Menu
What's new
By:
Filters Better Search

Whitelist specific websites and online games with OpenVPN ?

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

S

swealpha

Occasional Visitor
Hello!

Do you guys know if it is possible to whitelist some specific websites and online games when using OpenVPN?

For example no need to use VPN when using netflix or playing games.


Thank you great people!!
:)
 
swealpha said:
Oh i see, that seems to be a big project.

I wish merlin had something that is easy as dd-wrt's solution.
https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1158919#1158919
Click to expand...

If you can copy'n'paste a script to the router and make it executable, then it is not a big project at all.

RMerlin firmware allows selective routing of IPs via the GUI, but unlike your DD-WRT example it does not support URLs/Domains.

upload_2019-3-10_12-30-55.png


So the problem is you need to collate and enter ALL the IPs currently used by a domain, but even then you are limited to the max 100 entries.
(Netflix uses hundreds of IPs)

Using @Xentrk's script, you can easily configure the router to automatically achieve your requirements.
e.g. simply run the script to route ALL reddit.com IPs via the WAN
Code: 
./Xentrk_Martineau_IPSET_Domains.sh 0 REDDIT reddit.com

(Xentrk_Martineau_IPSET_Domains.sh): 17027 Starting Script Execution
(Xentrk_Martineau_IPSET_Domains.sh): 17027 IPSET created: REDDIT hash:net family inet hashsize 1024 maxelem 65536
(Xentrk_Martineau_IPSET_Domains.sh): 17027 CRON schedule created: #REDDIT# '0 2 * * * ipset save REDDIT'
(Xentrk_Martineau_IPSET_Domains.sh): 17027 Selective Routing Rule via WAN created (TAG fwmark 0x8000/0x8000)
(Xentrk_Martineau_IPSET_Domains.sh): 17027 Completed Script Execution
At this point no further action is required,, ALL IPs associated with 'reddit.com' will automatically be routed via the WAN rather than the VPN.

….but you may wish to manually confirm the current configuration..

The number of IPs retrieved for 'reddit.com' will probably be zero at this point...​
Code: 
ipset list REDDIT

Name: REDDIT
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 316
References: 1
Number of entries: 0
If you now manually force a reference to 'reddit.com', as the script has configured dnsmasq to automatically retrieve any IP address(es) associated with 'reddit.com', you can see in real-time if it works...
Code: 
nslookup reddit.com
 
Server:    127.0.0.1
Address 1: 127.0.0.1 localhost.localdomain
Name:      reddit.com
Address 1: 151.101.1.140
Address 2: 151.101.65.140
Address 3: 151.101.129.140
Address 4: 151.101.193.140
and hopefully dnsmasq has retrieved the current four IP address for routing via the WAN
Code: 
ipset list REDDIT
 
Name: REDDIT
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 540
References: 1
Number of entries: 4
Members:
151.101.65.140
151.101.193.140
151.101.1.140
151.101.129.140
 
I have been trying to get this to work for a specific IP (dvd.netflix.com) but have not been successful. For those who have Netflix, this is the DVD section of the site. @Xentrk's Netflix script works well for streaming but for some reason it doesn't work for this particular section of the site.

Fortunately, when I use nslookup dvd.netflix.com, I only get one IP address. I tried the policy rules via and placed the IP of the above domain into the source IP (and WAN) but still can't access it.

@Martineau - I tried to use your above post to build a similar code into my /jffs/scripts/nat-start but I couldn't get it work:

Code: 
./Xentrk_Martineau_IPSET_Domains.sh 0 DVDNetflix www.dvd.netlfix.com

Anything I am doing wrong?

Thank you for your help!
 
Marin said:
I have been trying to get this to work for a specific IP (dvd.netflix.com) but have not been successful. For those who have Netflix, this is the DVD section of the site. @Xentrk's Netflix script works well for streaming but for some reason it doesn't work for this particular section of the site.

Fortunately, when I use nslookup dvd.netflix.com, I only get one IP address. I tried the policy rules via and placed the IP of the above domain into the source IP (and WAN) but still can't access it.

@Martineau - I tried to use your above post to build a similar code into my /jffs/scripts/nat-start but I couldn't get it work:

Code: 
./Xentrk_Martineau_IPSET_Domains.sh 0 DVDNetflix www.dvd.netlfix.com

Anything I am doing wrong?

Thank you for your help!
Click to expand...

If the domain 'www.dvd.netflix.com' truly resolves to a single IP address
Code: 
nslookup www.dvd.netflix.com

Server:    127.0.0.1
Address 1: 127.0.0.1 localhost.localdomain
Name:      www.dvd.netflix.com
Address 1: 207.45.72.201

Code: 
nslookup dvd.netflix.com

Server:    127.0.0.1
Address 1: 127.0.0.1 localhost.localdomain
Name:      dvd.netflix.com
Address 1: 207.45.72.201
then if manually adding the single IP to the Selective routing GUI doesn't work, then presumably the IP address probably isn't a single entity or you are missing another associated URL/domain?

If however you are concerned that your IPSET DVDNetflix apparently isn't being populated, then this is probably because there may already be an existing dnsmasq directive that extracts any '*.netflix.com' ?
e.g. on my system it appears I already have:
Code: 
ipset=/netflix.com/NETFLIX
entry...as shown by the following entry found in 'dnsmasq.log'
Code: 
Mar 10 21:48:32 dnsmasq[32249]: ipset add NETFLIX 207.45.72.201 www.dvd.netflix.com
 
@Marin, what script are you using?

In the IPSET_Netflix.sh script, I am pulling down AS2906 for Netflix IPv4 addresses. dvd.netflix.com belongs to another AS Number - AS394406. So, it is not included.
upload_2019-3-11_7-25-42.png

You can manually add it to the x3mRouting_NETFLIX ipset list using the syntax @Martineau posts above. e.g. ipset add x3mRouting_NETFLIX 207.45.72.201

However, the IPv4 address will get wiped out during a refresh.

In IPSET_Netflix_Domains.sh, lines with the reference
Code: 
ipset=/amazonaws.com/netflix.com/nflxext.com/nflximg.net/nflxso.net/nflxvideo.net/x3mRouting_NETFLIX_DNSMASQ
would need to be modified to include the dvd.netflix.com domain:

Code: 
ipset=/amazonaws.com/netflix.com/nflxext.com/nflximg.net/nflxso.net/nflxvideo.net/dvd.netflix.com/x3mRouting_NETFLIX_DNSMASQ

If you manually update the ipset list domain names in dnsmasq.conf.add to include dvd.netflix.com, remember to bounce dnsmasq so it takes affect.

service restart_dnsmasq

Those are the work arounds for now. I have to fix one issue with the code. While in there, I can look into including dvd.netflix.com.
 
Martineau said:
If the domain 'www.dvd.netflix.com' truly resolves to a single IP address
Code: 
nslookup www.dvd.netflix.com

Server:    127.0.0.1
Address 1: 127.0.0.1 localhost.localdomain
Name:      www.dvd.netflix.com
Address 1: 207.45.72.201

Code: 
nslookup dvd.netflix.com

Server:    127.0.0.1
Address 1: 127.0.0.1 localhost.localdomain
Name:      dvd.netflix.com
Address 1: 207.45.72.201
then if manually adding the single IP to the Selective routing GUI doesn't work, then presumably the IP address probably isn't a single entity or you are missing another associated URL/domain?

If however you are concerned that your IPSET DVDNetflix apparently isn't being populated, then this is probably because there may already be an existing dnsmasq directive that extracts any '*.netflix.com' ?
e.g. on my system it appears I already have:
Code: 
ipset=/netflix.com/NETFLIX
entry...as shown by the following entry found in 'dnsmasq.log'
Code: 
Mar 10 21:48:32 dnsmasq[32249]: ipset add NETFLIX 207.45.72.201 www.dvd.netflix.com
Click to expand...

Thank you for your reply. It is interesting that I am able to access Netflix main site and stream movies using the Selective Routing for Netflix script but when I try to access this particular category on the same site, I can’t. When I off the VPN, I am able to without any issues.



Sent from my iPhone using Tapatalk
 
Xentrk said:
@Marin, what script are you using?

In the IPSET_Netflix.sh script, I am pulling down AS2906 for Netflix IPv4 addresses. dvd.netflix.com belongs to another AS Number - AS394406. So, it is not included.
View attachment 16518
You can manually add it to the x3mRouting_NETFLIX ipset list using the syntax @Martineau posts above. e.g. ipset add x3mRouting_NETFLIX 207.45.72.201

However, the IPv4 address will get wiped out during a refresh.

In IPSET_Netflix_Domains.sh, lines with the reference
Code: 
ipset=/amazonaws.com/netflix.com/nflxext.com/nflximg.net/nflxso.net/nflxvideo.net/x3mRouting_NETFLIX_DNSMASQ
would need to be modified to include the dvd.netflix.com domain:

Code: 
ipset=/amazonaws.com/netflix.com/nflxext.com/nflximg.net/nflxso.net/nflxvideo.net/dvd.netflix.com/x3mRouting_NETFLIX_DNSMASQ

If you manually update the ipset list domain names in dnsmasq.conf.add to include dvd.netflix.com, remember to bounce dnsmasq so it takes affect.

service restart_dnsmasq

Those are the work arounds for now. I have to fix one issue with the code. While in there, I can look into including dvd.netflix.com.
Click to expand...

Hi @Xentrk,

I have only used the IPSET_Netflix.sh script and it has worked really well for me.

I will try what you advice and see if it works. This is all very good info, I really appreciate it!!

Thank you to both!!


Sent from my iPhone using Tapatalk
 
posting more info on this on the Selective Netflix Routing thread
 
You must log in or register to reply here.

Similar threads

H
Extremely low speed on ac86u with openvpn client
Replies
7
Views
496
hassangh
H
D
VPN director issue on RT-AC86U (386.14 Merlin FW)
Replies
9
Views
426
Dome01
D
Z
Sudden VPN client issues with RX-AX82U
Replies
5
Views
245
eibgrad
eibgrad
D
ASUS AX11000
Replies
0
Views
405
Dstrong91
D
S
Using Web & Apps Filters with scheduling
Replies
0
Views
841
stephen7114
S
Similar threads
Thread starter Title Forum Replies Date
M Wireless Mac filter defaulting to whitelist. Asuswrt-Merlin 5
Q [Feature Request] Schedule DoS Protection state and/or whitelist option Asuswrt-Merlin 5
E Is there a way to switch a led to a specific colour by calling into a c program ? Asuswrt-Merlin 10
P Is there a way to suppress a specific message from syslog? Asuswrt-Merlin 0
Run5k Solved ASUS RT-AC68U router can't reach specific website - known issue? Asuswrt-Merlin 6
T Block YouTube from specific devices only Asuswrt-Merlin 2
D How to restrict VPN network access to certain IP Range or Hosts for specific VPN client Asuswrt-Merlin 8
M Firewall rule to allow only a specific domain name Asuswrt-Merlin 13

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 563 (members: 15, guests: 548)
Top