Hello !
I've read this topic a lot of time and it makes me understand a lot of things about what I want to do and how to do it.
I'm a total amateur in networking, so I'm just self-learning it as I'm using it.
Anyway here is my setup and what I want to achieve (and what I already achived) :
1 Fritzbox (router+modem) from my ISP connected from ethernet port 1 to WAN port Asus RT-N66U (router) installed with ASUSWRT-Merlin (RT-N66U_3.0.0.4_376.48_1)
Asus Router Wan port is configured in the Fritzbox network (192.168.0.0/24)
DHCP activated on 192.168.1.1/24) I actually don't care if the first network can't communicate with the second one.. The job of the fritzbox is just to give Internet to the router.
Ok so, I'm French and live in Germany with an English speaker Girlfriend - I know you don't care, it's just a nice introduction to what come next
-I want to watch French TV through a French VPN (setup in Asus gui as OPENVPN using interface tun11)
-With my girlfriend we watch Netflix/Hulu through an American VPN (setup in Asus gui as OPENVPN using interface tun12)
As in front of the TV it's not something easy/nice to go on a computer open a SSH session or whatever and change the VPN mode, I was interested in selective routing with 2 VPN running and the possibility of using 1 wifi SSID for VPN1 and a second wifi SSID for VPN2.
What I actually managed to get is :
Setup the 2 VPN, all network bypass the VPN by default and the devices in a specific IP range go on the VPN2 (those are DHCP reservation)
Playing in a SSH console allow me to easily place a Mark on interface BR0 or my IP range to switch the full traffic to ISP, VPN1 or VPN2.
Here is the actual code working :
Code:
#!/bin/sh
# This script goes in /jffs/scripts/vpn-route-up.sh
# Add the following to the OpenVPN configs
# route-nopull (Don't accept routes from server)
# route-up /jffs/scripts/vpn-route-up.sh
#Flush of all existing rules and marks
ip route flush table 10
ip route del default table 10
ip rule del fwmark 10 table 10
ip route flush table 12
ip route del default table 12
ip rule del fwmark 12 table 12
ip route flush table 14
ip route del default table 14
ip rule del fwmark 14 table 14
ip route flush cache
iptables -t mangle -F PREROUTING
tun_if="tun11"
tun_ifs="tun12"
tun_ip=$(ifconfig $tun_if | grep 'inet addr:'| cut -d: -f2 | awk '{ print $1}')
tun_ips=$(ifconfig $tun_if | grep 'inet addr:'| cut -d: -f2 | awk '{ print $1}')
ip route add default via $(nvram get wan_gateway) dev eth0 table 10
ip rule add fwmark 10 table 10
ip route add default via $tun_ip dev $tun_if table 12
ip rule add fwmark 12 table 12
ip route add default via $tun_ips dev $tun_ifs table 14
ip rule add fwmark 14 table 14
echo 0 > /proc/sys/net/ipv4/conf/$tun_if/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/$tun_ifs/rp_filter
#Set all traffic to bypass VPN
iptables -t mangle -A PREROUTING -i br0 -j MARK --set-mark 10
#Set specific IP range traffic to go through USA VPN tun12
iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.1.150-192.168.1.199 -j MARK --set-mark 14
exit
In my environment all my Ethernet network is in the ISP traffic. My IPAD and Chromecast are fixed IP with the DHCP reservation.
What I tried to achive was to setup a total of 3 DHCP scopes, the normal one and 1 for wl0.1 interface and one for 5Ghz wifi (eth02 I guess?)
But I'm quite sure it's impossible to do so. I tried first with wl0.1 - Put it out of br0, setup an IP and add the DHCP for it in dnsmasq.conf (even dnsmasq.conf.add with a reboot of course)
Is there a way to do what I would like ?
Is there any way to put the WIFI interface out of the grouped interface? and then get a dhcp scope for each ones so I can easily use the selective routes ?
I don't mind at all the my WIFI SSID 1, 2 and regular lan network can't communicate between each other.
Thank you by advance, and if something is not clear or if I forgot to give you an important information, just ask me