Selective route for an application

[bluemouseios]

I tried my best to do a search but found no luck, so have to ask here. Let me know if my question was posted before that I did not find by myself.

My router runs merlin v384.11_2, and I also run aria2c on the router for torrenting. I have two openvpn clients config for tcp and udp respectively. When the two vpn clients enabled, all my traffic goes through the VPN server flawlessly.

However, I'd like config it so that only the torrent traffic goes through vpn while other traffic still go wan. Is there a way to config that. I looked at iptables but clueless about it.

If torrent is running on a different server with a different ip address, I know I can config it through selective routing, but since the torrent is on the router and thus has ip: 192.168.1.1

Is it possible to config iptables to route port through the vpn interface (eg. tun12 in my case) while others go through wan (eth0)?

Here is routing table when two vpn clients enabled:

admin@nas:/tmp/home/root# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
67.(wan ip)     0.0.0.0         255.255.255.255 UH        0 0          0 eth0
23.(vpn server1)  67.x.x.1     255.255.255.255 UGH       0 0          0 eth0
23.(vpn server2)  67.x.x.1    255.255.255.255 UGH       0 0          0 eth0
10.28.16.0      0.0.0.0         255.255.255.0   U         0 0          0 tun11
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 br0
10.28.15.0      0.0.0.0         255.255.255.0   U         0 0          0 tun12
67.x.x.0         0.0.0.0         255.255.254.0   U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         10.28.15.1      128.0.0.0       UG        0 0          0 tun12
128.0.0.0       10.28.15.1      128.0.0.0       UG        0 0          0 tun12
0.0.0.0         67.x.x.1           0.0.0.0         UG        0 0          0 eth0

 

[Butterfly Bones]

I tried my best to do a search but found no luck, so have to ask here. Let me know if my question was posted before that I did not find by myself.

My router runs merlin v384.11_2, and I also run aria2c on the router for torrenting. I have two openvpn clients config for tcp and udp respectively. When the two vpn clients enabled, all my traffic goes through the VPN server flawlessly.

However, I'd like config it so that only the torrent traffic goes through vpn while other traffic still go wan. Is there a way to config that. I looked at iptables but clueless about it.

If torrent is running on a different server with a different ip address, I know I can config it through selective routing, but since the torrent is on the router and thus has ip: 192.168.1.1

Is it possible to config iptables to route port through the vpn interface (eg. tun12 in my case) while others go through wan (eth0)?

Here is routing table when two vpn clients enabled:

admin@nas:/tmp/home/root# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
67.(wan ip)     0.0.0.0         255.255.255.255 UH        0 0          0 eth0
23.(vpn server1)  67.x.x.1     255.255.255.255 UGH       0 0          0 eth0
23.(vpn server2)  67.x.x.1    255.255.255.255 UGH       0 0          0 eth0
10.28.16.0      0.0.0.0         255.255.255.0   U         0 0          0 tun11
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 br0
10.28.15.0      0.0.0.0         255.255.255.0   U         0 0          0 tun12
67.x.x.0         0.0.0.0         255.255.254.0   U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         10.28.15.1      128.0.0.0       UG        0 0          0 tun12
128.0.0.0       10.28.15.1      128.0.0.0       UG        0 0          0 tun12
0.0.0.0         67.x.x.1           0.0.0.0         UG        0 0          0 eth0

This can be configured in the VPN client settings using "Policy based routing". See the RMerlin Wiki how to article.
https://github.com/RMerl/asuswrt-merlin/wiki/Policy-based-routing[URL]https://github.com/RMerl/asuswrt-merlin/wiki/Policy-based-routing[/URL]

 

[bluemouseios]

Hi Butterfly, thanks for the reply.

However, I've actually tried the method in the wiki, as well as alternate manual method, neither works. I believe the main reason is the app is running on the router itself, so set a policy with source ip 192.168.1.1 won't work, maybe there are other rules overwrite it I am not sure.

The policy I've set, with both Redirect Internet traffic=Policy Rules (strict)

• Source IP=192.168.1.1 Dest IP=0.0.0.0 iface=VPN (this rule does not work though that's what I want, the app is running on it)
• Source IP=192.168.1.187 Dest IP=0.0.0.0 iface=VPN (this rule works perfectly but not what I need)

This can be configured in the VPN client settings using "Policy based routing". See the RMerlin Wiki how to article.
https://github.com/RMerl/asuswrt-merlin/wiki/Policy-based-routinghttps://github.com/RMerl/asuswrt-merlin/wiki/Policy-based-routing

 

[Martineau]

I tried my best to do a search but found no luck, so have to ask here. Let me know if my question was posted before that I did not find by myself.

My router runs merlin v384.11_2, and I also run aria2c on the router for torrenting. I have two openvpn clients config for tcp and udp respectively. When the two vpn clients enabled, all my traffic goes through the VPN server flawlessly.

However, I'd like config it so that only the torrent traffic goes through vpn while other traffic still go wan. Is there a way to config that. I looked at iptables but clueless about it.

If torrent is running on a different server with a different ip address, I know I can config it through selective routing, but since the torrent is on the router and thus has ip: 192.168.1.1

Is it possible to config iptables to route port through the vpn interface (eg. tun12 in my case) while others go through wan (eth0)?

Here is routing table when two vpn clients enabled:

admin@nas:/tmp/home/root# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
67.(wan ip)     0.0.0.0         255.255.255.255 UH        0 0          0 eth0
23.(vpn server1)  67.x.x.1     255.255.255.255 UGH       0 0          0 eth0
23.(vpn server2)  67.x.x.1    255.255.255.255 UGH       0 0          0 eth0
10.28.16.0      0.0.0.0         255.255.255.0   U         0 0          0 tun11
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 br0
10.28.15.0      0.0.0.0         255.255.255.0   U         0 0          0 tun12
67.x.x.0         0.0.0.0         255.255.254.0   U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         10.28.15.1      128.0.0.0       UG        0 0          0 tun12
128.0.0.0       10.28.15.1      128.0.0.0       UG        0 0          0 tun12
0.0.0.0         67.x.x.1           0.0.0.0         UG        0 0          0 eth0

Not sure if this Aria2c application thread is of help? Aria2c command to download thru VPN tunnel

However, if there are ports uniquely specific to the Aria2c application that can be identified then see Wiki Selective Port Routing

 

[bluemouseios]

Problem sovled, the solution is much easier. I just need create a br0 alias with a different ip and bind aria2 to that ip, then I can use the policy rule to route that ip to vpn only.

1. Set DHCP range start from 192.168.1.10, so that 192.168.1.[2-9] is reserved
2. add one line to /opt/etc/init.d/S81aria2 and update the args to bind to the new ip

ifconfig br0:0 192.168.1.2 up    # create br0 alias with a new ip
ARGS="--conf-path=/opt/etc/aria2.conf --interface=192.168.1.2"

3. In admin UI for openvpn client, set following rule:
Source IP=192.168.1.2 Dest IP=0.0.0.0 iface=VPN
4. restart the router

I've tested with ipleak.net and it works. The only issue left is that seems aria2 started before vpn client that the first connections are still through wan and quickly switched to vpn.

Is there a way to delay /opt/etc/init.d/ service to start after vpn client is up and running?

 

[Martineau]

The only issue left is that seems aria2 started before vpn client that the first connections are still through wan and quickly switched to vpn.

If you have the KILL-Switch enabled for the VPN, then the Aria2c alias will not have access to the WAN.

Alternatively.....

Is there a way to delay /opt/etc/init.d/ service to start after vpn client is up and running?

Since you now have a custom S81aria2 script, you could move it from /opt/etc/init.d/ to /jffs/scripts/and simply call it from the openvpn-event UP script?

 

[bluemouseios]

You are right. I enabled kill-switch but need wait nat rules applied to make it effective.

I moved S81aria2 out and added it to /jffs/script/nat-start, tested couple of times, now there is no leak anymore during the router start.

Now it is perfect. Thanks everyone's help here!