This is all I do. I reject the route push from the server by adding route-nopull to the custom config section.
Then I run a custom script by adding these lines to the custom config as well.
script-security 2
route-up /jffs/scripts/vpn_route_up.sh
Here is the script. I didn't want to mess with any of the default routes and tables so I just added two new tables to direct traffic.
Code:
#
ip route flush table 10
ip route del default table 10
ip rule del fwmark 10 table 10
ip route flush table 12
ip route del default table 12
ip rule del fwmark 12 table 12
ip route flush cache
iptables -t mangle -F PREROUTING
tun_if="tun11"
tun_ip=$(ifconfig $tun_if | grep 'inet addr:'| cut -d: -f2 | awk '{ print $1}')
ip route add default via $tun_ip dev $tun_if table 10
ip rule add fwmark 10 table 10
ip route add default via $(nvram get wan_gateway) dev eth0 table 12
ip rule add fwmark 12 table 12
echo 0 > /proc/sys/net/ipv4/conf/$tun_if/rp_filter
iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.7.40-192.168.7.49 -j MARK --set-mark 10
iptables -t mangle -A PREROUTING -i br0 -p tcp --dport 563 -j MARK --set-mark 12
exit
I imagine there is some way to pass out the tunnel interface name as well just haven't gotten that far yet. So for now it is just hard coded.
I decided to give VyprVPN a try with the intention of sending any of my P2P traffic over it and everything else bypassing the VPN, but doing this hopefully globally. Thanks to all the information here on setting up OpenVPN and the above solution to setting routes I have it half working.
What's working - all traffic is bypassing the VPN.
What's not working - traffic sending over a specific port (59934) for P2P is NOT going over the VPN.
I know zip about using iptables and all the attempts I've made at putting something in have failed. I tried these 2 commands to get that port going over the VPN:
iptables -t mangle -A PREROUTING -i br0 -p tcp --dport 59934 -j MARK --set-mark 10
iptables -t mangle -A PREROUTING -i br0 -p udp --dport 59934 -j MARK --set-mark 10
Here is some output from the tables:
admin@RT-N66U:/tmp/home/root# iptables -t mangle -L -nv --line
Chain PREROUTING (policy ACCEPT 141K packets, 95M bytes)
num pkts bytes target prot opt in out source destination
1 8 496 MARK tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:59934 MARK set 0xa
2 3 174 MARK udp -- br0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:59934 MARK set 0xa
3 27473 1620K MARK all -- br0 * 0.0.0.0/0 0.0.0.0/0 source IP range 192.168.1.2-192.168.1.254 MARK set 0xc
Chain INPUT (policy ACCEPT 45262 packets, 3159K bytes)
num pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 95349 packets, 92M bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 42982 packets, 15M bytes)
num pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 138K packets, 107M bytes)
num pkts bytes target prot opt in out source destination
admin@RT-N66U:/tmp/home/root# ip route show table 10
default via 10.10.1.116 dev tun11
admin@RT-N66U:/tmp/home/root# ip route show table 12
default via 72.185.64.1 dev eth0
admin@RT-N66U:/tmp/home/root#
What am I doing wrong? I'm not currently adding anything via the script except for setting up the default route(s). I wanted to make sure that was working before manually putting in commands to get the above to work.
So to reiterate, what I want to do is send ALL traffic, minus P2P on port 59934, out the wan normally. Then I want to send traffic on port 59934 over the VPN. I'm sure I can get this to work if I just sent all traffic from a source IP over the VPN, but that would kill some other things I do so I want this to be port specific if possible.
Help?!
And just so you can see what it's in the script right now:
---
#!/bin/sh
#
ip route flush table 10
ip route del default table 10
ip rule del fwmark 10 table 10
ip route flush table 12
ip route del default table 12
ip rule del fwmark 12 table 12
ip route flush cache
iptables -t mangle -F PREROUTING
tun_if="tun11"
tun_ip=$(ifconfig $tun_if | grep 'inet addr:'| cut -d: -f2 | awk '{ print $1}')
ip route add default via $tun_ip dev $tun_if table 10
ip rule add fwmark 10 table 10
ip route add default via $(nvram get wan0_gateway) dev eth0 table 12
ip rule add fwmark 12 table 12
echo 0 > /proc/sys/net/ipv4/conf/$tun_if/rp_filter
#iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.7.40-192.168.7.49 -j MARK --set-mark 10
#iptables -t mangle -A PREROUTING -i br0 -p tcp --dport 563 -j MARK --set-mark 12
iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.1.2-192.168.1.254 -j MARK --set-mark 12
exit
---
