[superTaco2]

Update:

ANSWER: Tunnel IPAddress/Netmask must be in CIDR notation.

=================================================

Firmware: DD-WRT v3.0-r46772 std (05/26/21)
Router Model: Netgear R6700 v3

Similar to https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1237985#1237985, I'm trying to setup my router so that all traffic goes to IVPN except one ip.

Following egc's Client Setup guide here: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624

But traffic isn't routing through the VPN tunnel. Handshake looks fine, but no traffic routing.

Dug deeper and followed the links to egc's Server Setup guide with additional troubleshooting: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322206

I followed this guide and it worked:

[egc]

You do not have to add anything manually (default route kicking in too soon should not be happening anymore and if it is happening you will see a warning in syslog)

The IP addresses you fill in in the PBR field are using the VPN.

You use CIDR notation as described in the guide, the address range you are using: 192.168.11.64/26
means all IP addresses from 192.168.11.64 until and including 192.168.11.127 (so 64 IP addresses) will use the VPN other IP addresses will use the WAN

If you want it otherwise see: https://www.ipaddressguide.com/cidr

You can enter multiple addresses/ranges which will use the VPN as a comma separated list

EDIT: You better enable Route allowed IP's via tunnel

[egc]

A viable setup could be something like this:

Enter in the PBR field 192.168.11.64/26, 192.168.11.128/26 so all addresses from .64 - .191 are using the VPN

For your DHCP range you use start address .64 for a maximum of 64 addresses those DHCP users will use the VPN

You can set static leases from .128 - .191 those will use the VPN.
Static leases below .64 will use the WAN

[superTaco2]

I spent a bunch more time on this, but the only way I'm able to get the WireGuard tunnel working is with the a startup script that adds the ip routes. And this solution doesn't work with PBR.

Any troubleshooting suggestions?

I tried a bunch of configurations (listed below).

I then thought on the timing problem and checked my syslogs and was surprised they start at 1/1/1970 (date is 0?). There are some issues resolving 2.pool.nto.org but it eventually gets there. What's odd to me is the WireGuard tunnel + routing is setup BEFORE the current date is resolved. Would that have something to do with it??

Logs Excerpt (timezone: Zulu) (IP addresses modified to protect the innocent. 3.3.188.150 is ISP ip)

[egc]

You always have to Enable Route allowed IP's via tunnel.

To test do not put anything in the PBR Field.

The route kicks in after NTP time is up but there is timeout of 90 seconds, the syslog will tell you if everything is working, it appears to work but the best way to see everything is from the CLI (telnet/Putty):

[egc]

One other thing your net mask is wrong it should be /24 (or 32) and not 255.255.255.255

You are on a recent build which has safeguards against this but you should see the warning in the syslog and the override

[superTaco2]

Thanks for the help, followed your instructions: disabled scripts & pbr, enabled Rouate Allowed IPs, rebooted and waited 2 mintutes . Unfortunately traffic is still not routing through the Tunnel:

Disable Scripts & PBR / Enable Route Allowed IPs:
nvram show | grep oet :

[egc]

See my earlier post, your netmask is still wrong.

It should be /24 and not 255.255.255.255

If you correct that it will work

[superTaco2]

[egc]

Glad it is solved

I will make some extra checks so that this will also be caught and specifically mention it in the label.

Actually using /24 is smarter as that is another safeguard against routing problems, if you add an /24 address to an interface a route is automatically added

That is why I favour /24 but if routing is working /32 should also work (and of course 255.255.255.255 is /32)