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)
icecold546
DD-WRT Novice


Joined: 18 Mar 2021
Posts: 13

PostPosted: Fri Mar 19, 2021 14:23    Post subject: Reply with quote
@eibgrad

Thank you

Just last question. So if DHCP additional adds clients are they not on 192.168.1.88 or is the script setup to dynamically change all routing as it comes in unless its those specified?

Thank you
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Fri Mar 19, 2021 14:36    Post subject: Reply with quote
The script does exactly as you requested. If the source IP is in that list, its packets are forwarded to 192.168.1.1, else they're forwarded to 192.168.1.88. *HOW* any particular client gets assigned an IP (DHCP or statically) has no bearing on the script's behavior.
_________________
ddwrt-ovpn-split-basic.sh (UPDATED!) * ddwrt-ovpn-split-advanced.sh (UPDATED!) * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)
icecold546
DD-WRT Novice


Joined: 18 Mar 2021
Posts: 13

PostPosted: Mon Mar 22, 2021 3:14    Post subject: Reply with quote
Many thanks. Assume the script is not just a one off run in the beginning

Will try out and let you know the result.

Many thanks again!
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum