I use those same settings for OpenVPN. The only difference is that I have "Route All Traffic through the VPN interface?" Set to YES, the script I use resets that anyways. I think the setting would be irrelevant using the script I do, but I'm not 100% sure.
I use the script found here (with some small modifications):
http://torguard.net/forums/index.ph...adavan-route-specific-traffic-around-the-vpn/
Now, the page says to run
nvram show | grep wan over ssh (could also be done or in the padavan interface administration->console) to get the correct setting for the wan gateway. I got fooled by this and used
nvram get wan_gateway for a long time with no success. The correct setting for my n56U in the script is indeed
nvram get wan0_gateway, so I assume that goes for all N56U's.
Here are my modifications. I added som tun alternatives, not sure if they are needed (but if it ain't broke, don't fix it
). This script gives me selective VPN routing for IP addresses 192.168.1.200-192.168.1.220, all other IP addresses in my lan bypassing the VPN:
Code:
## CUSTOMIZE YOUR SCRIPT VARIABLES
#
## Uncomment and set value(s) as needed to customize your rules
#
# IP addresses, contiguous range AND/OR individual.
#
ip_addrs_lst="192.168.1.200-192.168.1.220"
##Server ports to bypass VPN
server_ports="3389,27,23045"
#
# Specific destination websites ip range - Spotify , Netflix...
#
web_range_lst="192.168.10.1-192.168.10.254"
#67.202.0.1-67.202.63.254
#207.223.0.1-207.223.15.254
#98.207.0.1-98.207.255.254
#208.85.40.1-208.85.47.254
#78.31.8.1-78.31.15.254
#193.182.8.1-193.182.15.254"
########################################
# NO NEED TO CHANGE BELOW THIS LINE #
########################################
# SHELL COMMANDS FOR MAINTENANCE.
# DO NOT UNCOMMENT, THESE ARE INTENDED TO BE USED IN A SHELL COMMAND LINE
#
# List Contents by line number
# iptables -L PREROUTING -t mangle -n --line-numbers
#
# Delete rules from mangle by line number
# iptables -D PREROUTING type-line-number-here -t mangle
#
# To list the current rules on the router, issue the command:
# iptables -t mangle -L PREROUTING
#
# Flush/reset all the rules to default by issuing the command:
# iptables -t mangle -F PREROUTING
sleep 1
#
# First it is necessary to disable Reverse Path Filtering on all
# current and future network interfaces:
#
for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do
echo 0 > $i
done
#
# Delete table 100 and flush any existing rules if they exist.
#
ip route flush table 100
ip route del default table 100
ip rule del fwmark 1 table 100
ip route flush cache
iptables -t mangle -F PREROUTING
#
# Let's find out the tunnel interface
#
iface_lst=`route | awk ' {print $8}'`
for tun_if in $iface_lst; do
if [ $tun_if == "tun11" ] || [ $tun_if == "tun12" ] || [ $tun_if == "tun0" ] || [ $tun_if == "tun1" ] || [ $tun_if == "ppp0" ]; then
break
fi
done
#
# Copy all non-default and non-VPN related routes from the main table into table 100.
# Then configure table 100 to route all traffic out the WAN gateway and assign it mark "1"
#
ip route show table main | grep -Ev ^default | grep -Ev $tun_if \
| while read ROUTE ; do
ip route add table 100 $ROUTE
done
ip route add default table 100 via $(nvram get wan0_gateway)
ip rule add fwmark 1 table 100
ip route flush cache
# EXAMPLES:
#
# All LAN traffic will bypass the VPN (Useful to put this rule first,
# so all traffic bypasses the VPN and you can configure exceptions afterwards)
# iptables -t mangle -A PREROUTING -i br0 -j MARK --set-mark 1
#
# Ports 80 and 443 will bypass the VPN
# iptables -t mangle -A PREROUTING -i br0 -p tcp -m multiport --dport 80,443 -j MARK --set-mark 1
#
# All traffic from a particular computer on the LAN will use the VPN
# iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.1.2 -j MARK --set-mark 0
#
# All traffic to a specific Internet IP address will use the VPN
# iptables -t mangle -A PREROUTING -i br0 -m iprange --dst-range 216.146.38.70 -j MARK --set-mark 0
#
# All UDP and ICMP traffic will bypass the VPN
# iptables -t mangle -A PREROUTING -i br0 -p udp -j MARK --set-mark 1
# iptables -t mangle -A PREROUTING -i br0 -p icmp -j MARK --set-mark 1
# Default behavior: MARK = 1 all traffic bypasses VPN, MARK = 0 all traffic goes VPN
iptables -t mangle -A PREROUTING -i br0 -j MARK --set-mark 1
# IP_ADDRESSES - RANGE(S) AND/OR INDIVIDUAL(S)
for ip_addrs in $ip_addrs_lst ; do
iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range $ip_addrs -j MARK --set-mark 0
done
###### Ports that bypass VPN ######
###### Normal portforwarding will ######
###### need to be applied ######
iptables -t mangle -A PREROUTING -i br0 -p tcp -m multiport --dport $server_ports -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -i br0 -p tcp -m multiport --sport $server_ports -j MARK --set-mark 1
# WEBSITES_IP_RANGES -
for web_dst_range in $web_range_lst ; do
iptables -t mangle -A PREROUTING -i br0 -m iprange --dst-range $web_dst_range -j MARK --set-mark 0
done
The values for
web_range_lst is just a dummy range, in order to keep the script as intact as possible I didn't comment the last command out. The same goes for the ports, they (too) can of course be tweaked as needed.
The script first bypasses all VPN, then just adds the selected IP range. This is why I suspect the setting "Route All Traffic through the VPN interface?" is irrelevant.
I run this script in the padavan interface, Customization -> Run after firewall rules restarted, keeping the original
as my first line.
Works great on-the-fly, and doesn't require a reboot.
Hope this helps,
cheers Pat
