x3mRouting x3mRouting ~ Selective Routing for Asuswrt-Merlin Firmware

[Xentrk]

Is it possible to make x3mRouting works running experimental Wireguard? Some Netflix videos play & some will display proxy network warning if running Wireguard. It works perfectly on OpenVPN.

x3mRouting only supports OpenVPN protocol. x3mRouting is tightly integrated with Asuswrt-Merlin firmware OpenVPN functionality.

 

[mister]

Dear all,
may I ask a question concerning the AS number method for Amazon. I am routing amazon via wan interface using the as number method. i found out, that some other web pages are using the same as number or are associated with the same as number.

e. g. wieistmeineip.ch shows my private ip instead of my vpn ip (because it is routing the same way as Amazon)

is there a possibilty to differ the traffic used for Amazon prime Video and other non Amazon services? Or do I have to live with the fact that routing sometimes is not correct at some webpages?

thanks a lot
hugo

 

[Xentrk]

Dear all,
may I ask a question concerning the AS number method for Amazon. I am routing amazon via wan interface using the as number method. i found out, that some other web pages are using the same as number or are associated with the same as number.

e. g. wieistmeineip.ch shows my private ip instead of my vpn ip (because it is routing the same way as Amazon)

is there a possibilty to differ the traffic used for Amazon prime Video and other non Amazon services? Or do I have to live with the fact that routing sometimes is not correct at some webpages?

thanks a lot
hugo

You may be able to achieve this with some analysis and mining of /opt/var/log/dnsmasq.log

Download the getdomainnames.sh script and follow the instructions on the GitHub page.

1. change to the log directory e.g. cd /opt/var/log/.
   
2. Then issue the command tail -f dnsmasq.log > prime.
   
3. Go to prime and surf around the options and watch a few videos for a few minutes each to try to capture all of the domain used by amazon prime.
4. Press Ctrl-C to stop output to prime file.
   
5. run the getdomainnames.sh script. Provide it with the name of the name of the file and IP address you streamed from. sh getdomainnames.sh prime 192.168.1.150
6. This will create the file /opt/var/log/prime_domains
7. Do a sanity check on the domains as there may some other domains in the file not directly related to prime video. For example, on the roku, I will see roku domains listed in the file in addition to amazon domains. Those are probably candidates for remove. May involve some trial and error.
8. Install the entware package drill if not already installed.
   
9. Run the script below to gather the IPv4 Address for the domains you collected

#!/bin/sh

lookup_domains () {
    while read DOMAINS
        do
            drill -4 $DOMAINS | grep -v SERVER | grep -E "([0-9]{1,3}[\\.]){3}[0-9]{1,3}" | cut -f 5 >> /opt/tmp/PRIME
        done < /opt/var/log/prime_domains
}

true > /opt/tmp/PRIME
lookup_domains

This will create a file in /opt/tmp/PRIME. You can now use the MANUAL method to create an IPSET list from the file /opt/tmp/PRIME and specify the routing. Let us know how it turns out.

 

[mister]

Hi Xentrk,
it looks like a lot of time for testing. I will do that, if I have some freetime in my holidays. But if amazon prime will add or change the streaming adresses, I will have to repeat the procedure , right? The IP adress you mentioned in step 5 (192.168.1.150) should be changed to the IP of my router or the IP of my device I streamed ?

Thanks a lot again for your reply and your support.

Hugo.

 

[TonyK132]

Has anyone figured out how to successfully whitelist QVC? I've added their IP address 167.140.19.0/24 in the VPN rules table to put it on the WAN, and I tried adding the AS number AS15086 in vpnclient1-route-up and vpnclient2-route-up then restarting both VPNs, but QVC still detects that I'm on a VPN by giving me an Access Denied.

 

[Xentrk]

Hi Xentrk,
it looks like a lot of time for testing. I will do that, if I have some freetime in my holidays. But if amazon prime will add or change the streaming adresses, I will have to repeat the procedure , right? The IP adress you mentioned in step 5 (192.168.1.150) should be changed to the IP of my router or the IP of my device I streamed ?

Thanks a lot again for your reply and your support.

Hugo.

I did some experimenting with my IPSET lists and didn't run updates for over a year and didn't have a problem. Once you get it working, I can show you how to automate so it will update the list. If you have an issue, then you may need to see if a new domain name got added. I had issues on my Roku recently where a new domain was added for the cloud DVR servie that was in the block list. If the streaming service didn't get a reply, it couldn't play the show.

I updated the "true" line as follows:

true > /opt/tmp/PRIME

 

[mister]

Hi Xentrk,
it seems to me, that there is a bigger bug in my configuration.
Suddenly Amazon was no longer rooted properly.
Liststats showed

su@RT-AC86U-7298:/tmp/home/root# liststats
AMAZON-14618 - 0
AMAZON-16509 - 0
AMAZON-GLOBAL - 0

I was very surprised, rebooted but no success.
That was my nat-start
#!/bin/sh
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 NETFLIX-812 AS812
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 NETFLIX-2906 AS2906
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 NETFLIX-14618 AS14618
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 NETFLIX-394406 AS394406
sh /jffs/scripts/x3mRouting/load_AMAZON_ipset_iface.sh 0 AMAZON-GLOBAL GLOBAL
sh /jffs/scripts/x3mRouting/load_AMAZON_ipset_iface.sh 0 AMAZON-EU DE
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 AMAZON-16509 AS16509
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 AMAZON-14618 AS14618

Neither the AMAZON-EU DE (Germany?) nor the AMAZON-EU EU worked --> no population.
I deleted this entry completely and after switching the router of via hardware switch and rebooting I got an population of the ASN entries but no population of the AMAZON Global lists:

su@RT-AC86U-7298:/tmp/home/root# liststats
AMAZON-14618 - 267
AMAZON-16509 - 3932
AMAZON-EU - 0

or
ASUSWRT-Merlin RT-AC86U 384.15_0 Sat Feb 8 18:41:28 UTC 2020
su@RT-AC86U-7298:/tmp/home/root# liststats
AMAZON-14618 - 267
AMAZON-16509 - 3932
AMAZON-GLOBAL - 0

Maybe I am using the script in a wrong way ?! Maybe that could be the reason for my other problems as well ....
Do you have an idea what I did wrong ?

Thanks a lot

Hugo

PS: Maybe I should add: I am using the nat-start file only for entries, which should be routed via WAN instead on VPN. For the VPN1 or VPN2 routing I am using the route1-up method you described... I don´t think that there should be a problem with that fact, because only wan is adressed but I want to add it for your information.

 

[Xentrk]

Hi Xentrk,
it seems to me, that there is a bigger bug in my configuration.
Suddenly Amazon was no longer rooted properly.
Liststats showed

su@RT-AC86U-7298:/tmp/home/root# liststats
AMAZON-14618 - 0
AMAZON-16509 - 0
AMAZON-GLOBAL - 0

I was very surprised, rebooted but no success.
That was my nat-start
#!/bin/sh
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 NETFLIX-812 AS812
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 NETFLIX-2906 AS2906
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 NETFLIX-14618 AS14618
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 NETFLIX-394406 AS394406
sh /jffs/scripts/x3mRouting/load_AMAZON_ipset_iface.sh 0 AMAZON-GLOBAL GLOBAL
sh /jffs/scripts/x3mRouting/load_AMAZON_ipset_iface.sh 0 AMAZON-EU DE
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 AMAZON-16509 AS16509
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 0 AMAZON-14618 AS14618

Neither the AMAZON-EU DE (Germany?) nor the AMAZON-EU EU worked --> no population.
I deleted this entry completely and after switching the router of via hardware switch and rebooting I got an population of the ASN entries but no population of the AMAZON Global lists:

su@RT-AC86U-7298:/tmp/home/root# liststats
AMAZON-14618 - 267
AMAZON-16509 - 3932
AMAZON-EU - 0

or
ASUSWRT-Merlin RT-AC86U 384.15_0 Sat Feb 8 18:41:28 UTC 2020
su@RT-AC86U-7298:/tmp/home/root# liststats
AMAZON-14618 - 267
AMAZON-16509 - 3932
AMAZON-GLOBAL - 0

Maybe I am using the script in a wrong way ?! Maybe that could be the reason for my other problems as well ....
Do you have an idea what I did wrong ?

Thanks a lot

Hugo

PS: Maybe I should add: I am using the nat-start file only for entries, which should be routed via WAN instead on VPN. For the VPN1 or VPN2 routing I am using the route1-up method you described... I don´t think that there should be a problem with that fact, because only wan is adressed but I want to add it for your information.

I suspect you are experiencing the 'jq' entware package I reported in January. The 'jq' package is required to parse through the aws json file. Please see how to patch in this forum post until the entware package is updated.

Update:
@Jack Yaz posted a possble fix on the GitHub issue page. https://github.com/Entware/Entware/issues/391

I will try it when I get home from work and see if it resolves the issue

The new version of x3mRouting will require the openvpn-event file. The new version will automatically post the code to the vpnclientX-route-up to run the script which creates the routing rules and the vpnclientX-route-pre-down to remove the routing rule when the vpn client goes down. There is one edge case where one has to call the script from nat-start if using the GUI method when combined with the first method for specifying LAN clients. I plan to do some analysis on that one to see if I can eliminate nat-start all together.

 

[mister]

Ok, than I will wait till the next update of the script.
may I ask a few questions concering your last reply:

1. Do I have to modify my nat-start or routup file manually or will the updated script migrates my configuration? Currently I have the nat-start configuration for all WAN routing rules and the VPNClient1-up (or route-up) and -down configuration. As I wrote somedays before, I am using the VPNfailover script as well, so VPN1&2 have the same configuration and VPN3&4 have the same as well. VPN5 is reserved for the guest WIFI. It would be nice if you could add an how to migrate text on your github page or post it here.

2. Regarding the Amazon routing. Could you explain please, what you have to add if you are using Amazon-EU routing rules as the second parameter. Your country code or EU

AMAZON-EU DE (For Germany) or AMAZON-EU EU


3. If you are using the GLOBAL Version: Does it mean, that all Amazon regions are included or are that special IPs you have to combine with your region (e.g. EU)

4. If you are using the AMAZON file, are the ASN entries necassary for prime video or not ?


Sorry for these many questions, but I didn´t understand it up to now.

Thanks a lot for your support again.

Hugo

 

[Xentrk]

The jq package appears to have been updated on entware. I am happy to report that the following command fixed the jq entware package issue I was having.

opkg update && opkg remove --autoremove jq && opkg install jq

Thank you @Jack Yaz

 

[Xentrk]

Ok, than I will wait till the next update of the script.
may I ask a few questions concering your last reply:

Is there anything stopping you from using the current version of x3mRouting?

1. Do I have to modify my nat-start or routup file manually or will the updated script migrates my configuration? Currently I have the nat-start configuration for all WAN routing rules and the VPNClient1-up (or route-up) and -down configuration. As I wrote somedays before, I am using the VPNfailover script as well, so VPN1&2 have the same configuration and VPN3&4 have the same as well. VPN5 is reserved for the guest WIFI. It would be nice if you could add an how to migrate text on your github page or post it here.

I have been thinking about the migration as I have been updating the code. But I haven't gotten that far yet. I need to finish all of the code first to see the full impact. I will document the process along with any manual steps that may be required to convert over to the new version.

2. Regarding the Amazon routing. Could you explain please, what you have to add if you are using Amazon-EU routing rules as the second parameter. Your country code or EU

AMAZON-EU DE (For Germany) or AMAZON-EU EU

Following is how I group the regions together:

case "$REGION" in
    AP)
      REGION="ap-east-1 ap-northeast-1 ap-northeast-2 ap-northeast-3 ap-south-1 ap-southeast-1 ap-southeast-2"
      ;;
    CA)
      REGION="ca-central-1"
      ;;
    CN)
      REGION="cn-north-1 cn-northwest-1"
      ;;
    EU)
      REGION="eu-central-1 eu-north-1 eu-west-1 eu-west-2 eu-west-3"
      ;;
    SA)
      REGION="sa-east-1"
      ;;
    US)
      REGION="us-east-1 us-east-2 us-west-1 us-west-2"
      ;;
    GV)
      REGION="us-gov-east-1 us-gov-west-1"
      ;;
    GLOBAL)
      REGION="GLOBAL"

3. If you are using the GLOBAL Version: Does it mean, that all Amazon regions are included or are that special IPs you have to combine with your region (e.g. EU)

I also have the same question. According to the aws documentaiton, each region is separate. It does appear as if the CIDR ranges do cast a wide net to cover the other regions.

4. If you are using the AMAZON file, are the ASN entries necassary for prime video or not ?

I only require the US Region for Amazon Prime. I don't use the Amazon ASN numbers. AS16509 also works for me though. There shouldn't be a need to use both. When I first experienced the 'jq' issue, switching over to AS16509 was my recommended work around.

 

[mister]

Okay, I updated jq as you wrote and I will check, if the Amazon EU rooting rules will populated.
If I understood you in the right way, I can will use the command AMAZON-EU EU only.

Update: they are populated. I will check if prime video is working.

Thanks a lot.

Regarding the new version of your script:
I think a lot of people here are using the GUI for routing all the traffic via a specific VPN for dedicated clients (Policy rules) in combination with the script ones.

Will there be a possibility to downgrade in the case, the upgraded version of your script would not work with the old configuration ?
As far as I can see , a downgrade is currently not possible right ?

 

[Dew]

Hi all,

I installed option 1 but i don't seems to see a file in /jffs/configs/x3mRouting_client_rules?

I have tried to re-read the wiki, reinstall from amtm but i am at a loss here.

 

[Pak Kriss]

It's very likely I missed something. But if I see this in the log, then I need to hit the "Apply" button of the VPN to get the selective routing back:
Mar 6 20:33:43 kernel: SHN Release Version: 2.0.1 890c91d
Mar 6 20:33:43 kernel: UDB Core Version: 0.2.18
Mar 6 20:33:43 kernel: sizeof forward pkt param = 280

If I enabled bandwidth QoS I had regular similar issues, so I switched it off. But I sure I missed some part of selective routing.

-rw-rw-rw- 1 admin root 77649 Feb 8 17:34 Advanced_OpenVPNClient_Content.asp
-rwxr-xr-x 1 admin root 8633 Feb 8 17:34 load_AMAZON_ipset.sh*
-rwxr-xr-x 1 admin root 7413 Feb 8 17:34 load_ASN_ipset.sh*
-rwxr-xr-x 1 admin root 10634 Feb 8 17:34 load_DNSMASQ_ipset.sh*
-rwxr-xr-x 1 admin root 6851 Feb 8 17:34 load_MANUAL_ipset.sh*
-rwxr-xr-x 1 admin root 1373 Feb 8 17:34 mount_files_gui.sh*
-rwxr-xr-x 1 admin root 2257 Feb 17 08:13 openvpn-event*
-rwxr-xr-x 1 admin root 5377 Feb 8 17:34 updown-client.sh*
-rwxr-xr-x 1 admin root 307 Feb 22 19:48 vpnclient1-route-up*
-rwxr-xr-x 1 admin root 16813 Feb 8 17:34 vpnrouting.sh*

#!/bin/sh
logger -st "($(basename "$0"))" $$ Starting Script Execution

sh /jffs/scripts/x3mRouting/load_MANUAL_ipset.sh GOOGLEASN
sh /jffs/scripts/x3mRouting/load_MANUAL_ipset.sh IPWIDGET
sh /jffs/scripts/x3mRouting/load_MANUAL_ipset.sh SGSLASN

logger -st "($(basename "$0"))" $$ Endting Script Execution


-rw-rw-rw- 1 admin root 8020 Feb 17 08:50 GOOGLEASN
-rw-rw-rw- 1 admin root 200 Mar 7 02:00 IPWIDGET
-rw-rw-rw- 1 admin root 16450 Feb 22 19:48 SGSLASN
drwxrwxrwx 3 admin root 4096 Sep 9 08:04 opt/

 

[Xentrk]

Hi all,

I installed option 1 but i don't seems to see a file in /jffs/configs/x3mRouting_client_rules?

I have tried to re-read the wiki, reinstall from amtm but i am at a loss here.

You have to run x3mRouting_client_config.sh to create the file /jffs/configs/x3mRouting_client_rules

You can then edit /jffs/configs/x3mRouting_client_rules to create the routing rules.

The next step is to run x3mRouting_client_nvram.sh to create the nvram values.

And just like you do in the gui screen, you have to bounce the vpn client so the rules will take affect. Rerun the x3mRouting_client_nvram.sh and bounce the vpn client instance if you ever make changes to the /jffs/configs/x3mRouting_client_rules file so the update rules will take effect.

 

[Dew]

You have to run x3mRouting_client_config.sh to create the file /jffs/configs/x3mRouting_client_rules

You can then edit /jffs/configs/x3mRouting_client_rules to create the routing rules.

The next step is to run x3mRouting_client_nvram.sh to create the nvram values.

And just like you do in the gui screen, you have to bounce the vpn client so the rules will take affect. Rerun the x3mRouting_client_nvram.sh and bounce the vpn client instance if you ever make changes to the /jffs/configs/x3mRouting_client_rules file so the update rules will take effect.

Hi thank you!!

I am such a noob as I thought the installation will install the scripts automatically. Anyway, I manage to get option 1 working but i want to have only specific clients using the VPN only when accessing netflix. How can i achieve that? I tried option 2 with these options on the routing screen but all traffic seems to be going through the VPN instead of netflix only (check what is my IP and yahoo directed to that country page). Can you see what am i doing wrong?

sh /jffs/scripts/x3mRouting/load_ASN_ipset.sh NETFLIX AS2906

 

[Xentrk]

Hi thank you!!

I am such a noob as I thought the installation will install the scripts automatically. Anyway, I manage to get option 1 working but i want to have only specific clients using the VPN only when accessing netflix. How can i achieve that? I tried option 2 with these options on the routing screen but all traffic seems to be going through the VPN instead of netflix only (check what is my IP and yahoo directed to that country page). Can you see what am i doing wrong?

sh /jffs/scripts/x3mRouting/load_ASN_ipset.sh NETFLIX AS2906

I will look into automatically generating /jffs/configs/x3mRouting_client_rules in the next release when option 1 is selected.

Currently, the rule above says that all LAN clients that generate traffic matching the NETFLIX ipset list will get routed thru the VPN Client. If you want to only specify the rule to specific LAN clients, you will need to enter the IP address of the LAN clients in the Source IP field. You can also specify a CIDR range if you have more than one address.

Unfortunately, the GUI does not support the routing of IPSET lists to the WAN iface (vpn bypass). If you need to bypass the VPN Client matching Netflix traffic for specific LAN clients, see this post for the set-up instructions.

I am automating the set-up in the next release.

 

[Xentrk]

It's very likely I missed something. But if I see this in the log, then I need to hit the "Apply" button of the VPN to get the selective routing back:
Mar 6 20:33:43 kernel: SHN Release Version: 2.0.1 890c91d
Mar 6 20:33:43 kernel: UDB Core Version: 0.2.18
Mar 6 20:33:43 kernel: sizeof forward pkt param = 280

If I enabled bandwidth QoS I had regular similar issues, so I switched it off. But I sure I missed some part of selective routing.

-rw-rw-rw- 1 admin root 77649 Feb 8 17:34 Advanced_OpenVPNClient_Content.asp
-rwxr-xr-x 1 admin root 8633 Feb 8 17:34 load_AMAZON_ipset.sh*
-rwxr-xr-x 1 admin root 7413 Feb 8 17:34 load_ASN_ipset.sh*
-rwxr-xr-x 1 admin root 10634 Feb 8 17:34 load_DNSMASQ_ipset.sh*
-rwxr-xr-x 1 admin root 6851 Feb 8 17:34 load_MANUAL_ipset.sh*
-rwxr-xr-x 1 admin root 1373 Feb 8 17:34 mount_files_gui.sh*
-rwxr-xr-x 1 admin root 2257 Feb 17 08:13 openvpn-event*
-rwxr-xr-x 1 admin root 5377 Feb 8 17:34 updown-client.sh*
-rwxr-xr-x 1 admin root 307 Feb 22 19:48 vpnclient1-route-up*
-rwxr-xr-x 1 admin root 16813 Feb 8 17:34 vpnrouting.sh*

#!/bin/sh
logger -st "($(basename "$0"))" $$ Starting Script Execution

sh /jffs/scripts/x3mRouting/load_MANUAL_ipset.sh GOOGLEASN
sh /jffs/scripts/x3mRouting/load_MANUAL_ipset.sh IPWIDGET
sh /jffs/scripts/x3mRouting/load_MANUAL_ipset.sh SGSLASN

logger -st "($(basename "$0"))" $$ Endting Script Execution


-rw-rw-rw- 1 admin root 8020 Feb 17 08:50 GOOGLEASN
-rw-rw-rw- 1 admin root 200 Mar 7 02:00 IPWIDGET
-rw-rw-rw- 1 admin root 16450 Feb 22 19:48 SGSLASN
drwxrwxrwx 3 admin root 4096 Sep 9 08:04 opt/



View attachment 21794

Perform some of the Troubleshooting steps to see if the RPDB and iptables routing rules got created properly.

If you still have an issue, update the firmware to 384.15. Then, run x3mRouting and update the installation to get all of the changes since 384.15.

 

[Dew]

I will look into automatically generating /jffs/configs/x3mRouting_client_rules in the next release when option 1 is selected.

Currently, the rule above says that all LAN clients that generate traffic matching the NETFLIX ipset list will get routed thru the VPN Client. If you want to only specify the rule to specific LAN clients, you will need to enter the IP address of the LAN clients in the Source IP field. You can also specify a CIDR range if you have more than one address.

Unfortunately, the GUI does not support the routing of IPSET lists to the WAN iface (vpn bypass). If you need to bypass the VPN Client matching Netflix traffic for specific LAN clients, see this post for the set-up instructions.

I am automating the set-up in the next release.

I specify the client IP address into the rule set but netflix on iphone (192.168.2.11) don't seems to be going through the VPN.

admin@RT-AC68U-8320:/tmp/home/root# iptables -nvL PREROUTING -t mangle --line
Chain PREROUTING (policy ACCEPT 2071 packets, 469K bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        1    60 MARK       all  --  tun11  *       0.0.0.0/0            0.0.0.0/0            MARK xset 0x1/0x7
2     3939 1285K MARK       all  --  br0    *       0.0.0.0/0            0.0.0.0/0            match-set NETFLIX dst MARK or 0x8000
3      190 67051 MARK       all  --  br0    *       192.168.2.11         0.0.0.0/0            match-set NETFLIX dst MARK or 0x1000

 

[Xentrk]

I specify the client IP address into the rule set but netflix on iphone (192.168.2.11) don't seems to be going through the VPN.

admin@RT-AC68U-8320:/tmp/home/root# iptables -nvL PREROUTING -t mangle --line
Chain PREROUTING (policy ACCEPT 2071 packets, 469K bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        1    60 MARK       all  --  tun11  *       0.0.0.0/0            0.0.0.0/0            MARK xset 0x1/0x7
2     3939 1285K MARK       all  --  br0    *       0.0.0.0/0            0.0.0.0/0            match-set NETFLIX dst MARK or 0x8000
3      190 67051 MARK       all  --  br0    *       192.168.2.11         0.0.0.0/0            match-set NETFLIX dst MARK or 0x1000

The conflict may be due to Line 2 which makes all Netflix traffic on the LAN get routed to the WAN. That will get the first match. You should delete it as traffic will default to the WAN unless you have an exception rule as you do in line 3.

iptables -t mangle -D PREROUTING 2

Line 3 shows that 190 packets have traversed the iptables chain. What error msg do you get on Netflix? Do you get a proxy error? NF blocks many VPN services.