Xentrk
Part of the Furniture
This script works great for selective routing of LAN clients over three OpenVPN clients:
What I like about the script is I can set Accept DNS Configuration to Exclusive which prevents DNS leaks when using selective routing and allows AB-Solution to work over the VPN tunnel.
I have another script that performs additional routing thru the OpenVPN clients using using domain names mined from dnsmasq. The scripted worked for several months and recently stopped working. So, in attempt to fix the script on the AC88U, I tried to duplicate the success I have with Selective Routing on pfSense using the features of pfBlockerNG to create IPv4 lists using AS Numbers rather than domain names. It can be done in a few mouse clicks on pfSense which is a nice feature! But I still experienced issues on the AC88U.
To better understand what is occurring, I wrote the following script to route queries to www.whatismyipaddress.com to OpenVPN Client 2. I used several other ip location sites to validate that my laptop remained in its assigned interface and the sites always reported the correct location. But where whatismyipaddress ended up is a different story. Here is the code of ipbypass.sh script to test and see what was occuring:
Test Case #1 - Three OpenVPN Clients 1=SD, 2=LA, 3=UK
Test Results with 2 OVPN Clients (1=SD, 2=LA):
ip rule
I repeated test case 2 but moved Chain Num 3 to the bottom to Chain 7. I got the same results.
I don't use QOS and tried with AI Protection turned off and on.
Code:
#!/bin/sh
logger -t "($(basename $0))" $$ Starting IPSET_VPN_Routing.sh..." $0${*:+ $*}."
# Uncomment the line below for debugging
# set -xo
ipset create LAN_GW hash:net family inet hashsize 1024 maxelem 65536
ipset create OVPNC1 hash:net family inet hashsize 1024 maxelem 65536
ipset create OVPNC2 hash:net family inet hashsize 1024 maxelem 65536
ipset create OVPNC3 hash:net family inet hashsize 1024 maxelem 65536
# extract LAN ip addresses
ipset add LAN_GW $(nvram get lan_ipaddr)
# extract OVPNC1 ip addresses
for ip in $(awk '{ print $1 }' /jffs/scripts/OVPNC1)
do
ipset add OVPNC1 $ip
done
# extract OVPNC2 ip addresses
for ip in $(awk '{ print $1 }' /jffs/scripts/OVPNC2)
do
ipset add OVPNC2 $ip
done
# extract OVPNC3 ip addresses
for ip in $(awk '{ print $1 }' /jffs/scripts/OVPNC3)
do
ipset add OVPNC3 $ip
done
# WAN
ip rule del fwmark 0x7000
ip rule add fwmark 0x7000 table 254 prio 9990
#VPN Client 1
ip rule del fwmark 0x1000
ip rule add fwmark 0x1000 table 111 prio 9991
#VPN Client 2
ip rule del fwmark 0x2000
ip rule add fwmark 0x2000 table 112 prio 9992
#VPN Client 3
ip rule del fwmark 0x3000
ip rule add fwmark 0x3000 table 113 prio 9993
ip route flush cache
###########################################################
#Create table to contain items added automatically by wan #
###########################################################
# WAN
iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000
iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000
# VPN Client 1
iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000
iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000
# VPN Client 2
iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set OVPNC2 src,dst -j MARK --set-mark 0x2000/0x2000
iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set OVPNC2 src,dst -j MARK --set-mark 0x2000/0x2000
# VPN Client 3
iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set OVPNC3 src,dst -j MARK --set-mark 0x3000/0x3000
iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set OVPNC3 src,dst -j MARK --set-mark 0x3000/0x3000
logger -t "($(basename $0))" $$ Ending IPSET_VPN_Routing.sh..." $0${*:+ $*}."I have another script that performs additional routing thru the OpenVPN clients using using domain names mined from dnsmasq. The scripted worked for several months and recently stopped working. So, in attempt to fix the script on the AC88U, I tried to duplicate the success I have with Selective Routing on pfSense using the features of pfBlockerNG to create IPv4 lists using AS Numbers rather than domain names. It can be done in a few mouse clicks on pfSense which is a nice feature! But I still experienced issues on the AC88U.
To better understand what is occurring, I wrote the following script to route queries to www.whatismyipaddress.com to OpenVPN Client 2. I used several other ip location sites to validate that my laptop remained in its assigned interface and the sites always reported the correct location. But where whatismyipaddress ended up is a different story. Here is the code of ipbypass.sh script to test and see what was occuring:
Code:
#!/bin/sh
#set -xo
ipset create WHATISMYIPADDRESS hash:net family inet hashsize 1024 maxelem 65536
for domain_name in whatismyipaddress.com
do
for ip in $(nslookup $domain_name | grep -v ":" | awk '/^Name:/,0{if (/^Addr/)print $3}'); do
echo "ip address is:" $ip
ipset add WHATISMYIPADDRESS $ip
done
done
###########################################################
#Create table to contain items added automatically by wan #
###########################################################
iptables -v -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set WHATISMYIPADDRESS dst,dst -j MARK --set-mark 0x2000/0x2000
iptables -v -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set WHATISMYIPADDRESS dst,dst -j MARK --set-mark 0x2000/0x2000
logger -t "($(basename $0))" $$ ending ipbypass.sh..." $0${*:+ $*}."Test Case #1 - Three OpenVPN Clients 1=SD, 2=LA, 3=UK
Code:
Laptop set to either WAN, OVPNC1, 2, or 3. Where does WHATISMYIPADDRESS end up?
Laptop whatismyipaddress.com Location
0 WAN LA (Pass)
1 SD UK (Fail)
2 LA LA (Pass)
3 UK UK (Fail)
Chain PREROUTING (policy ACCEPT 8726 packets, 3342K bytes)
num pkts bytes target prot opt in out source destination
1 0 0 MARK all -- tun11 * 0.0.0.0/0 0.0.0.0/0 MARK xset 0x1/0x7
2 2 156 MARK all -- tun12 * 0.0.0.0/0 0.0.0.0/0 MARK xset 0x1/0x7
3 1750 1345K MARK all -- tun13 * 0.0.0.0/0 0.0.0.0/0 MARK xset 0x1/0x7
4 0 0 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set LAN_GW src,dst MARK or 0x7000
5 3610 407K MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set OVPNC1 src,dst MARK or 0x1000
6 3609 407K MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set OVPNC2 src,dst MARK or 0x2000
7 0 0 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set OVPNC3 src,dst MARK or 0x3000
8 100 11050 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set WHATISMYIPADDRESS dst,dst MARK or 0x2000Test Results with 2 OVPN Clients (1=SD, 2=LA):
Code:
Laptop set to either WAN or OVPNC1 or 2. Where does WHATISMYIPADDRESS end up?
Laptop whatismyipaddress.com Location
0 WAN LA (Pass)
1 SD WAN (Fail)
2 LA LA (Pass)
Chain PREROUTING (policy ACCEPT 87 packets, 7110 bytes)
num pkts bytes target prot opt in out source destination
1 3399 1981K MARK all -- tun11 * 0.0.0.0/0 0.0.0.0/0 MARK xset 0x1/0x7
2 10459 8933K MARK all -- tun12 * 0.0.0.0/0 0.0.0.0/0 MARK xset 0x1/0x7
3 18 725 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set WHATISMYIPADDRESS dst,dst MARK or 0x2000
4 0 0 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set LAN_GW src,dst MARK or 0x7000
5 16 1878 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set OVPNC1 src,dst MARK or 0x1000
6 15 1838 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set OVPNC2 src,dst MARK or 0x2000
7 0 0 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set OVPNC3 src,dst MARK or 0x3000
Code:
0: from all lookup local
9990: from all fwmark 0x7000 lookup main
9991: from all fwmark 0x1000 lookup ovpnc1
9992: from all fwmark 0x2000 lookup ovpnc2
9993: from all fwmark 0x3000 lookup ovpnc3
32766: from all lookup main
32767: from all lookup defaultI don't use QOS and tried with AI Protection turned off and on.
Last edited:
