Menu
What's new
By:
Filters Better Search

Selective Routing with Asuswrt-Merlin

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

kman said:
Hi @Xentrk from the above post, I tried executing the script but for both of these lines:

iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000

iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000

I received:
iptables: No chain/target/match by that name.

To recap, this is my configuration:
  1. On VPN Client GUI page, set Accept DNS Configuration = Exclusive
  2. Redirect Internet Traffic = Policy Rules (Strict)
  3. All entries from the policy routing table have been removed and Create NAT on tunnel is set to Yes.
  4. I have specified the VPN clients in the OVPNC1 file to list the ip address of the devices that will go thru the VPN.
I have verified the IPSET lists are populate for OVPNC1 and WAN_GW. The IP RULE confirms the rules are created. But issuing the above -t mangle command just throws iptables: No chain/target/match by that name.

Can something be blocking this script from running or creating the PREROUTING for LAN_GW/OVPNC1?
Click to expand...
Kman, do you have the same router as me? AC68u?
 
kman said:
Hi @Xentrk from the above post, I tried executing the script but for both of these lines:

iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000

iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000

I received:
iptables: No chain/target/match by that name.

To recap, this is my configuration:
  1. On VPN Client GUI page, set Accept DNS Configuration = Exclusive
  2. Redirect Internet Traffic = Policy Rules (Strict)
  3. All entries from the policy routing table have been removed and Create NAT on tunnel is set to Yes.
  4. I have specified the VPN clients in the OVPNC1 file to list the ip address of the devices that will go thru the VPN.
I have verified the IPSET lists are populate for OVPNC1 and WAN_GW. The IP RULE confirms the rules are created. But issuing the above -t mangle command just throws iptables: No chain/target/match by that name.

Can something be blocking this script from running or creating the PREROUTING for LAN_GW/OVPNC1?
Click to expand...
Did you add the -D line first?

Code: 
iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000
iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000

iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000
iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000

What does this command show?
Code: 
iptables --line -t nat -nvL
I saw this code in some scripts posted by others. Try adding it after the !#/bin/sh and before the fwmarks and tables are created to see if it helps.
Code: 
for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do
echo 0 > $i
done
Hopefully, someone else will be able to help.

Here are some other commands to debug:
Code: 
route -n
ip route show table local
 
Last edited:
Rappy said:
I'm afraid that does nothing.
Click to expand...

Here are the contents of /etc/dnsmasq.cong file on a router I support.

https://pastebin.com/80mZTft3

Perhaps there is something else in here that is required to get logging working for you in addition to log-queries and log-facility options. But from what I have read, those two options should do it.

You may want to try adding the options for interfaces and the option domain-needed.

If that does not work, then I am out of ideas. You may want to start a new thread about getting dnsmasq to log your queries to see if you can get some help that way.
 
Last edited:
Xentrk said:
I saw this code in some scripts posted by others. Try adding it <snip> to see if it helps.
Code: 
for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do
echo 0 > $i
done
Click to expand...

This crucial code snippet was finally officially added to Firmware 380.63? (6-Nov-2016) so should already be standard on all current Firmwares (see script /usr/sbin/vpnrouting.sh to confirm)
 
Xentrk said:
Did you add the -D line first?

Code: 
iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000
iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000

iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000
iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000

What does this command show?
Code: 
iptables --line -t nat -nvL
I saw this code in some scripts posted by others. Try adding it after the !#/bin/sh and before the fwmarks and tables are created to see if it helps.
Code: 
for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do
echo 0 > $i
done
Hopefully, someone else will be able to help.

Here are some other commands to debug:
Code: 
route -n
ip route show table local
Click to expand...

Yes I have added the -D and now also added the
Code: 
for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do
echo 0 > $i
done
result:
Code: 
+ iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000
iptables: No chain/target/match by that name.
+ iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000
iptables: No chain/target/match by that name.
+ iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000
iptables: No chain/target/match by that name.
+ iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000
iptables: No chain/target/match by that name.

@Rappy it is the same router as yours, AC68U.
 
Xentrk said:
Here are the contents of /etc/dnsmasq.cong file on a router I support.

https://pastebin.com/80mZTft3

Perhaps there is something else in here that is required to get logging working for you in addition to log-queries and log-facility options. But from what I have read, those two options should do it.

You may want to try adding the options for interfaces and the option domain-needed.

If that does not work, then I am out of ideas. You may want to start a new thread about getting dnsmasq to log your queries to see if you can get some help that way.
Click to expand...
Why is there also a dnsmasq.conf in the tmp/etc/ directory? This one has different config. Should I leave that one alone?
 
Rappy said:
Why is there also a dnsmasq.conf in the tmp/etc/ directory? This one has different config. Should I leave that one alone?
Click to expand...
It is a symbolic link, /tmp/etc is the same as /etc. In my sftp gui, if I type /etc and hit enter, it resolves to /tmp/etc.
 
Xentrk said:
It is a symbolic link, /tmp/etc is the same as /etc. In my sftp gui, if I type /etc and hit enter, it resolves to /tmp/etc.
Click to expand...
For me they are both different. The tmp one has none of the extra parameters I put in the other one.
 
Can you go to the root directory level (cd .. a few times) and enter the l s - a l | grep etc command (spaces between "l" and "s" and the dash and "a" and the "a" and "l" are added to get around blocks put in place by this technical forum site that does not allow me to enter basic linux commands in a forum post. :mad:

This is mine:
Code: 
lrwxrwxrwx    1 admin    root             7 Oct  5 03:01 etc -> tmp/etc
Note the symbolic link with the arrow.

What does your report?
 
Last edited:
Xentrk said:
spaces between "l" and "s" and the dash and "a" and the "a" and "l" are added to get around blocks put in place by this technical forum site that does not allow me to enter basic linux commands in a forum post. :mad:
Click to expand...

You mean like this? ;)
Code: 
ls  -lah  /  |  grep   ">"

lrwxrwxrwx    1 admin    root           7 Oct  4 21:00 e tc -> tmp/e tc
lrwxrwxrwx    1 admin    root           8 Oct  4 21:00 home -> tmp/home
lrwxrwxrwx    1 admin    root           9 Oct  4 21:00 media -> tmp/media
lrwxrwxrwx    1 admin    root           7 Oct  4 21:00 mnt -> tmp/mnt
lrwxrwxrwx    1 admin    root           7 Oct  4 21:00 opt -> tmp/opt
lrwxrwxrwx    1 admin    root          13 Oct  4 21:00 root -> tmp/home/root
lrwxrwxrwx    1 admin    root           7 Oct  4 21:00 var -> tmp/var
 
Martineau said:
You mean like this? ;)
Code: 
ls  -lah  /  |  grep   ">"

lrwxrwxrwx    1 admin    root           7 Oct  4 21:00 e tc -> tmp/e tc
lrwxrwxrwx    1 admin    root           8 Oct  4 21:00 home -> tmp/home
lrwxrwxrwx    1 admin    root           9 Oct  4 21:00 media -> tmp/media
lrwxrwxrwx    1 admin    root           7 Oct  4 21:00 mnt -> tmp/mnt
lrwxrwxrwx    1 admin    root           7 Oct  4 21:00 opt -> tmp/opt
lrwxrwxrwx    1 admin    root          13 Oct  4 21:00 root -> tmp/home/root
lrwxrwxrwx    1 admin    root           7 Oct  4 21:00 var -> tmp/var
Click to expand...
You nailed it! I like your solution better. :D
 
Rappy said:
https://pastebin.com/raw/44mwsECk
Click to expand...
That confirms the symbolic link of etc and tmp/etc...Still does not explain why you are seeing a different dnsmasq.conf. Should not be the case. If you navigate to /etc it should go to /tmp/etc. At least mine does. Well, you can go to /etc AND /tmp/etc and do the ls command and grep for dnsmasq.conf. Then, compare the timestamp on the file. If you rename the file in one directory, can you still list two different files?
 
Xentrk said:
That confirms the symbolic link of etc and tmp/etc...Still does not explain why you are seeing a different dnsmasq.conf. Should not be the case. If you navigate to /etc it should go to /tmp/etc. At least mine does. Well, you can go to /etc AND /tmp/etc and do the ls command and grep for dnsmasq.conf. Then, compare the timestamp.
Click to expand...
They both now appear to match, but when I first change something in one of them, say to add some of the lines you suggested, it doesn't update in the other one. Then eventually the original (and the link) revert to the un adulterated config.
 
Rappy said:
They both now appear to match, but when I first change something in one of them, say to add some of the lines you suggested, it doesn't update in the other one. Then eventually the original (and the link) revert to the un adulterated config.
Click to expand...

Restart dnsmasq then after verifying you have the log-queries and log-facility lines in dnsmasq.conf. The log-dhcp option should not be required for what we are trying to accomplish. Try doing a tail on the log file while surfing the web. Do you see entries being added?

If you do not see any logging to dnsmasq.conf, please start a new thread for the issue or install AB-Solution. The dnsmasq config that is installed as part of AB-Solution works and allows me to mine traffic for selective routing with no issues. You have the scripts. You just need the domain names to finish complete your objective.
 
Just an update, I ended up installing AB Solutions (which works great btw) and retried running the script, but the same errors:

+ iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000
iptables: No chain/target/match by that name.
+ iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000
iptables: No chain/target/match by that name.
+ iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000
iptables: No chain/target/match by that name.
+ iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000
iptables: No chain/target/match by that name.
 
kman said:
Just an update, I ended up installing AB Solutions (which works great btw) and retried running the script, but the same errors:

+ iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000
iptables: No chain/target/match by that name.
+ iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set LAN_GW src,dst -j MARK --set-mark 0x7000/0x7000
iptables: No chain/target/match by that name.
+ iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000
iptables: No chain/target/match by that name.
+ iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set OVPNC1 src,dst -j MARK --set-mark 0x1000/0x1000
iptables: No chain/target/match by that name.
Click to expand...

Something is not right with iptables on your router. Please post the output of the commands below, along with your firmware and router so we can ask @RMerlin about it.

Code: 
iptables --verbose -t mangle -vL PREROUTING
iptables --version
 
Rappy said:
They both now appear to match, but when I first change something in one of them, say to add some of the lines you suggested, it doesn't update in the other one. Then eventually the original (and the link) revert to the un adulterated config.
Click to expand...
@Rappy, I think this may be the missing piece to getting dnsmasq logging working for you. Can you check these settings?

In dnsmasq.conf file, have an entry like the following:
Code: 
resolv-file=/tmp/resolv.conf

In the resolv.conf file, add:
Code: 
nameserver 127.0.0.1

On my system, /etc/tmp/resolv.conf is a link to /rom/etc/resolv.conf
Code: 
lrwxrwxrwx    1 admin    root            20 Oct 13 14:07 resolv.conf -> /rom/etc/resolv.conf
 
Xentrk said:
Something is not right with iptables on your router. Please post the output of the commands below, along with your firmware and router so we can ask @RMerlin about it.

Code: 
iptables --verbose -t mangle -vL PREROUTING
iptables --version
Click to expand...

Please see below. Note, I have altered IP add. Router: AC68U, fw 380.68_4.
Code: 
admin@RT-AC68U:/tmp/home/root# iptables --verbose -t mangle -vL PREROUTING
Chain PREROUTING (policy ACCEPT 13M packets, 12G bytes)
 pkts bytes target     prot opt in     out     source               destination
3049K 3769M MARK       all  --  tun11  any     anywhere             anywhere             MARK xset 0x1/0x7
 6548  929K MARK       all  --  tun21  any     anywhere             anywhere             MARK xset 0x1/0x7
 8064  614K MARK       all  --  !ppp0  any     anywhere             cwcwddd.dsl.ca       MARK or 0x8000
libiptc vlibxtables.so.7. 1872 bytes.
Table `mangle'
Hooks: pre/in/fwd/out/post = 0/260/2f8/428/4c0
Underflows: pre/in/fwd/out/post = 1c8/260/390/428/4c0
Entry 0 (0):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `tun11'/XXXXXX..........to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 3049351 packets, 3768950264 bytes
Cache: 00000000
Target name: `MARK' [40]

Entry 1 (152):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `tun21'/XXXXXX..........to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 6548 packets, 929435 bytes
Cache: 00000000
Target name: `MARK' [40]

Entry 2 (304):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 99.128.150.121/255.255.255.255
Interface: `ppp0'/XXXXX...........to `'/................
Protocol: 0
Flags: 00
Invflags: 01
Counters: 8064 packets, 613533 bytes
Cache: 00000000
Target name: `MARK' [40]

Entry 3 (456):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 12997572 packets, 11708616915 bytes
Cache: 00000000
Target name: `' [40]
verdict=NF_ACCEPT

Entry 4 (608):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 3974696 packets, 4160325173 bytes
Cache: 00000000
Target name: `' [40]
verdict=NF_ACCEPT

Entry 5 (760):
SRC IP: 192.168.1.0/255.255.255.0
DST IP: 192.168.1.0/255.255.255.0
Interface: `'/................to `br0'/XXXX............
Protocol: 0
Flags: 00
Invflags: 00
Counters: 13158 packets, 6804359 bytes
Cache: 00000000
Target name: `MARK' [40]

Entry 6 (912):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 9022106 packets, 7548259449 bytes
Cache: 00000000
Target name: `' [40]
verdict=NF_ACCEPT

Entry 7 (1064):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 3141498 packets, 1734310330 bytes
Cache: 00000000
Target name: `' [40]
verdict=NF_ACCEPT

Entry 8 (1216):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 12164356 packets, 9282803322 bytes
Cache: 00000000
Target name: `' [40]
verdict=NF_ACCEPT

Entry 9 (1368):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 0 packets, 0 bytes
Cache: 00000000
Target name: `ERROR' [64]
error=`BWDPI_FILTER'

Entry 10 (1544):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 0 packets, 0 bytes
Cache: 00000000
Target name: `' [40]
verdict=RETURN

Entry 11 (1696):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 0 packets, 0 bytes
Cache: 00000000
Target name: `ERROR' [64]
error=`ERROR'

admin@RT-AC68U:/tmp/home/root# iptables --version
iptables v1.4.14
 
kman said:
Please see below. Note, I have altered IP add. Router: AC68U, fw 380.68_4.
Code: 
admin@RT-AC68U:/tmp/home/root# iptables --verbose -t mangle -vL PREROUTING
Chain PREROUTING (policy ACCEPT 13M packets, 12G bytes)
 pkts bytes target     prot opt in     out     source               destination
3049K 3769M MARK       all  --  tun11  any     anywhere             anywhere             MARK xset 0x1/0x7
 6548  929K MARK       all  --  tun21  any     anywhere             anywhere             MARK xset 0x1/0x7
 8064  614K MARK       all  --  !ppp0  any     anywhere             cwcwddd.dsl.ca       MARK or 0x8000
libiptc vlibxtables.so.7. 1872 bytes.
Table `mangle'
Hooks: pre/in/fwd/out/post = 0/260/2f8/428/4c0
Underflows: pre/in/fwd/out/post = 1c8/260/390/428/4c0
Entry 0 (0):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `tun11'/XXXXXX..........to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 3049351 packets, 3768950264 bytes
Cache: 00000000
Target name: `MARK' [40]

Entry 1 (152):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `tun21'/XXXXXX..........to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 6548 packets, 929435 bytes
Cache: 00000000
Target name: `MARK' [40]

Entry 2 (304):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 99.128.150.121/255.255.255.255
Interface: `ppp0'/XXXXX...........to `'/................
Protocol: 0
Flags: 00
Invflags: 01
Counters: 8064 packets, 613533 bytes
Cache: 00000000
Target name: `MARK' [40]

Entry 3 (456):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 12997572 packets, 11708616915 bytes
Cache: 00000000
Target name: `' [40]
verdict=NF_ACCEPT

Entry 4 (608):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 3974696 packets, 4160325173 bytes
Cache: 00000000
Target name: `' [40]
verdict=NF_ACCEPT

Entry 5 (760):
SRC IP: 192.168.1.0/255.255.255.0
DST IP: 192.168.1.0/255.255.255.0
Interface: `'/................to `br0'/XXXX............
Protocol: 0
Flags: 00
Invflags: 00
Counters: 13158 packets, 6804359 bytes
Cache: 00000000
Target name: `MARK' [40]

Entry 6 (912):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 9022106 packets, 7548259449 bytes
Cache: 00000000
Target name: `' [40]
verdict=NF_ACCEPT

Entry 7 (1064):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 3141498 packets, 1734310330 bytes
Cache: 00000000
Target name: `' [40]
verdict=NF_ACCEPT

Entry 8 (1216):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 12164356 packets, 9282803322 bytes
Cache: 00000000
Target name: `' [40]
verdict=NF_ACCEPT

Entry 9 (1368):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 0 packets, 0 bytes
Cache: 00000000
Target name: `ERROR' [64]
error=`BWDPI_FILTER'

Entry 10 (1544):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 0 packets, 0 bytes
Cache: 00000000
Target name: `' [40]
verdict=RETURN

Entry 11 (1696):
SRC IP: 0.0.0.0/0.0.0.0
DST IP: 0.0.0.0/0.0.0.0
Interface: `'/................to `'/................
Protocol: 0
Flags: 00
Invflags: 00
Counters: 0 packets, 0 bytes
Cache: 00000000
Target name: `ERROR' [64]
error=`ERROR'

admin@RT-AC68U:/tmp/home/root# iptables --version
iptables v1.4.14
Click to expand...
It appears you may have the same iptables issue as @Ted Danson does with iptables on the AC68U.
https://www.snbforums.com/threads/u...te-domains-to-a-vpn-client.41560/#post-351464. I've never had a problem with it. I hope the community can help on this issue.
 
You must log in or register to reply here.

Similar threads

O
PI hole + unbound + domain vpn routing
Replies
10
Views
626
OBENZ
O
S
Explicit oVPN routing
Replies
4
Views
1K
ZebMcKayhan
Z
dacid44
Routing packets through a wireguard client
Replies
15
Views
2K
ZebMcKayhan
Z
H
Issue with Setting up Policy Routing with VPN Client
Replies
4
Views
1K
hydraulics
H
kevinkey619
Route only specific ports and hosts via VPN. All other traffic via WAN. (Asuswrt-Merlin)
Replies
0
Views
1K
kevinkey619
kevinkey619
Similar threads
Thread starter Title Forum Replies Date
E Multi source selective port forward? Asuswrt-Merlin 1
C Routing my VPN Server through VPN Client 1 Having issues with Facetime Asuswrt-Merlin 50
O PI hole + unbound + domain vpn routing Asuswrt-Merlin 10
CaptnDanLKW VPN Stays connected but Stops Routing after DoH Change Asuswrt-Merlin 2
T [Solved]Configure Policy based routing for transparent proxy Asuswrt-Merlin 6
M OpenVPN / site to site with special security/routing constraints Asuswrt-Merlin 7
Acru Bug Report: nvram chilli_enable=1 when guest network is removed causes no routing to occur Asuswrt-Merlin 2
G [Help] Routing VPN server through VPN client (external VPN Provider) Asuswrt-Merlin 14
P IPv6 routing table flags Asuswrt-Merlin 2
RMerlin Release Asuswrt-Merlin 3006.102.2 is now available for Wifi 7 devices Asuswrt-Merlin 28

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 770 (members: 31, guests: 739)
Top