Asus 86u running merlin not routing

[Mikeyg76]

Good afternoon,

i am having the following issue, on my old ASUS 68u running merlin i was able to add as many clients to my VPN redirect list, but now I am having the issue that on my new Asus 86u that only 6 clients can be routed on VPN, even though I have more then that listed to go through the WAN. I have around 10 IP's i would like to not hit my VPN, but for some reason only 6 will be excluded. Also I am running 384.7_2 Thanks

Nov 24 14:18:32 openvpn-updown: Forcing 192.168.50.0/24 to use DNS server 10.18.252.1
Nov 24 14:18:32 openvpn-updown: Excluding 192.168.50.76 from forced DNS routing
Nov 24 14:18:32 openvpn-updown: Excluding 192.168.50.10 from forced DNS routing
Nov 24 14:18:32 openvpn-updown: Excluding 192.168.50.157 from forced DNS routing
Nov 24 14:18:32 openvpn-updown: Excluding 192.168.50.129 from forced DNS routing
Nov 24 14:18:32 openvpn-updown: Excluding 192.168.50.184 from forced DNS routing
Nov 24 14:18:32 openvpn-updown: Excluding 192.168.50.20 from forced DNS routing
Nov 24 14:18:32 rc_service: service 12754:notify_rc updateresolv
Nov 24 14:18:37 ovpn-client2[12597]: /bin/ip route add 46.21.151.106/32 via 47.208.228.1
Nov 24 14:18:37 ovpn-client2[12597]: /bin/ip route add 0.0.0.0/1 via 10.18.252.1
Nov 24 14:18:37 ovpn-client2[12597]: /bin/ip route add 128.0.0.0/1 via 10.18.252.1
Nov 24 14:18:37 openvpn-routing: Configuring policy rules for client 2
Nov 24 14:18:37 ovpn-client2[12597]: Initialization Sequence Completed

 

[wesbez]

Is it the 86 or the 68 because you’ve noted both.

 

[Mikeyg76]

Is it the 86 or the 68 because you’ve noted both.

Sorry it’s for the 86u. Thanks

 

[Mikeyg76]

Is there a line of command that I can put in to allow more time for the router to pick up the remaining IP’s to be routed?

 

[CaptainSTX]

Are you using policy based routing as an option under the VPN client?

With policy based routing the default bypasses the VPN (WAN) then you only need to list the IPs of the devices you want to route through the VPN client.

However personally I like to list all IPs so I positively know which devices are going WAN and which are using the VPN. I have twelve devices included in my list.

Also FYI I am running Merlin 7.2 on an AC1900P and it says the list under policy routing is limited to 100 devices/IPs.

 

[john9527]

Check the name you entered for the 7th client and make sure it doesn't contain any special or double-byte characters.

 

[octopus]

Also FYI I am running Merlin 7.2 on an AC1900P

There is no Merlin 7.2 Software.
https://www.snbforums.com/threads/a...d-forks-on-non-asus-devices-is-illegal.44636/

 

[john9527]

Also, please post the output of

nvram show | grep vpn_client2_clientlist

 

[wesbez]

There is no Merlin 7.2 Software.

He means 384.7_2 it’s shorthand like for eg instead of saying RT-AC86U we would say 86U

 

[octopus]

He means 384.7_2 it’s shorthand like for eg instead of saying RT-AC86U we would say 86U

ok

 

[Mikeyg76]

Are you using policy based routing as an option under the VPN client?

With policy based routing the default bypasses the VPN (WAN) then you only need to list the IPs of the devices you want to route through the VPN client.

However personally I like to list all IPs so I positively know which devices are going WAN and which are using the VPN. I have twelve devices included in my list.

Also FYI I am running Merlin 7.2 on an AC1900P and it says the list under policy routing is limited to 100 devices/IPs.

Hi, Thanks for the reply, yes I am using policy based routing, I have tried both policy rules and policy rules strict. I have had upto ten listed in my old router and everything was fine, it’s jiat strange that it stops at the sixth one.

I have always listed the IP's i want the VPN to ignore, but i guess for now i will list the IPs to route through the VPN.

 

[Mikeyg76]

Also, please post the output of

nvram show | grep vpn_client2_clientlist

vpn_client1_clientlist=<LAN>192.168.50.0/24>0.0.0.0>VPN<FAMILY-PC>192.168. 50.165>0.0.0.0>WAN<XBOXONES>192.168.50.10>0.0.0.0>WAN<iPhone6s>192.168.50 .154>0.0.0.0>WAN< iPhone>192.168.50.184>0.0.0.0>WAN<XBOXONE X>192.168.50.76 >0.0.0.0>WAN<iPad>192.168.50.20>0.0.0.
vpn_client1_clientlist1=0>WAN<Echo Kitchen>192.168.50.157>0.0.0.0>WAN<Echo Famil yroom>192.168.50.129>0.0.0.0>WAN

Everything is listed under that, but still under the system log it shows only 6 and the two that are not listed are still behind the VPN (checked the IP's, they show my true IP), which is not want i want, I moved everything to client1 to see if it would work there and still the same error.

Nov 25 12:36:14 openvpn-updown: Forcing 192.168.50.0/24 to use DNS server 10.26.124.1
Nov 25 12:36:14 openvpn-updown: Excluding 192.168.50.165 from forced DNS routing
Nov 25 12:36:14 openvpn-updown: Excluding 192.168.50.10 from forced DNS routing
Nov 25 12:36:14 openvpn-updown: Excluding 192.168.50.154 from forced DNS routing
Nov 25 12:36:14 openvpn-updown: Excluding 192.168.50.184 from forced DNS routing
Nov 25 12:36:15 openvpn-updown: Excluding 192.168.50.76 from forced DNS routing
Nov 25 12:36:15 openvpn-updown: Excluding 192.168.50.20 from forced DNS routing
Nov 25 12:36:15 rc_service: service 5661:notify_rc updateresolv
Nov 25 12:36:21 ovpn-client1[5509]: /bin/ip route add 94.100.23.162/32 via 47.208.228.1
Nov 25 12:36:21 ovpn-client1[5509]: /bin/ip route add 0.0.0.0/1 via 10.26.124.1
Nov 25 12:36:21 ovpn-client1[5509]: /bin/ip route add 128.0.0.0/1 via 10.26.124.1
Nov 25 12:36:21 openvpn-routing: Configuring policy rules for client 1
Nov 25 12:36:21 ovpn-client1[5509]: Initialization Sequence Completed
Nov 25 12:37:51 dropbear[5946]: Password auth succeeded for 'asus' from 192.168.50.21:54952

Here is how it is listed on my list:

LAN 192.168.50.0/24 0.0.0.0 VPN
FAMILY-PC 192.168.50.165 0.0.0.0 WAN
XBOXONES 192.168.50.10 0.0.0.0 WAN
iPhone6s 192.168.50.154 0.0.0.0 WAN
iPhone 192.168.50.184 0.0.0.0 WAN
XBOXONE X 192.168.50.76 0.0.0.0 WAN
iPad 192.168.50.20 0.0.0.0 WAN
EchoKitchen 192.168.50.157 0.0.0.0 WAN
EchoFamilyroom 192.168.50.129 0.0.0.0 WAN

 

[Mikeyg76]

Also here is my custom commands:

resolv-retry infinite
auth-nocache
route-delay 5
explicit-exit-notify 5
remote-cert-tls server

 

[Mikeyg76]

Alright so i did a test and added another iphone to the excluded list, even though it will not show up on my system log i can confirm that it shows my true IP, but it still shows VPN's DNS. On the first 6 on the list, nothing shows but my true information, allowing those 6 to access the sites i want them to, on the rest they show my true ip. but vpn's dns which causes me not to be bale t visit the sites i want, which means to me that there is a issue.

 

[john9527]

vpn_client1_clientlist=<LAN>192.168.50.0/24>0.0.0.0>VPN<FAMILY-PC>192.168. 50.165>0.0.0.0>WAN<XBOXONES>192.168.50.10>0.0.0.0>WAN<iPhone6s>192.168.50 .154>0.0.0.0>WAN< iPhone>192.168.50.184>0.0.0.0>WAN<XBOXONE X>192.168.50.76 >0.0.0.0>WAN<iPad>192.168.50.20>0.0.0.
vpn_client1_clientlist1=0>WAN<Echo Kitchen>192.168.50.157>0.0.0.0>WAN<Echo Famil yroom>192.168.50.129>0.0.0.0>WAN

Everything is listed under that, but still under the system log it shows only 6 and the two that are not listed are still behind the VPN (checked the IP's, they show my true IP), which is not want i want, I moved everything to client1 to see if it would work there and still the same error.

I think this is something @RMerlin is going to need to check. Because of a limitation in the HND SDK, he needed to break the vpn clientlist defs into 255 byte chunks. It looks like it's stopping at the first chunk 'clientlist' and not reading 'clientlist1' (the part that overflowed to the next chunk for the 6th entry would be defaulted to what you intended).

 

[RMerlin]

Are you using the firmware's vpnrouting.sh script, or a customized one? The firmware's built-in script should properly append all entries.

https://github.com/RMerl/asuswrt-merlin.ng/blob/master/release/src/router/others/vpnrouting.sh#L114

I just tested it with a bunch of entries split across two variables, all clients are there:

admin@stargate88ax:/tmp/home/root# ip rule
0:    from all lookup local
10501:    from 192.168.10.105 lookup ovpnc3
10502:    from 192.168.10.80 lookup ovpnc3
10503:    from 192.168.10.81 lookup ovpnc3
10504:    from 192.168.10.82 lookup ovpnc3
10505:    from 192.168.10.83 lookup ovpnc3
10506:    from 192.168.10.85 lookup ovpnc3
10507:    from 192.168.10.86 lookup ovpnc3
10508:    from 192.168.10.87 lookup ovpnc3
10509:    from 192.168.10.88 lookup ovpnc3
10510:    from 192.168.10.89 lookup ovpnc3
32766:    from all lookup main
32767:    from all lookup default

 

[john9527]

@Mikeyg76
Are you using any of @Martineau 's script packages? I think he may package a customized vpnrouting with some of them.

 

[Martineau]

@Mikeyg76
Are you using any of @Martineau 's script packages? I think he may package a customized vpnrouting with some of them.

I don't distribute vpnrouting.sh, but I do post code snippets to show how I have made useful tweaks
e.g. Streamline ugly code etc.

VPN_UNIT=${dev:4:1}

if [ "${dev:0:4}" == "tun1" ];then
    VPN_IP_LIST=$(nvram get vpn_client${VPN_UNIT}_clientlist)$(nvram get vpn_client${VPN_UNIT}_clientlist1)$(nvram get vpn_client${VPN_UNIT}_clientlist2)$(nvram get vpn_client${VPN_UNIT}_clientlist3)$(nvram get vpn_client${VPN_UNIT}_clientlist4)$(nvram get vpn_client${VPN_UNIT}_clientlist5)
    ########################################################################################## Martineau Hack 8 of 13
    #   Selective routing entries are limited to 99 VPN rules regardless if there is 1 or 99 WAN rules!
    #   Sort the rules into WAN,VPN order then simply set the base VPN PRIO to the number of WAN entries + 1
    #   Now we can have up to 199!! 
    VPN_IP_LIST=$(Sort "$VPN_IP_LIST")
    VPN_REDIR=$(nvram get vpn_client${VPN_UNIT}_rgw)
    VPN_FORCE=$(nvram get vpn_client${VPN_UNIT}_enforce)
    VPN_LOGGING=$(nvram get vpn_client${VPN_UNIT}_verb)
else
    # Assume OpenVPN Server 'tun21' or 'tun22'
    run_custom_script
    exit 0
fi

I suggest that the OP uses

to see if Syslog highlights additional info, otherwise the OP will need to provide a debug trace.

 

[john9527]

I don't distribute vpnrouting.sh, but I do post code snippets to show how I have made useful tweaks

Thanks for the clarification...wasn't sure if any changes were needed for your magic

 

[john9527]

@RMerlin
It's actually updown.sh that's missing the concatenation for clientlist

https://github.com/RMerl/asuswrt-merlin.ng/blob/master/release/src/router/others/updown.sh#L13