VPN Director - Asuswrt-Merlin

[Mikey3]

Can someone tell me how to setup a rule in VPN Director to allow all clients to go through the VPN tunnel except one?

Thanks

 

[johndoe85]

Click on Add new rule in VPN director. Choose your VPN client in the interface section and add the clients you want to go through the VPN.
You should be able to set 192.168.50.0/24 as a choice instead of one client per rule. Name that rule "all clients" or something.
Then add a second rule with the client you want to go through the WAN interface

 

[Viktor Jaep]

@Mikey3 And to add just one last tidbit to this... make sure your exception rule is located at the top of your rules list, as rules are processed top-down... So your more global VPN rule should be #2.

 

[kyphos]

A related question about VPN Director:
Is there any way to specify that traffic from all WiFi-connected devices go through a VPN (but devices wired to the LAN continue to go through the WAN interface)? The VPN Director GUI only seems to allow client definition by IP, not by interface.

Thanks.

 

[chongnt]

@Mikey3 And to add just one last tidbit to this... make sure your exception rule is located at the top of your rules list, as rules are processed top-down... So your more global VPN rule should be #2.

WAN has higher priority over VPN client. Regardless of the sequence of rule creation, higher priority rule will always sorted on top in GUI and applied first. There should be no issue for OP requirement.

VPN Director

Third party firmware for Asus routers (newer codebase) - RMerl/asuswrt-merlin.ng

github.com

 

[Viktor Jaep]

WAN has higher priority over VPN client. Regardless of the sequence of rule creation, higher priority rule will always sorted on top in GUI and applied first. There should be no issue for OP requirement.

VPN Director

Third party firmware for Asus routers (newer codebase) - RMerl/asuswrt-merlin.ng

github.com

Thanks for this @chongnt ... but if something starts acting wonky, it's probably best to sort them in order of importance top-down... as a best practice.

 

[chongnt]

A related question about VPN Director:
Is there any way to specify that traffic from all WiFi-connected devices go through a VPN (but devices wired to the LAN continue to go through the WAN interface)? The VPN Director GUI only seems to allow client definition by IP, not by interface.

Thanks.

Yes, it seems there is no straight forward way of doing this. You can split LAN and WiFi to different subnet, say manually assign IP for your LAN devices to say 192.168.50.2 -192.168.50.127 (192.168.50.0/25) and let WiFi devices get their IP from DHCP pool 192.168.50.129 - 192.168.50.254 (192.168.50.128/25). This way you can do it with two rules in VPN Director.
Another option I can think of is use Guest Network with YazFi addons. It has option to route it over VPN.

GitHub - jackyaz/YazFi: Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more!

Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more! - GitHub - jackyaz/Yaz...

github.com

 

[chongnt]

Thanks for this @chongnt ... but if something starts acting wonky, it's probably best to sort them in order of importance top-down... as a best practice.

In 386.9, there is no option to sort it manually. I suppose the same for 388.x? The rules are automatically sorted by Interface priority as we create it.

 

[Viktor Jaep]

In 386.9, there is no option to sort it manually. I suppose the same for 388.x? The rules are automatically sorted by Interface priority as we create it.

Jeez... you're absolutely right. Maybe I was confusing the vpn director with something else where you could change its order. Thank you!

 

[kyphos]

Yes, it seems there is no straight forward way of doing this. You can split LAN and WiFi to different subnet, say manually assign IP for your LAN devices to say 192.168.50.2 -192.168.50.127 (192.168.50.0/25) and let WiFi devices get their IP from DHCP pool 192.168.50.129 - 192.168.50.254 (192.168.50.128/25). This way you can do it with two rules in VPN Director.
Another option I can think of is use Guest Network with YazFi addons. It has option to route it over VPN.

GitHub - jackyaz/YazFi: Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more!

Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more! - GitHub - jackyaz/Yaz...

github.com

@chongnt
I can see how I would narrow the scope of the DHCP server to 192.168.50.2-.127. But don't know how to define another DHCP pool (.129-.254) for WiFi devices.

However, I think your Guest Network idea will work. I'd never set one up, but I just tried it. It's not at all obvious (at least, it's not to me), but doing so creates a new subnet (192.168.101.0/24) and a DHCP server for devices that associate with the guest network. So a VPN Director rule can be created with a rule that assigns the entire subnet to a VPN. Presto - mission accomplished.

That DHCP server for the guest network is well hidden - I can't see it listed on the LAN/DHCP Server page, nor on the Guest Network page.

I will take a look at YazFi. I've never heard of it, and frankly don't know how I would add it to my RT-AC86U. I'm fairly new to Merlin firmware.

Thanks for the tips!!!

 

[Mikey3]

Click on Add new rule in VPN director. Choose your VPN client in the interface section and add the clients you want to go through the VPN.
You should be able to set 192.168.50.0/24 as a choice instead of one client per rule. Name that rule "all clients" or something.
Then add a second rule with the client you want to go through the WAN interface

View attachment 47611

View attachment 47612

Thanks. Much appreciated

 

[Mikey3]

@Mikey3 And to add just one last tidbit to this... make sure your exception rule is located at the top of your rules list, as rules are processed top-down... So your more global VPN rule should be #2.

Great. Thanks