POLICY RULES IN VPN NOT WORKING

[Ali]

I have an ASUS RT 88u. I have been on merlin wrt for 1 year now with no complaints. Recently I upgraded the firmware to 380.58. I have noticed that internet has been slow. I have one VOIP ATA connected to my network through VPN, because VOIP is blocked by my ISP. I have used policy rules to route only the VOIP traffic through VPN. This was mainly why I flashed merlin on my routher. After further investigation, I have found out that occasionally the router routes all traffic through VPN, and not only the ones in policy rules. This behavior can be repeated any time if you create 2 open vpn clients, both with policy rules. You can then check your ip address by searching what is my ip in google from a computer that is not suppose to go through the VPN.
Has any saw this behavior?

 

[RMerlin]

I have an ASUS RT 88u. I have been on merlin wrt for 1 year now with no complaints. Recently I upgraded the firmware to 380.58.

Why did you upgrade to a 10 months old firmware?

 

[Ali]

Why did you upgrade to a 10 months old firmware?

What I meant is that I have started noticing this behavior since that version. I have updated to the newest one but the problem still exists.

 

[Martineau]

....occasionally the router routes all traffic through VPN, and not only the ones in policy rules. This behavior can be repeated any time if you create 2 open vpn clients, both with policy rules

Check the RPDB rules when Selective routing is working, and again when the Selective routing fails:

ip rule

and VPN Client routing tables e.g. VPN Client 1 and 2

ip route show table 111
ip route show table 112

NOTE: If Selective PORT routing is used, then check

iptables -nvL PREROUTING -t mangle --line

 

[RimRider]

Sorry for the necrobump, but I'm having the exact same problem as the OP and a Google search brought me here.

This has been frying my head for the past week. Running two VPN clients simultaneously with Policy Rules and for some unknown reason, some IP addresses not selected in the Rules are randomly pushed through one or the other VPN client.

The last resort is me now asking for help!

 

[Martineau]

Sorry for the necrobump, but I'm having the exact same problem as the OP and a Google search brought me here.

This has been frying my head for the past week. Running two VPN clients simultaneously with Policy Rules and for some unknown reason, some IP addresses not selected in the Rules are randomly pushed through one or the other VPN client.

You have not stated if the issue is with LAN (device) IPs or destination IPs (or both) but the diagnostic commands shown in Post #4 should be able to identify if there is a mismatch between the RPDB rules and the kernel routing tables.

 

[RimRider]

I'm trying with LAN IPs.

I have a UK VPN (Client 1) running and I want my Homeserver going through that. I also want my FireTV sticks to go via my US VPN (Client 2).

It configured as the pics below. Randomly, I have my Study PC, (the one I'm currently typing on) going through the UK VPN too, whereas I want it to use my default ISP.

Edit: I've booted up the laptop (connected via LAN) and that is also routed via the UK VPN...

 

[RimRider]

Here are the diags. I'm unsure how to decipher them though...

 

[Martineau]

Here are the diags. I'm unsure how to decipher them though...

View attachment 11067

Sorry.

RMerlin firmware not supported on Netgear R7000

 

[RimRider]

Well, that's unfortunate.

Guess I'm getting a new router...

 

[RimRider]

Bought an AC86U.

Same settings, same problem.

Seems like this issue is common in the forums. I've seen loads of posts regarding it but no real solution.

@yorgi seems to be the most knowledgeable regarding this error so I've sent him a PM.

Has ANYONE successfully used policy rules on 2 "ACTIVE" clients?

 

[RMerlin]

Has ANYONE successfully used policy rules on 2 "ACTIVE" clients?

You have to understand that the rules are all in the same table, therefore you must take care of ensuring there is no overlap in your rules. That includes the default route. If you have both tunnels rely on their default routes, then only the first one will ever be used.

Multiple tunnels were never intended for that kind of usage. Primary use was for tunnelling, not for intercepting and redirecting Internet connections. To get that working, you will need to have some fairly good understanding of Linux routing.

 

[RimRider]

Thanks for the firmware RMerlin.

Just to clarify, if I have 3 computers - Computer A, Computer B and Computer C.

Are you saying it is not possible to have Computer A go through Client 1 (UK VPN), Computer B go through Client 2 (US VPN) and have Computer C just use my normal ISP and go through neither client?

Will Computer C will always go through Client 1?

 

[CaptainSTX]

Bought an AC86U.

Same settings, same problem.

Seems like this issue is common in the forums. I've seen loads of posts regarding it but no real solution.

@yorgi seems to be the most knowledgeable regarding this error so I've sent him a PM.

Has ANYONE successfully used policy rules on 2 "ACTIVE" clients?

I have three VPN clients running with certain static IPs routed to each client plus other connected devices routed using local ISP.

For testing purposes I have three different VPN providers and I allow connections even if the tunnel is down.

 

[RimRider]

I don't want two different VPN providers though.

 

[CaptainSTX]

I don't want two different VPN providers though.

Then you are going to have to setup two different ports. One for each server you want to use. With some VPN providers that is easier than others. Using Port 443 may not be a good option if that is what is suggested.

 

[RimRider]

OK, I'll try that. I'm with NordVPN and they definitely allow 1194 and 443. Thanks for the suggestion...

 

[Martineau]

I have 3 computers - Computer A, Computer B and Computer C.

Are you saying it is not possible to have Computer A go through Client 1 (UK VPN), Computer B go through Client 2 (US VPN) and have Computer C just use my normal ISP and go through neither client?

Will Computer C will always go through Client 1?

RMerlin is not saying that your required routing will NOT work.

Many users have successfully implemented Selective Routing; simply using the GUI to define which LAN devices should use a specific VPN connection.

connect 2 vpn at the same time?

However, RMerlin has alluded to the fact that in some cases, the 'default route' inserted into the ovpncX tables may in fact incorrectly redirect everything to the first VPN Client connection that is established.

To debug you will need to again provide the output of the diagnostic commands (preferably as text rather than a GIF) to identify if ovpnc2 clients are (incorrectly) actually using the ovpnc1 route.