Usually this is caused by a
'corruption' of the Selective Routing configuration - i.e. the firewall has
unexpectedly restarted (due to manual tinkering with QOS or other features in the GUI?) but it depends on the router model/firmware/features enabled etc.
You could try this crude debugging script when it fails, or schedule it using cru/cron to track/dump the status of the Selective Routing environment to Syslog.
Code:
#!/bin/sh
# Debugging Selective routing use cru/cron
Say(){
echo -e $$ $@ | logger -st "($(basename $0))"
}
SayT() {
echo -e $$ $@ | logger -t "($(basename $0))"
}
ANSIColours() {
cRESET="\e[0m";cBLA="\e[30m";cRED="\e[31m";cGRE="\e[32m";cYEL="\e[33m";cBLU="\e[34m";cMAG="\e[35m";cCYA="\e[36m";cGRA="\e[37m"
cBGRA="\e[90m";cBRED="\e[91m";cBGRE="\e[92m";cBYEL="\e[93m";cBBLU="\e[94m";cBMAG="\e[95m";cBCYA="\e[96m";cBWHT="\e[97m"
aBOLD="\e[1m";aDIM="\e[2m";aUNDER="\e[4m";aBLINK="\e[5m";aREVERSE="\e[7m"
cRED_="\e[41m";cGRE_="\e[42m"
}
ANSIColours
VPN_ROUTES=
WAN_IP=
for VPN_TAB in 254 $(ip route show table 254 | grep -oE "tun1[1|2|3|4|5]" | sort )
do
[ "$VPN_TAB" != "254" ] && VPN_TAB=$(echo $VPN_TAB | sed 's/tun1/11/')
echo -e $cBWHT
Say "VPN Client" ${VPN_TAB:2:1} "route Table:" $VPN_TAB
echo -en $cBMAG
AROUTE=$(ip route show table $VPN_TAB | awk ' /default/ {print $3}')
if [ -z "$(echo "$VPN_ROUTES" | grep -oF $AROUTE )" ];then
VPN_ROUTES=$VPN_ROUTES" "$AROUTE
else
echo -e $cBRED"\a"
TXT="ALREADY used by a previous VPN Client"
if [ "$WAN_IP" == "$AROUTE" ];then
TXT="is via the WAN!!!"
fi
Say "***ERROR*** VPN Client" ${VPN_TAB:2:1} "route" $AROUTE $TXT
echo -e $cRESET
fi
# Obfuscate IP address <optional>
ip route show table $VPN_TAB | grep -E "^0\.|^128.|^default|tun1"
ip route show table $VPN_TAB | grep -E "^0\.|^128.|^default|tun1" >>/tmp/syslog.log
if [ "$VPN_TAB" != "254" ];then
DEV=$(ip route show table $VPN_TAB | grep -v "default" | grep -oE "tun1[1|2|3|4|5]" )
if [ "tun1"${VPN_TAB:2:1} != "$DEV" ];then
echo -e $cBRED"\a"
Say "***ERROR*** RPDB rules will be misdirected for VPN Client" ${VPN_TAB:2:1}
echo -e $cRESET
else
if [ ! -z "$(ip route show table $VPN_TAB | grep -E "^0\.|^128.]")" ];then
echo -e $cBRED"\a"
Say "***ERROR***Selective routing NOT enabled! - table 'main' is routing ALL traffic via VPN"
echo -e $cRESET
fi
fi
else
WAN_IP=$AROUTE
fi
done
echo -e $cBWHT
Say "RPDB rules:"
echo -en $cBMAG
ip rule;ip rule >>/tmp/syslog.log
echo -e $cBWHT
Say "Count of active RPDB rules:"
echo -en $cBGRE
# How many entities Selectively routed
ip rule | grep -v "fwmark" | grep -oE "lookup.*ovpnc[1-5]+" | sort -k 2 | uniq -c
ip rule | grep -v "fwmark" | grep -oE "lookup.*ovpnc[1-5]+" | sort -k 2 | uniq -c >>/tmp/syslog.log
SayT "Summary:$(ip rule | grep -v "fwmark" | grep -oE "lookup.*ovpnc[1-5]+" | sort -k 2 | uniq -c)"
echo -e $cRESET
exit 0
You may get a clue in finding the issue either in the RPDB rules (less likely though
can happen) or the actual individual Selective routing tables (
highly likely).
