A
andrew2018
Guest
Hi everyone, I've tried everything I can think of but can't find a solution to a routing problem. I have a RT-AC68U (a genuine one running Merlin 384.6) with two separate VPN connections. I'm using scripts (thanks to Martineau and others) that set up policy-based routing using ipsets.
It all works great except when one of the VPN connections drops or I take it down manually. Traffic that I want to go out only via that VPN connection starts going out via the WAN connection instead and keeps doing that even when the VPN connection comes back up.
I've been testing it by putting a couple of useful web sites like dnsleaktest.com and whatismyipaddress.com in different ipsets so I can tell whether they are seeing my traffic through a VPN or the WAN.
Can someone see what I'm missing please? Thanks for any help.
nat-start script
services-start script
When VPN connections come up, I also run a script that restarts dnsmasq.
dnsmasq.conf.add
It all works great except when one of the VPN connections drops or I take it down manually. Traffic that I want to go out only via that VPN connection starts going out via the WAN connection instead and keeps doing that even when the VPN connection comes back up.
I've been testing it by putting a couple of useful web sites like dnsleaktest.com and whatismyipaddress.com in different ipsets so I can tell whether they are seeing my traffic through a VPN or the WAN.
Can someone see what I'm missing please? Thanks for any help.
nat-start script
Code:
#!/bin/sh
ip rule del prio 9990
ip rule add fwmark 0x7000 table main prio 9990
ip rule del fwmark 0x1000
ip rule add fwmark 0x1000 table ovpnc1 prio 9991
ip rule del fwmark 0x2000
ip rule add fwmark 0x2000 table ovpnc2 prio 9992
# WAN (traffic that must be forced to go via ISP)
iptables -v -t mangle -D PREROUTING -i br0 -p all -m set --match-set WAN0 dst,dst -j MARK --set-mark 0x7000/0x7000
iptables -v -t mangle -A PREROUTING -i br0 -p all -m set --match-set WAN0 dst,dst -j MARK --set-mark 0x7000/0x7000
# VPN 1 (VPN client 1)
iptables -v -t mangle -D PREROUTING -i br0 -p all -m set --match-set VPN1 dst,dst -j MARK --set-mark 0x1000/0x1000
iptables -v -t mangle -A PREROUTING -i br0 -p all -m set --match-set VPN1 dst,dst -j MARK --set-mark 0x1000/0x1000
# VPN 2 (VPN client 2)
iptables -v -t mangle -D PREROUTING -i br0 -p all -m set --match-set VPN2 dst,dst -j MARK --set-mark 0x2000/0x2000
iptables -v -t mangle -A PREROUTING -i br0 -p all -m set --match-set VPN2 dst,dst -j MARK --set-mark 0x2000/0x2000services-start script
Code:
#!/bin/sh
modprobe xt_set
ipset create WAN0 list:set
ipset create VPN1 list:set
ipset create VPN2 list:set
ipset create WAN0-novpn hash:net family inet hashsize 1024 maxelem 65536
ipset add WAN0 WAN0-novpn
ipset create VPN1-group1 hash:net family inet hashsize 1024 maxelem 65536
ipset create VPN1-group2 hash:net family inet hashsize 1024 maxelem 65536
ipset create VPN1-group3 hash:net family inet hashsize 1024 maxelem 65536
ipset add VPN1 VPN1-group1
ipset add VPN1 VPN1-group2
ipset add VPN1 VPN1-group3
ipset create VPN2-group1 hash:net family inet hashsize 1024 maxelem 65536
ipset create VPN2-group2 hash:net family inet hashsize 1024 maxelem 65536
ipset create VPN2-group3 hash:net family inet hashsize 1024 maxelem 65536
ipset add VPN2 VPN2-group1
ipset add VPN2 VPN2-group2
ipset add VPN2 VPN2-group3When VPN connections come up, I also run a script that restarts dnsmasq.
dnsmasq.conf.add
Code:
# Never forward plain names (without a dot or domain part)
domain-needed
# WAN0 - No VPN
# Set up ipsets and direct DNS traffic to the DNS server of the WAN provider
ipset=/site1.com/site2.com/WAN0-novpn
server=/site1.com/site2.com/NNN.NNN.NNN.NNN
# VPN1
# Set up ipsets and direct DNS traffic to the DNS server of the VPN provider
ipset=/site3.com/site4.com/VPN1-group1
server=/site3.com/site4.com/MMM.MMM.MMM.MMM
and so on for the other ipsets
