Help routing VPN to LAN Port

[ooklathemok]

I have seen the question in the forum a few times, but no answers as I search. So, it's either incredibly easy and I am missing something or not possible?

My desired setup is this:
RT-AC68U as the main router.
My Apple Airport Extreme Base Station in bridge mode as VPN.

This way, I can switch SSIDs on devices to be on my ISP or VPN. It seems backwards because the locked down Airport cannot use a VPN, but I just got the RT AC68U and trust it to manage the internet better.

OpenVPN is setup with GUI and working currently but how do I get the ASUSwrt to route the VPN to only a single LAN port? Assuming I will have to use jffs and iptables but I am a bit lost. Perhaps combining info in the selective routing thread and using the info from this thread about the ports would be a good place to start?

Or does anyone have a suggestion for better search terms? Sorry for being so green. Just opened the box today and installed RMerlin's firmware. Previously I had an old Buffalo router with DD-WRT running my VPN.

 

[ooklathemok]

tutorials for learning iptables

Well, obviously I am a total leech just showing up here and asking for help. So it's time to back the train up and start from the beginning. I've found two sites to help me learn iptables:

http://artoflinux.blogspot.ca/2008/07/iptables-tutorial-for-beginners.html

http://www.garron.me/en/linux/iptables-manual.html

I guess I'll start here. I'm not entirely sure how to single out the ethernet ports on the back of the router but that's getting way ahead of myself. Maybe it's not even possible? Have a great weekend.

 

[ooklathemok]

Using sinshiva's post, I think I see how to single out the ehternet LAN port on the back of the ASUS router and assign it to a vlan.

From the system logs and other posts here, I see that my OpenVPN connection is tun11.

Now, I just need to figure out a rule or filter to send the VPN to a vlan. Though, I am uncertain what happens to the rest of the traffic. Using sinshiva's method above, creating vlan 1 and vlan 4, I suppose I would need a rule for vlan 1 as well.

 

[hardtotell]

Maybe possible. Try Google this, "iptables acts on routing, while ebtables acts on switching"

1. Use robocfg to reconfigure the VLANs of your router. Example: How to move the Ethernet LAN port#4 from VLAN1 to a new VLAN, named 'VLAN10'.

/jffs/scripts/firewall-start

robocfg vlan 1 ports "1 2 3 5t"
robocfg vlan 10 ports "4 5t"
vconfig add eth0 10
ifconfig vlan10 up
brctl addif br0 vlan10
# TODO: add ebtables rules here

2. Now use ebtables to handle the switching. See I did something different, but I think it's the same idea.
Force LAN port 4 to use the Guest network for Asus/merlin RT-AC68U
http://www.smallnetbuilder.com/forums/showthread.php?t=18969

 

[ooklathemok]

Thank you so much. I had a link to your thread as well.
And thank you for the search suggestion. I am starting to understand the scripts I am reading here, but I didn't know the difference between ebtables and iptables. Obviously, I have more learning to do.

Asuswrt-Merlin seems pretty great so I want to take advantage of it to manage my home. Currently, I have it behind the Airport Extreme Base Station which is woefully locked down. However, I suppose this will allow me to experiment with these scripts and still have internet.

 

[Alfsu]

Traffic to VPN

My desired setup is this:
RT-AC68U as the main router.
My Apple Airport Extreme Base Station in bridge mode as VPN.

Do you mean having the AC68U connected to ISP and also having a VPN tunnel, with the Airport router bridged behind it? and you want all devices connected to the Airport to route through the VPN?

If so, I would do the following (using the selective routing thread):

On the 68U, add a selective route to direct all traffic to the VPN for the IP assigned to the WAN port of the Airport router (make it a static IP).

If the above route alone doesn't work, then add another selective route for the subnet used in the Airport router.

I figure in this scenario, you have to use the Airport in AP mode, and if available, disable NAT on it.

Good luck!