Policy based routing (manual method)

[mancio2]

Hi All,
i have read the following guide:

https://github.com/RMerl/asuswrt-merlin/wiki/Policy-based-routing-(manual-method)

because i would like to create a script that manually add and remove rules to redirect specific clients routing all the traffic through the vpn.

I don't understand if in the router configuration i have to disable Redirect Internet traffic setting it to No, if i would like to do it manually. Which options for Redirect Internet traffic setting i have to set in the GUI?

After that, if i would like to add another rule for another client in the future, have i to run another time the script inside the guide? Or i could run the last command for a specific client?

iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.xx.xxx -j MARK --set-mark 0

Thank you in advance.
Alessandro

 

[Martineau]

Hi All,
i have read the following guide:

https://github.com/RMerl/asuswrt-merlin/wiki/Policy-based-routing-(manual-method)

because i would like to create a script that manually add and remove rules to redirect specific clients routing all the traffic through the vpn.

I don't understand if in the router configuration i have to disable Redirect Internet traffic setting it to No, if i would like to do it manually. Which options for Redirect Internet traffic setting i have to set in the GUI?

After that, if i would like to add another rule for another client in the future, have i to run another time the script inside the guide? Or i could run the last command for a specific client?

iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.xx.xxx -j MARK --set-mark 0

Thank you in advance.
Alessandro

The "guide" you have posted is flawed, and since the functionality is now included in the firmware, I recommend that it should not be used.

The firmware will correctly create the appropriate VPN Client routing table(s) when

"Redirect Internet traffic=Policy Rules" or "Redirect Internet traffic=Policy Rules(strict)"

So, unless you need to Selectively route Ports, MACs or IPSETs etc., then there is no need to use fwmark tagging.

However if you do need to use fwmarks, then it is easier to follow the fwmark settings proposed by myself and @Xentrk

 

[mancio2]

The "guide" you have posted is flawed, and since the functionality is now included in the firmware, I recommend that it should not be used.

The firmware will correctly create the appropriate VPN Client routing table(s) when

"Redirect Internet traffic=Policy Rules" or "Redirect Internet traffic=Policy Rules(strict)"

So, unless you need to Selectively route Ports, MACs or IPSETs etc., then there is no need to use fwmark tagging.

However if you do need to use fwmarks, then it is easier to follow the fwmark settings proposed by myself and @Xentrk

Hi Martineau,
Thank you for your reply.
I would like to create a script which allow me to add or remove policy rules by command line instead of by GUI. This beacause in the future i would like to integrate it in an API Rest server.
Is there any guide or forum post that i could read about fwmark settings?

Thank you so much.
Alessandro.

 

[Robert Friberg]

Same here, I'd like to learn how to make changes to the configuration from the command line. @mancio2 let us know when you figure out a good approach.

 

[Robert Friberg]

I friend suggested I could use curl pointing to the web ui. This works of course only if the feature is available in the web interface. I just want to make it easy to enable/disable any of the 3 guest networks so curl approach will hopefully work for me.

 

[Martineau]

I just want to make it easy to enable/disable any of the 3 guest networks.

How to enable/disable Guest SSID from command line

 

[Robert Friberg]

How to enable/disable Guest SSID from command line

Awesome, thank you

 

[mancio2]

@Martineau could you link me the fwmark settings proposed by you and @Xentrk please?

 

[Xentrk]

@Martineau could you link me the fwmark settings proposed by you and @Xentrk please?

These are the fwmarks and bitmasks that have been working for me when running five OpenVPN Clients on AC88U:

set_fwmark_parms () {
    FWMARK_WAN="0x8000/0x8000"
    FWMARK_OVPNC1="0x1000/0x1000"
    FWMARK_OVPNC2="0x2000/0x2000"
    FWMARK_OVPNC3="0x4000/0x4000"
    FWMARK_OVPNC4="0x7000/0x7000"
    FWMARK_OVPNC5="0x3000/0x3000"
}

Repository: https://github.com/Xentrk/netflix-vpn-bypass