[GUIDE] PPTP selective routing / split tunnel

[RMerlin]

Any plans for Merlin FW to implement policy based routing similarly to OpenVPN?

None.

 

[sambosoul]

Hello everyone,

Thank you all very much for sharing your knowledge, I am a greenhorn when it comes to scripting so please bear with me

A few information about my setup:

Asus AC66U router
Router IP: 192.168.1.1
Subnet: 255.255.255.0
Device IP I would like to be routed through PPTP VPN: 192.168.1.140

I carried out all aforementioned steps but something isn't quite working because when I fire up the PPTP VPN client then all devices are assigned to the tunnel, not just the client device mentioned above. Here are my scripts:

PPTP-UP

#!/bin/sh
/jffs/scripts/vpnc-ip-up $@

VPN_GW="192.168.1.140"
VPN_SUBNET="192.168.1.0"
VPN_NETMASK="255.255.255.0"
VPN_DEV="ppp5"

ip route delete default via ${VPN_GW} dev ${VPN_DEV}
route -n add -net ${VPN_SUBNET} netmask ${VPN_NETMASK} ${VPN_DEV}
ip route add default dev ${VPN_DEV} table 3
logger Traffic to ${VPN_GW} dev ${VPN_DEV} configured for split tunnel

Services-Start

#!/bin/sh
logger Installing pptp script
sleep 20
cd /tmp/ppp/
rm /tmp/ppp/vpnc-ip-up
ln -s /jffs/scripts/pptp-up.sh vpnc-ip-up
service restart_vpncall
logger pptp script installed

Both scripts are set to Octal 0777

PPTP VPN is interface ppp5, I have assigned a static IP in the DHCP settings for the client device to IP address 192.168.1.140. No static routes were configured.

many thanks for your guidance.

 

[Martineau]

<snip>...when I fire up the PPTP VPN client then all devices are assigned to the tunnel, not just the client device 192.168.1.140

I suspect the script did not correctly remove the default route to ppp5

Issue:

ip route | grep default

and see if there are two default directives..there should only be one if you intend to use selective routing.

Also, having created custom route table 3, you need to create the RPDB rule for device 192.168.1.140 to use routing table 3

e.g.

ip rule add from 192.168.1.140 table 3 prio 9000
ip route flush cache

ip rule