bigjess007
New Around Here
I have a RT-AC68U running the latest Merlin Firmware (380.68_4) and am attempting to use selective routing to get certain traffic (Netflix) to route straight to WAN bypassing VPN (as all traffic is tunneled through a VPN).
I started in the Selective Routing with Asuswrt-Merlin thread reading through it and trying the scripts. I always end up getting the error "iptables: No chain/target/match by that name".
Late in that thread, there are posts stating several folks who have RT-AC68U's are getting the same error and it appears that it may be because of this model router. There was a post that redirected to the thread Using ipset to selectively route domains to a VPN client? that had the same error as me. Working through that thread, it appears that user may have resolved their error as well, however I still cannot get this working.
So I am starting a new thread cause I need to get this working and can't.
Here are my scripts:
nat-start that is in /jffs/scripts/
The Netflix.sh script:
The Netflix script runs fine when I run it manually. When I run nat-start manually I get the "iptables: No chain/target/match by that name."
There were several requests in the threads asking for additional information to troubleshoot, so I've tried to include everything I've found:
ip rule
iptables -t mangle -nvL
iptables -t mangle -nvL PREROUTING --line
iptables -nvL PREROUTING --line -t mangle
I started in the Selective Routing with Asuswrt-Merlin thread reading through it and trying the scripts. I always end up getting the error "iptables: No chain/target/match by that name".
Late in that thread, there are posts stating several folks who have RT-AC68U's are getting the same error and it appears that it may be because of this model router. There was a post that redirected to the thread Using ipset to selectively route domains to a VPN client? that had the same error as me. Working through that thread, it appears that user may have resolved their error as well, however I still cannot get this working.
So I am starting a new thread cause I need to get this working and can't.
Here are my scripts:
nat-start that is in /jffs/scripts/
Code:
#!/bin/sh
/jffs/scripts/Netflix.sh
ip rule del prio 9990
ip rule add from 0/0 fwmark 0x7000 table main prio 9990
iptables -t mangle -D PREROUTING -m set --match-set Netflix dst -j MARK --set-mark 0x7000/0x7000
iptables -t mangle -A PREROUTING -m set --match-set Netflix dst -j MARK --set-mark 0x7000/0x7000The Netflix.sh script:
Code:
#!/bin/sh
ipset create Netflix hash:net family inet hashsize 1024 maxelem 65536
ipset add Netflix 108.175.32.0/20
****************truncated, see next post for all the ip's added****************The Netflix script runs fine when I run it manually. When I run nat-start manually I get the "iptables: No chain/target/match by that name."
There were several requests in the threads asking for additional information to troubleshoot, so I've tried to include everything I've found:
ip rule
Code:
0: from all lookup local
9990: from all fwmark 0x7000 lookup main
32766: from all lookup main
32767: from all lookup defaultiptables -t mangle -nvL
Code:
Chain PREROUTING (policy ACCEPT 159M packets, 147G bytes)
pkts bytes target prot opt in out source destination
61M 71G CONNMARK all -- eth0 * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore mask 0x7
Chain INPUT (policy ACCEPT 65M packets, 73G bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 94M packets, 74G bytes)
pkts bytes target prot opt in out source destination
300K 20M QOSO0 all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 40M packets, 13G bytes)
pkts bytes target prot opt in out source destination
36M 12G QOSO0 all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain POSTROUTING (policy ACCEPT 133M packets, 86G bytes)
pkts bytes target prot opt in out source destination
61M 67G QOSO0 all -- * br0 0.0.0.0/0 0.0.0.0/0
Chain QOSO0 (3 references)
pkts bytes target prot opt in out source destination
97M 79G CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore mask 0x7
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 connmark match ! 0x0/0xff00
8 799 CONNMARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 connbytes 0:524287 connbytes mode bytes connbytes direction both CONNMARK set-return 0x1/0x7
57 55196 CONNMARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 connbytes 0:524287 connbytes mode bytes connbytes direction both CONNMARK set-return 0x1/0x7
0 0 CONNMARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 connbytes 524288 connbytes mode bytes connbytes direction both CONNMARK set-return 0x4/0x7
48 2674 CONNMARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 connbytes 524288 connbytes mode bytes connbytes direction both CONNMARK set-return 0x4/0x7
581K 274M CONNMARK all -- * * 0.0.0.0/0 224.0.0.0/4 CONNMARK set-return 0x6/0x7
60M 67G CONNMARK all -- * * 0.0.0.0/0 192.168.15.0/24 CONNMARK set-return 0x6/0x7
36M 12G CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0 CONNMARK set-return 0x4/0x7iptables -t mangle -nvL PREROUTING --line
Code:
Chain PREROUTING (policy ACCEPT 159M packets, 147G bytes)
num pkts bytes target prot opt in out source destination
1 61M 71G CONNMARK all -- eth0 * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore mask 0x7iptables -nvL PREROUTING --line -t mangle
Code:
Chain PREROUTING (policy ACCEPT 159M packets, 147G bytes)
num pkts bytes target prot opt in out source destination
1 61M 71G CONNMARK all -- eth0 * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore mask 0x7
Last edited:
