x3mRouting x3mRouting ~ Selective Routing for Asuswrt-Merlin Firmware (1-Nov-2020)

Xentrk · May 9, 2021

Suresh said:
@Xentrk it seems prime video no longer works with Amazon global dnsmasq method. Is there a new code we can try within US?

Code:

x3mRouting.sh 1 0 AMAZON aws_region=GLOBAL

Use US region if you reside in US. I was using US for a very long time. I then switched to GLOBAL for awhile as a test. But one day I had a requirement to create different routing rules for AWS regions EU and US. So, I went back to US so I could create a separate rule for EU. Some people specify all regions. Separate regions using comma e.g. (aws_region=US,GLOBAL).

Suresh · May 9, 2021

@Xentrk not sure if you know the answer but i just started using Asus Instant Guard on my iPhone to route mobile traffic through my home network. When I turn it on, traffic seen to bypass all my x3mrouting rules and it is exposing my ISP IP. Is there a rule setup I am missing here?

I see IPSec Server created when running Instant Guard on my iPhone.

using Diversion, i found that the iPhone has ip 10.10.10.1 when connected to Instant Guard and I can see traffic going through router while i am connected to cellular/InstantGuard.

is there a command similar to this to route this traffic through client 1?

Code:

x3mRouting server=1 client=1

Xentrk · May 10, 2021

Suresh said:
@Xentrk not sure if you know the answer but i just started using Asus Instant Guard on my iPhone to route mobile traffic through my home network. When I turn it on, traffic seen to bypass all my x3mrouting rules and it is exposing my ISP IP. Is there a rule setup I am missing here?

I see IPSec Server created when running Instant Guard on my iPhone.

View attachment 33740

using Diversion, i found that the iPhone has ip 10.10.10.1 when connected to Instant Guard and I can see traffic going through router while i am connected to cellular/InstantGuard.

is there a command similar to this to route this traffic through client 1?

Code:

x3mRouting server=1 client=1

There is not a similar feature in x3mRouting for IPSec traffic. x3mRouting supports OpenVPN Server to OpenVPN client or OpenVPN server to ipset list prerouting rules. No plans to add support for IPSec.

Sonyrolfy · May 11, 2021

Xentrk said:
Use US region if you reside in US. I was using US for a very long time. I then switched to GLOBAL for awhile as a test. But one day I had a requirement to create different routing rules for AWS regions EU and US. So, I went back to US so I could create a separate rule for EU. Some people specify all regions. Separate regions using comma e.g. (aws_region=US,GLOBAL).

Hi Xentrk, Still going strong with your script here!

For Amazon Prime video i made a dnsmasq rule:

x3mRouting 1 0 amazonvideo.com dnsmasq=amazonvideo.com

This works perfect from my side in the EU.

2 81 4409 MARK all -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set amazonvideo.com dst MARK or 0x8000

Maybe it works in the us aswell?

Suresh · May 11, 2021

Sonyrolfy said:
Hi Xentrk, Still going strong with your script here!

For Amazon Prime video i made a dnsmasq rule:

x3mRouting 1 0 amazonvideo.com dnsmasq=amazonvideo.com

This works perfect from my side in the EU.

2 81 4409 MARK all -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set amazonvideo.com dst MARK or 0x8000

Maybe it works in the us aswell?

It worked, not sure why this amazonvideo.com isn't part of aws_region=US

Brainstorm · May 11, 2021

Xentrk said:
With Asuswrt-Merlin, you can run from 1 to 5 VPN Clients at the same time. BBC blocks known VPN servers. As a result, I have a dedicated or private IP in UK that is not shared. I then route BBC traffic to the VPN Client to UK. For me, this is VPN client 3. I also have Netflix and other streaming services in my home country that block shared VPNs too. As a result, I route Netflix, Hulu, etc to my Private IP in US. This is VPN Client 1 on my router. Most LAN clients are assigned to use a shared VPN servers in Los Angeles. This is VPN client 2. I also have a few sites I need to route to the WAN. So I use the dnsmasq method for that.

As a result, most of my LAN devices default to Los Angeles for most web traffic. But BBC goes to VPN client 3 and US streaming services to VPN client 1. The x3mRouting rules will take higher priority than the LAN rules for clients. So, the clients can also be assigned to use the WAN or a VPN tunnel, but when they access BBC, the traffic will traverse thru the VP

Brainstorm · May 11, 2021

Hi Xentrk. Just wondering how you got a dedicated UK IP, and how it works for tv. I'm spending more and more time abroad for work, and use Nord and Express, but both are sometimes found out and blocked, and both can be slow. I have family in the UK, and was considering buying a decent router and setting up a vpn server there, but I'm not sure how feasible that is, or what performance would be like given upload/download speeds. Any advice would be extremely welcome....

Torson · May 11, 2021

There are some VPN providers currently offering dedicated IP addresses. ...and yes, they work well for streaming and more.

Two that come to mind are TorGuard and PIA.
Here is @Xentrk's write-up on TorGuard: https://x3mtek.com/why-i-use-torguard-as-my-vpn-provider/. And a link to PIA's offering: https://www.privateinternetaccess.com/helpdesk/kb/articles/do-you-offer-dedicated-ip-addresses.

This being said, there are endless threads out there on what level of privacy to expect and why.

Xentrk · May 12, 2021

Brainstorm said:
Hi Xentrk. Just wondering how you got a dedicated UK IP, and how it works for tv. I'm spending more and more time abroad for work, and use Nord and Express, but both are sometimes found out and blocked, and both can be slow. I have family in the UK, and was considering buying a decent router and setting up a vpn server there, but I'm not sure how feasible that is, or what performance would be like given upload/download speeds. Any advice would be extremely welcome....

The dedicated IP is meant for streaming services that get blocked by known/shared VPN servers. Please see this article for an explanation. There is no requirement to use DNS of VPN provider either. App for Android and Google streaming devices, etc..

Xentrk · May 12, 2021

Suresh said:
It worked, not sure why this amazonvideo.com isn't part of aws_region=US

You can use the autoscan.sh script to search for domain names in dnsmasq log that have amazon in the name. Then, use the ASN Lookup Utility on some of the domains and see what the AS number it returns and other information. I just used US region for several years. Then, I switched to GLOBAL for some testing and found it still worked. Then something happened one day and it stopped working. I then changed it back to US and commented out GLOBAL. Plus, I some BBC domains are hosted on AWS EU region so I had to create a separate rule.

Example of autoscan.sh and ASN Lookup Utility (Install using Option 4)

Code:

 sh autoscan.sh scan=amazon

IPSET Format
-------------------------------------
amazon-adsystem.com
amazon.com
amazon.dev
amazonalexa.com
amazonaws.com
amazonvideo.com
media-amazon.com


FQDN Format
-------------------------------------
aax-us-east.amazon-adsystem.com
ab2xb7ra6e44.na.api.amazonvideo.com
api.amazon.com
api.amazonalexa.com
arcus-uswest.amazon.com
aviary.amazon.com
avs-alexa-18-na.amazon.com
dcape-na.amazon.com
dna.amazon.com
dp-discovery-na-ext.amazon.com
dp-gw-na.amazon.com
firebat-25-aftn-232216.na.api.amazonvideo.com
firs-ta-g7g.amazon.com
ktpx.amazon.com
m.media-amazon.com
msh.amazon.com
sessions.prod.bugs.firebat.prime-video.amazon.dev
spectrum.s3.amazonaws.com

# asn ab2xb7ra6e44.na.api.amazonvideo.com

------------------------------------------------------
| ASN lookup for ab2xb7ra6e44.na.api.amazonvideo.com |
------------------------------------------------------

- Resolving "ab2xb7ra6e44.na.api.amazonvideo.com"... 4 IP addresses found:

  52.84.224.71 +PTR server-52-84-224-71.sin2.r.cloudfront.net
               +ASN 16509 (AMAZON-02, US)
               +ORG Amazon.com, Inc.
               +NET 52.84.224.0/22 (AMAZO-CF)
               +ABU abuse@amazonaws.com
               +GEO Singapore, Singapore (SG)

52.84.224.121 +PTR server-52-84-224-121.sin2.r.cloudfront.net
               +ASN 16509 (AMAZON-02, US)
               +ORG Amazon.com, Inc.
               +NET 52.84.224.0/22 (AMAZO-CF)
               +ABU abuse@amazonaws.com
               +GEO Singapore, Singapore (SG)

  52.84.224.74 +PTR server-52-84-224-74.sin2.r.cloudfront.net
               +ASN 16509 (AMAZON-02, US)
               +ORG Amazon.com, Inc.
               +NET 52.84.224.0/22 (AMAZO-CF)
               +ABU abuse@amazonaws.com
               +GEO Singapore, Singapore (SG)

  52.84.224.11 +PTR server-52-84-224-11.sin2.r.cloudfront.net
               +ASN 16509 (AMAZON-02, US)
               +ORG Amazon.com, Inc.
               +NET 52.84.224.0/22 (AMAZO-CF)
               +ABU abuse@amazonaws.com
               +GEO Singapore, Singapore (SG)
<snip>

Note the region is listed in the ASN 16509 line.

Brainstorm · May 12, 2021

x3mRouting question....

#########################################################
# Assign the interface for each LAN client by entering #
# the appropriate interface number in the first column #
# 0 = WAN #
# 1 = OVPNC1 #
# 2 = OVPNC2 #
# 3 = OVPNC3 #
# 4 = OVPNC4 #
# 5 = OVPNC5 #
#########################################################
0 192.168.1.150 SamsungTV
1 192.168.1.151 Samsung-Phone
2 192.168.1.152 Asus-Laptop
2 192.168.1.153 iPad
1 192.168.1.154 Lenovo-Laptop

Does this mean I can only route a device to a vpn? I want to route different apps on the TV/Roku to different vpn's, is that possible?

Kris87 · May 13, 2021

Having an issue with x3mRouting Option 3. I want to route traffic to certain IPs through the WAN interface instead of the VPN client:

Code:

admin@RT-AC86U-A2E8:/# x3mRouting 1 0 WHATISMY ip=104.16.155.36,104.16.154.36
(x3mRouting): 10940 Starting Script Execution 1 0 WHATISMY ip=104.16.155.36,104.16.154.36
Successfully added 104.16.155.36
Successfully added 104.16.154.36
(x3mRouting): 10940 IPSET created: WHATISMY
(x3mRouting): 10940 Selective Routing Rule via WAN created for WHATISMY fwmark 0x8000/0x8000
(x3mRouting): 10940 iptables -t mangle -D PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 2>/dev/null added to /jffs/scripts/x3mRouting/vpnclient1-route-up
(x3mRouting): 10940 iptables -t mangle -A PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 added to /jffs/scripts/x3mRouting/vpnclient1-route-up
(x3mRouting): 10940 iptables -t mangle -D PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 2>/dev/null added to /jffs/scripts/x3mRouting/vpnclient1-route-pre-down
(x3mRouting): 10940 sh /jffs/scripts/x3mRouting/x3mRouting.sh 1 0 WHATISMY added to /jffs/scripts/nat-start
(x3mRouting): 10940 Completed Script Execution

IPSET and PREROUTING seems to work as I do see some packets:

Code:

admin@RT-AC86U-A2E8:/# ipset -L WHATISMY
Name: WHATISMY
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 480
References: 1
Number of entries: 2
Members:
104.16.154.36
104.16.155.36

admin@RT-AC86U-A2E8:/# iptables -nvL PREROUTING -t mangle --line
Chain PREROUTING (policy ACCEPT 679K packets, 525M bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      162 13422 MARK       all  --  br0    *       0.0.0.0/0            0.0.0.0/0            match-set WHATISMY dst MARK or 0x8000

However, the routing does not work. I am confused as to why /jffs/scripts/nat-start only contains one line: "#!/bin/sh" (the same for /jffs/scripts/x3mRouting/vpnclient1-route-up) - these files were created by the x3mRouting command above.

I also noticed that x3mRouting appended "sh /jffs/scripts/x3mRouting/openvpn-event $@" to the previously existing file /jffs/scripts/openvpn-event, however, this line comes after an "exit 0" - surely that's not how it's supposed to work?

Any ideas?

Xentrk · May 15, 2021

Brainstorm said:
x3mRouting question....

#########################################################
# Assign the interface for each LAN client by entering #
# the appropriate interface number in the first column #
# 0 = WAN #
# 1 = OVPNC1 #
# 2 = OVPNC2 #
# 3 = OVPNC3 #
# 4 = OVPNC4 #
# 5 = OVPNC5 #
#########################################################
0 192.168.1.150 SamsungTV
1 192.168.1.151 Samsung-Phone
2 192.168.1.152 Asus-Laptop
2 192.168.1.153 iPad
1 192.168.1.154 Lenovo-Laptop

Does this mean I can only route a device to a vpn? I want to route different apps on the TV/Roku to different vpn's, is that possible?

Option 2 and 3 provide the ability to route traffic. It can coexist with Option 1. For example, you can set up you streaming device to use VPN Client 1 using x3mRouting option 1. But because VPN Client 1 is a shared or known VPN server, Netflix will block you. As a result, you can create a rule so Netflix bypasses the VPN client 1. Read thru the examples on the x3mRouting README.

Xentrk · May 15, 2021

Kris87 said:
Having an issue with x3mRouting Option 3. I want to route traffic to certain IPs through the WAN interface instead of the VPN client:

Code:

admin@RT-AC86U-A2E8:/# x3mRouting 1 0 WHATISMY ip=104.16.155.36,104.16.154.36 (x3mRouting): 10940 Starting Script Execution 1 0 WHATISMY ip=104.16.155.36,104.16.154.36 Successfully added 104.16.155.36 Successfully added 104.16.154.36 (x3mRouting): 10940 IPSET created: WHATISMY (x3mRouting): 10940 Selective Routing Rule via WAN created for WHATISMY fwmark 0x8000/0x8000 (x3mRouting): 10940 iptables -t mangle -D PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 2>/dev/null added to /jffs/scripts/x3mRouting/vpnclient1-route-up (x3mRouting): 10940 iptables -t mangle -A PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 added to /jffs/scripts/x3mRouting/vpnclient1-route-up (x3mRouting): 10940 iptables -t mangle -D PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 2>/dev/null added to /jffs/scripts/x3mRouting/vpnclient1-route-pre-down (x3mRouting): 10940 sh /jffs/scripts/x3mRouting/x3mRouting.sh 1 0 WHATISMY added to /jffs/scripts/nat-start (x3mRouting): 10940 Completed Script Execution

IPSET and PREROUTING seems to work as I do see some packets:

Code:

admin@RT-AC86U-A2E8:/# ipset -L WHATISMY Name: WHATISMY Type: hash:net Revision: 6 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 480 References: 1 Number of entries: 2 Members: 104.16.154.36 104.16.155.36 admin@RT-AC86U-A2E8:/# iptables -nvL PREROUTING -t mangle --line Chain PREROUTING (policy ACCEPT 679K packets, 525M bytes) num pkts bytes target prot opt in out source destination 1 162 13422 MARK all -- br0 * 0.0.0.0/0 0.0.0.0/0 match-set WHATISMY dst MARK or 0x8000

However, the routing does not work. I am confused as to why /jffs/scripts/nat-start only contains one line: "#!/bin/sh" (the same for /jffs/scripts/x3mRouting/vpnclient1-route-up) - these files were created by the x3mRouting command above.

I also noticed that x3mRouting appended "sh /jffs/scripts/x3mRouting/openvpn-event $@" to the previously existing file /jffs/scripts/openvpn-event, however, this line comes after an "exit 0" - surely that's not how it's supposed to work?

Any ideas?

I wonder if you have an older version installed of x3mRouting.sh that had the issue. It appears that nat-start and the openvpn up and pre-down files not being populated. I can't duplicate the issue. What version of x3mRouting is installed? Here is how to check:

Code:

grep "VERSION=" /jffs/scripts/x3mRouting/x3mRouting.sh
# VERSION=2.3.10

I tested on AC88U using VPN Client 2 as the source as that is what my laptop is assigned. I renamed /jffs/scripts/nat-start and the vpnclient 2 up/down files to start from a fresh state.

Code:

x3mRouting 2 0 WHATISMY ip=104.16.155.36,104.16.154.36

The above creates an ipset list using the Manual method.
/jffs/scripts/nat-start contains the manual method entry:

Code:

#!/bin/sh
sh /jffs/scripts/x3mRouting/x3mRouting.sh 2 0 WHATISMY

save/backup file in /opt/tmp/WHATISMY contains the ip addresses

Code:

104.16.154.36
104.16.155.36

ipset list WHATISMY is loaded with IPv4 addresses in memory:

Code:

ipset -L WHATISMY
Name: WHATISMY
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 428
References: 1
Number of entries: 2
Members:
104.16.155.36
104.16.154.36

/jffs/scripts/x3mRouting/vpnclient2-route-pre-down

Code:

#!/bin/sh
iptables -t mangle -D PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 2>/dev/null

Code:

#!/bin/sh
iptables -t mangle -D PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 2>/dev/null
iptables -t mangle -A PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000

Routing is working. whatismyipaddress.com reports WAN address and whatismyip.com reports VPN client 2 address.

For the second issue, x3mRouting does not check for the "exit 0" condition when appending the line to /jffs/scripts/openvpn-event. I will add patch to check for that condition. You can edit it manually for now.

Kris87 · May 15, 2021

Xentrk said:
I wonder if you have an older version installed of x3mRouting.sh that had the issue. It appears that nat-start and the openvpn up and pre-down files not being populated. I can't duplicate the issue. What version of x3mRouting is installed? Here is how to check:

Code:

grep "VERSION=" /jffs/scripts/x3mRouting/x3mRouting.sh # VERSION=2.3.10

I tested on AC88U using VPN Client 2 as the source as that is what my laptop is assigned. I renamed /jffs/scripts/nat-start and the vpnclient 2 up/down files to start from a fresh state.

Code:

x3mRouting 2 0 WHATISMY ip=104.16.155.36,104.16.154.36

The above creates an ipset list using the Manual method.
/jffs/scripts/nat-start contains the manual method entry:

Code:

#!/bin/sh sh /jffs/scripts/x3mRouting/x3mRouting.sh 2 0 WHATISMY

save/backup file in /opt/tmp/WHATISMY contains the ip addresses

Code:

104.16.154.36 104.16.155.36

ipset list WHATISMY is loaded with IPv4 addresses in memory:

Code:

ipset -L WHATISMY Name: WHATISMY Type: hash:net Revision: 6 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 428 References: 1 Number of entries: 2 Members: 104.16.155.36 104.16.154.36

/jffs/scripts/x3mRouting/vpnclient2-route-pre-down

Code:

#!/bin/sh iptables -t mangle -D PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 2>/dev/null

Code:

#!/bin/sh iptables -t mangle -D PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 2>/dev/null iptables -t mangle -A PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000

Routing is working. whatismyipaddress.com reports WAN address and whatismyip.com reports VPN client 2 address.

For the second issue, x3mRouting does not check for the "exit 0" condition when appending the line to /jffs/scripts/openvpn-event. I will add patch to check for that condition. You can edit it manually for now.

Thank you for looking into this, Xentrk!

x3mRouting is at version 2.3.10 and I modified the empty files and /jffs/scripts/openvpn-event manually according to your instructions. I assume the last set should go into /jffs/scripts/xm3Routing/vpnclient1-route-up:

Code:

iptables -t mangle -D PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000 2>/dev/null

iptables -t mangle -A PREROUTING -i br0 -m set --match-set WHATISMY dst -j MARK --set-mark 0x8000/0x8000

The way I understand it, it should work right after installation, i.e. no reboot or restart of VPN client necessary - but makes no difference anyway.

So apart from VPN client #1 vs. #2 I our settings are identical, yet whatismyipaddress.com reports the VPN client 1 IP address.

In the GUI on the VPN tab I have "Force Internet traffic through tunnel=Policy Rules" and a rule that says to route my local subnet (my workstation's IP) through Iface VPN - is that okay?

Just curious and perhaps a stupid question, is there a way to see the routing works correctly (or incorrectly) *on the router*, e.g. by querying a "from [local workstation IP] to 104.16.154.36"?

Brainstorm · May 15, 2021

Xentrk said:
Option 2 and 3 provide the ability to route traffic. It can coexist with Option 1. For example, you can set up you streaming device to use VPN Client 1 using x3mRouting option 1. But because VPN Client 1 is a shared or known VPN server, Netflix will block you. As a result, you can create a rule so Netflix bypasses the VPN client 1. Read thru the examples on the x3mRouting README.

OK. So this:
#########################################################
# Assign the interface for each LAN client by entering #
# the appropriate interface number in the first column #
# 0 = WAN #
# 1 = OVPNC1 #
# 2 = OVPNC2 #
# 3 = OVPNC3 #
# 4 = OVPNC4 #
# 5 = OVPNC5 #
#########################################################
0 192.168.1.150 SamsungTV
1 192.168.1.151 Samsung-Phone
2 192.168.1.152 Asus-Laptop
2 192.168.1.153 iPad
1 192.168.1.154 Lenovo-Laptop

Is just allocating static ip addresses to DHCP, yes?
I've read through the README file. That's a long read with an awful lot of info and different ways of achieving the same result, and now I'm a little confused. For me, the only way to understand how to do it and what it's capable of, I'll have to download it and try it, but in principle, I can configure it so my smart TV can use one vpn for one service, and another vpn for another. Is that a correct assumption?

Xentrk · May 15, 2021

@Brainstorm
Focus on the section that explains option 3 usage. The usage examples should help.

For example

Code:

x3mRouting ALL 1 NETFLIX  dnsmasq=netflix.com,nflxext.com,nflximg.net,nflxso.net,nflxvideo.net

Here is a brief summary of the above:

x3mRouting is the command. It calls the script /jffs/scripts/x3mRouting/x3mRouting.sh
ALL is the source of the data. ALL means "ALL Netflix" traffic from any device on the network
1 is the destination. This is VPN Client 1.
NETFLIX is the IPSET name
dnsmasq=netflix.com,nflxext.com,nflximg.net,nflxso.net,nflxvideo.net is the "dnsmasq" method used to gather the IPv4 addresses and load them into the IPSET list. Other methods are Amazon AWS region, ASN and manual.

In summary, route all Netflix traffic from any device on the network to VPN Client 1. This will override any LAN client routing rules for a device or devices. For example, if my FireTV is configured to use VPN Client 2, Netflix traffic will get routed to VPN Client 1.

Brainstorm · May 16, 2021

Xentrk said:
@Brainstorm
Focus on the section that explains option 3 usage. The usage examples should help.

For example

Code:

x3mRouting ALL 1 NETFLIX dnsmasq=netflix.com,nflxext.com,nflximg.net,nflxso.net,nflxvideo.net

Here is a brief summary of the above:

x3mRouting is the command. It calls the script /jffs/scripts/x3mRouting/x3mRouting.sh
ALL is the source of the data. ALL means "ALL Netflix" traffic from any device on the network
1 is the destination. This is VPN Client 1.
NETFLIX is the IPSET name
dnsmasq=netflix.com,nflxext.com,nflximg.net,nflxso.net,nflxvideo.net is the "dnsmasq" method used to gather the IPv4 addresses and load them into the IPSET list. Other methods are Amazon AWS region, ASN and manual.

In summary, route all Netflix traffic from any device on the network to VPN Client 1. This will override any LAN client routing rules for a device or devices. For example, if my FireTV is configured to use VPN Client 2, Netflix traffic will get routed to VPN Client 1.

Hi Xentrk. Thanks for your patience. I'm having trouble loading the code....amtm keeps saying it wants entware, but I can't see how to install it, as my amtm doesn't show any option to download it, only to Show available scripts ot tools, check for updated scripts, and atm options. AC86U is ruuning 386.2.2. Do I need to load diversion toget the full set of amtm commands?

Brainstorm · May 17, 2021

Brainstorm said:
x3mRoutingHi Xentrk. Thanks for your patience. I'm having trouble loading the code....amtm keeps saying it wants entware, but I can't see how to install it, as my amtm doesn't show any option to download it, only to Show available scripts ot tools, check for updated scripts, and atm options. AC86U is ruuning 386.2.2. Do I need to load diversion toget the full set of amtm commands?

So I've loaded entware, I've run
sh -c "$(curl -sL https://raw.githubusercontent.com/Xentrk/x3mRouting/master/Install_x3mRouting.sh)"
and installed all the packages, but I haven't edited any of the files.
However, the first thing that happens is none of my configured express vpns will connect. I just get an error message " Error, check configuration" I've tried rebooting the router, reinstalling the vpns, but they won't work unless I delete all of x3mRouting and reboot. Then I have to reinstall the vpn configs again, and they will work and connect.
I tried reinstalling the x3mRouting packages and editing the /jffs/scripts/x3mRouting/x3mRouting_client_rules file, but nothing changed.
I'm obviously doing something fundamentally wrong. Anyone have any idea what it might be? Should the vpn's still work after I've loaded the packages but not configured anything?

Xentrk · May 17, 2021

Brainstorm said:
So I've loaded entware, I've run
sh -c "$(curl -sL https://raw.githubusercontent.com/Xentrk/x3mRouting/master/Install_x3mRouting.sh)"
and installed all the packages, but I haven't edited any of the files.
However, the first thing that happens is none of my configured express vpns will connect. I just get an error message " Error, check configuration" I've tried rebooting the router, reinstalling the vpns, but they won't work unless I delete all of x3mRouting and reboot. Then I have to reinstall the vpn configs again, and they will work and connect.
I tried reinstalling the x3mRouting packages and editing the /jffs/scripts/x3mRouting/x3mRouting_client_rules file, but nothing changed.
I'm obviously doing something fundamentally wrong. Anyone have any idea what it might be? Should the vpn's still work after I've loaded the packages but not configured anything?

Look in the System Log for clues as to why the VPN connection is having issues. Most providers allow you to create and import an ovpn config file which helps eliminates errors. Policy Rules (Strict) setting needs to be enabled in the OpenVPN client screen for x3mRouting to work.

Thread starter	Title	Forum	Replies	Date
C	How do I get x3mrouting working with AdGuard Home ?	Asuswrt-Merlin AddOns	6	Sep 11, 2024
A	x3mRouting x3mRouting vs Domain based VPN routing	Asuswrt-Merlin AddOns	29	Apr 29, 2024
R	DomainVPNRouting Domain VPN Routing v3.0.4 *Release*	Asuswrt-Merlin AddOns	54	Sep 30, 2024
C	Question about DomainBased Routing & Re-connection	Asuswrt-Merlin AddOns	0	Sep 29, 2024
K	DomainVPNRouting Domain VPN Routing help	Asuswrt-Merlin AddOns	4	Sep 8, 2024
A	DomainVPNRouting Domain VPN Routing Question	Asuswrt-Merlin AddOns	32	Apr 21, 2024
	DomainVPNRouting Domain-based VPN routing script	Asuswrt-Merlin AddOns	2	Feb 11, 2024
R	DomainVPNRouting Domain VPN Routing	Asuswrt-Merlin AddOns	96	Jan 22, 2024

x3mRouting x3mRouting ~ Selective Routing for Asuswrt-Merlin Firmware (1-Nov-2020)

Part of the Furniture

Occasional Visitor

Part of the Furniture

Senior Member

Occasional Visitor

Regular Contributor

Regular Contributor

Senior Member

Part of the Furniture

Part of the Furniture

Regular Contributor

New Around Here

Part of the Furniture

Part of the Furniture

New Around Here

Regular Contributor

Part of the Furniture

Regular Contributor

Regular Contributor

Part of the Furniture

Similar threads

Similar threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest