0: from all lookup local
9988: from all fwmark 0xc lookup 12
9989: from all fwmark 0xa lookup 10
9990: from all fwmark 0x7000 lookup main
32766: from all lookup main
32767: from all lookup defaultChain PREROUTING (policy ACCEPT 581K packets, 714M bytes)
num pkts bytes target prot opt in out source destination
1 102K 11M MARK all -- br0 * 0.0.0.0/0 0.0.0.0/0 source IP range 192.168.1.10-192.168.1.254 MARK set 0xa
2 0 0 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8443 MARK set 0xc
3 65808 3656K MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set NETFLIX dst MARK or 0x7000
4 593 327K MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set AMAZONAWS dst MARK or 0x7000
5 311 30108 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set AKAMAI dst MARK or 0x7000Please try the version in the first post. From my testing on Asus Merlin and pfSense, the akamai IPv4 addresses should not be needed, only the Netflix and Amazon AWS. So let's eliminate the akamai as an issue.
0: from all lookup local
4000: from all fwmark 0x7000/0x7000 lookup main
4002: from all to 108.160.151.39 lookup ovpnc2
4997: from all fwmark 0x3000/0x3000 lookup ovpnc3
4998: from all fwmark 0x2000/0x2000 lookup ovpnc2
5000: from all fwmark 0x1000/0x1000 lookup ovpnc1
<snip>#ip rule
0: from all lookup local# ip rule
0: from all lookup local
10101: from 192.168.22.152 lookup ovpnc1
32766: from all lookup main
32767: from all lookup default# ip rule
0: from all lookup local
9990: from all fwmark 0x7000/0x7000 lookup main
10101: from 192.168.22.152 lookup ovpnc1
32766: from all lookup main
32767: from all lookup defaultThe diagnostics look okay to me. You say you have an AC86U. But in the prompts, I see RT-AC66R. What firmware version are you running? What do you have set for Accept DNS Configuration? Try Exclusive at first. If you still have issues, change it to Strict. And in the Custom Configuration section, add the line:
Whoa I just noticed that but it is AC86U.
Accept DNS Configuration is set to Exclusive so I'll try Strict. I will also try the dhcp-option DNS 9.9.9.9 and will report back.
View attachment 12119
RTNETLINK answers: No such file or directoryStill not working. Also I noticed I had to run your script everytime I reboot the router, and once I run the script I get the following:
checking shared-SelectiveRouting-whitelist
file found, no further checks
RTNETLINK answers: No such file or directory
iptables: No chain/target/match by that name.
I can still play from Amazon but not from Netflix
I will need to update the code to add the lock file logic or you may experience duplicate ip rule entries when placing it in nat-start. I'll post an update soon.
I’ve seen good reviews on the tv box you have.
Did you install the entware package jq? It is required to parse the json file.
ipset v6.32, protocol version: 6jq --help
jq - commandline JSON processor [version 1.5]
<snip>Try using quad9 or another public dns for the wan DNS. Then, retest. I am away right now. I will rerun it again when I get home tonight.
#!/bin/sh
####################################################################################################
# Script: IPSET_Netflix3.sh
# Author: Xentrk
# 1-Mar-2018 Version 3.0
#
#####################################################################################################
# Script Description:
#
# The purpose of this script is for selective routing of Netflix traffic using
# Autonomous System Numbers (ASNs). ASNs are assigned to entities such as Internet
# Service Providers and other large organizations that control blocks of IP addresses.
#
# Netflix and other services that use Amazon AWS servers are blocking VPN's.
#
# This script will
# 1. Create shared whitelist entry for ipinfo.io in /jffs/shared-SelectiveRouting-whitelist for use by AB-Solution and Skynet.
# Otherwise, ipinfo.io may be blocked and the script will not work.
# 2. Obtain the IPv4 addresses used by Netflix and Amazon AWS USA from ipinfo.io.
# IPv6 addresses are excluded in this version.
# 3. Create the IPSET list NETFLIX
# 4. Add the IPv4 address to the IPSET list NETFLIX
# 5. Route IPv4 addresses in IPSET list NETFLIX to WAN interface.
#
# Note 1: IPSET syntax differs between version 6 and 4.5
# Syntax for ipset v6
# ipset create WAN0 list:set
# ipset add WAN0 setlist (e.g. SPEEDTEST)
# for routers running ipset v4.5 (ipset -V)
# ipset -N WAN0 setlist (e.g. SPEEDTEST)
#
# Note 2: In the event one needs to use IPv6 in the future, the syntax is: ipset -N NETFLIX-v6 hash:net family ipv6
#
# Note 3: Troubleshooting
#
# You can use these sites for AS validation and troubleshooting to lookup ASNs:
#
# https://bgp.he.net/AS16509 (Click on the prefixes tab to view IP addresses)
# http://ipinfo.io/AS2906
#
# Note 4: Required OpenVPN Client Settings
#
# - Redirect Internet Traffic = Policy Rules or Policy Rules (Strict)
# - Others?
#
#######################################################################
logger -t "($(basename $0))" $$ Starting IPSET_Netflix.sh..." $0${*:+ $*}."
# Uncomment for debugging
set -x
# Prevent script from running concurrently when called from nat-start
PROGNAME=$(basename "$0")
LOCKFILE_DIR=/tmp
LOCK_FD=200
lock() {
local prefix=$1
local fd=${2:-$LOCK_FD}
local lock_file=$LOCKFILE_DIR/$prefix.lock
# create lock file
eval "exec $fd>$lock_file"
# acquier the lock
flock -n $fd \
&& return 0 \
|| return 1
}
eexit() {
local error_str="$@"
echo $error_str
exit 1
}
main() {
lock $PROGNAME \
|| eexit "Only one instance of $PROGNAME can run at one time."
# check shared-SelectiveRouting-whitelist so ipinfo.io is not blocked
# by AB-Solution and Skynet
echo -e "\n checking shared-SelectiveRouting-whitelist"
if [ -s "/jffs/shared-SelectiveRouting-whitelist" ];then
echo " file found, no further checks"
else
echo "generating missing file"
echo "ipinfo.io" > /jffs/shared-SelectiveRouting-whitelist
fi
ipset create NETFLIX hash:net family inet hashsize 1024 maxelem 65536
#Pull all IPv4s listed for Netflix USA - AS2906
netsv4=`curl http://ipinfo.io/AS2906 2>/dev/null | grep -E "a href.*2906\/" | grep -v ":" |sed 's/^.*\">//; s/<.*//; /^\s*$/d'`
for net in $netsv4
do
ipset add NETFLIX $net
done
unset netsv4
# Download Amazon AWS json file
wget https://ip-ranges.amazonaws.com/ip-ranges.json -O /jffs/scripts/ip-ranges.json
# Create IPSET lists
ipset create AMAZONAWS hash:net family inet hashsize 1024 maxelem 65536
#Pull all IPv4s listed for Amazon AWS
for IPv4 in `jq -r '.prefixes | .[].ip_prefix' < ip-ranges.json`
do
ipset add AMAZONAWS $IPv4
done
unset IPv4
###########################################################
#Create table to contain items added automatically by wan #
###########################################################
ip rule del prio 9990
ip rule add from 0/0 fwmark 0x7000/0x7000 table main prio 9990
iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set NETFLIX dst,dst -j MARK --set-mark 0x7000/0x7000
iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set NETFLIX dst,dst -j MARK --set-mark 0x7000/0x7000
iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set AMAZONAWS dst,dst -j MARK --set-mark 0x7000/0x7000
iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set AMAZONAWS dst,dst -j MARK --set-mark 0x7000/0x7000
logger -t "($(basename $0))" $$ Ending IPSET_Netflix.sh..." $0${*:+ $*}."
}
mainip rule
0: from all lookup local
10101: from 192.168.22.152 lookup ovpnc1
32766: from all lookup main
32767: from all lookup defaultwget https://ip-ranges.amazonaws.com/ip-ranges.json -O /jffs/scripts/ip-ranges.json
--2018-03-01 19:52:27-- https://ip-ranges.amazonaws.com/ip-ranges.json
Resolving ip-ranges.amazonaws.com... 54.230.14.242, 54.230.14.67, 54.230.14.58, ...
Connecting to ip-ranges.amazonaws.com|54.230.14.242|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 154591 (151K) [application/json]
Saving to: '/jffs/scripts/ip-ranges.json'
/jffs/scripts/ip-ranges.json 100%[===================================================>] 150.97K 239KB/s in 0.6s
2018-03-01 19:52:30 (239 KB/s) - '/jffs/scripts/ip-ranges.json' saved [154591/154591]
+ ipset create TESTAMAZONAWS hash:net family inet hashsize 1024 maxelem 65536
+ jq -r .prefixes | .[].ip_prefix
+ ipset add TESTAMAZONAWS 13.32.0.0/15
+ ipset add TESTAMAZONAWS 13.35.0.0/16
<snip>
| Thread starter | Title | Forum | Replies | Date |
|---|---|---|---|---|
| H | Routing wireguard | VPN | 0 | |
|
[solved] PFSense+OpenVPN: Problems Routing Specific VLAN traffic out VPN | VPN | 1 |
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
