DD-WRT :: View topic - [SOLVED] "killswitch" doesn't fully kill & how

[SOLVED] "killswitch" doesn't fully kill & how

DD-WRT Forum Index -> Advanced Networking

View previous topic :: View next topic

Author

Message

JackPollack
DD-WRT User

Joined: 22 May 2015
Posts: 60

Posted: Wed Jun 29, 2022 17:28 Post subject: [SOLVED] "killswitch" doesn't fully kill & how

firmware r48607
Using OpenVPN

I have a firewall rule

Code:

iptables -I FORWARD -s 192.168.0.28 -o vlan2 -j DROP

and this set

Code:

ip route add default dev tun1 table 200
ip rule add from 192.168.0.28 table 200

If I run command

Code:

killall openvpn

The "STATUS - OPEENVPN" page shows that the VPN is down as expected but if I try to browse the internet on the .28 device (which should only be connected over the VPN) after 5 min the browser does render the page sometimes (sometimes it times out as expected). I don't think thse pages are browser cached and they could be a new google search

A traceroute from .28 when the VPN is up takes 1 second as expected when the VPN is down it takes 5 minutes to complete (very slow on each hop) but eventually completes and returns

Code:

traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets
1 * 192.168.1.1 (192.168.1.1) 4.789 ms 266.605 ms
2 182.157.64.1 (182.157.64.1) 11.577 ms 12.225 ms 7.943 ms
3 68.173.202.188 (68.173.202.188) 15.400 ms 267.406 ms 12.024 ms
4 68.173.198.56 (68.173.198.56) 20.236 ms 15.717 ms 28.289 ms
5 66.109.6.78 (66.109.6.78) 17.732 ms 183.490 ms
107.14.19.24 (107.14.19.24) 16.981 ms
6 66.109.5.138 (66.109.5.138) 15.709 ms
66.109.6.27 (66.109.6.27) 242.718 ms
66.109.5.138 (66.109.5.138) 247.722 ms
7 209.85.172.46 (209.85.172.46) 13.920 ms
24.30.200.163 (24.30.200.163) 15.725 ms
72.14.212.114 (72.14.212.114) 273.217 ms
8 * * *
9 8.8.8.8 (8.8.8.8) 15.788 ms * 131.192 ms

Why doesn't my firewall rule totally kill the .28 devise when the VPN is down? How can I make this work as expected (totally kill internet for .28 when VPN is down)?

Why/how is it working if the firewall is down. ie I would like to understand how it is still working and why if it is, it is so slow (would think I'm connected or not)

I know there is a lot of other config stuff I could provide, but this post is already getting long so I'm hoping this info may be enough to answer the question (of course I can provide more if requested

Sponsor

the-joker
DD-WRT Developer/Maintainer

Joined: 31 Jul 2021
Posts: 2146
Location: All over YOUR webs

Posted: Wed Jun 29, 2022 17:35 Post subject:

Hello there.

First you should be using a current build http://ftp.dd-wrt.com/dd-wrtv2/downloads/betas/2022/06-29-2022-r49392/

Then consider sharing screenshots of your setup.

If any questions consider reading the OpenVPN guide written by our resident and beloved M.C.H.O and tunneling expert egc.
_________________
Saving your retinas from the burn!🔥
DD-WRT Inspired themes for routers
DD-WRT Inspired themes for the phpBB Forum
DD-WRT Inspired themes for the SVN Trac & FTP site
Join in for a chat @ #style_it_themes_public:matrix.org or #style_it_themes:discord

DD-WRT UI Themes Bug Reporting and Discussion thread

Router: ANus RT-AC68U E1 (recognized as C1)

eibgrad
DD-WRT Guru

Joined: 18 Sep 2010
Posts: 9157

Posted: Wed Jun 29, 2022 17:40 Post subject:

Why are you NOT using the GUI to manage all this? It has its own PBR (policy based routing) and a proper killswitch, even a watchdog!, all of which is known to work correctly.

As far as your specific coding, it *assumes* vlan2 is the network interface for the WAN. That's not always the case! Did you verify this by dumping the main routing table?

Code:

ip route

P.S. That's why the following is safer.

Code:

WAN_IF="$(ip route | awk '/^default/{print $NF}')"
iptables -I FORWARD -s 192.168.0.28 -o $WAN_IF -j DROP

_________________
ddwrt-ovpn-split-basic.sh (UPDATED!) * ddwrt-ovpn-split-advanced.sh (UPDATED!) * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)

JackPollack
DD-WRT User

Joined: 22 May 2015
Posts: 60

Posted: Wed Jun 29, 2022 19:05 Post subject:

I ran into some problems I think it was related to the USB/NAS settings. After 2 weeks of fooling around with it I finally gave up and went with older version of the firmware. Can't remember the specifics.

If I cant get my way to work correctly I will try the GUI PBR but would like to try to fix this and understand it if possible.

ip route returns

Code:

default via x.x.x.x dev eth0
127.0.0.0/8 dev lo scope link
y.y.y.y/23 dev tun1 scope link src z.z.z.z
a.a.a.0/19 dev eth0 scope link src b.b.b.b
192.168.1.0/24 dev br0 scope link src 192.168.1.1

eth0 is the normal WAN
tun1 is the VPN

I dont think I should change the firewall rule to tun1 (should I?)
iptables -I FORWARD -s 192.168.0.28 -o tun1 -j DROP <---- ??????

eibgrad
DD-WRT Guru

Joined: 18 Sep 2010
Posts: 9157

Posted: Wed Jun 29, 2022 19:08 Post subject:

JackPollack wrote:

Code:

default via x.x.x.x dev eth0
127.0.0.0/8 dev lo scope link
y.y.y.y/23 dev tun1 scope link src z.z.z.z
a.a.a.0/19 dev eth0 scope link src b.b.b.b
192.168.1.0/24 dev br0 scope link src 192.168.1.1

eth0 is the normal WAN
tun1 is the VPN

I dont think I should change the firewall rule to tun1 (should I?)
iptables -I FORWARD -s 192.168.0.28 -o tun1 -j DROP <---- ??????

As I worried, vlan2 is NOT the WAN. It's eth0! That's the output network interface (-o) you want blocked.
_________________
ddwrt-ovpn-split-basic.sh (UPDATED!) * ddwrt-ovpn-split-advanced.sh (UPDATED!) * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)

egc
DD-WRT Guru

Joined: 18 Mar 2014
Posts: 12504
Location: Netherlands

Posted: Wed Jun 29, 2022 19:15 Post subject:

The GUI is there especially for people who need help in setting these things up Smile

If you want to setup a manual killswitch use @eibgrads suggestion.

The OpenVPN client setup guide has a similar one.
Reading a manual sometimes helps Wink

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

JackPollack
DD-WRT User

Joined: 22 May 2015
Posts: 60

Posted: Thu Jun 30, 2022 13:23 Post subject:
Thanks everyone. changing the firewall rule solved the issue working: iptables -I FORWARD -s 192.168.1.28 -o eth0 -j DROP

Display posts from previous:

Page 1 of 1

DD-WRT Forum Index -> Advanced Networking

All times are GMT

Navigation

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum

Log in

[SOLVED] "killswitch" doesn't fully kill & how

Quick Links

Log in