x3mRouting x3mRouting ~ Selective Routing for Asuswrt-Merlin Firmware

andresmorago · Oct 14, 2019

hello @Martineau
i got this to work so all vpn clients are routed through the other vpn.

vpnclient1-route-up

Code:

#!/bin/sh
logger -st "($(basename "$0"))" $$ Starting Script Execution JAJA

sh /jffs/scripts/x3mRouting/load_MANUAL_ipset_iface.sh 1 amazon_vpn

iptables -D POSTROUTING -t nat -s 10.0.1.0/24 -o tun11 -j MASQUERADE
iptables -I POSTROUTING -t nat -s 10.0.1.0/24 -o tun11 -j MASQUERADE

logger -st "($(basename "$0"))" $$ Ending Script Execution

quick question: how do i undo this so the clients are now routed back throught the routers wan?

i tried by running

Code:

iptables -D POSTROUTING -t nat -s 10.0.1.0/24 -o tun11 -j MASQUERADE

but now clients will have no internet access

Martineau · Oct 14, 2019

andresmorago said:
hello @Martineau
i got this to work so all vpn clients are routed through the other vpn.

vpnclient1-route-up

Code:

#!/bin/sh logger -st "($(basename "$0"))" $$ Starting Script Execution JAJA sh /jffs/scripts/x3mRouting/load_MANUAL_ipset_iface.sh 1 amazon_vpn iptables -D POSTROUTING -t nat -s 10.0.1.0/24 -o tun11 -j MASQUERADE iptables -I POSTROUTING -t nat -s 10.0.1.0/24 -o tun11 -j MASQUERADE logger -st "($(basename "$0"))" $$ Ending Script Execution

quick question: how do i undo this so the clients are now routed back throught the routers wan?

i tried by running

Code:

iptables -D POSTROUTING -t nat -s 10.0.1.0/24 -o tun11 -j MASQUERADE

but now clients will have no internet access

The -t nat POSTROUTING rule simply ensures the packets originating from the OpenVPN Server subnet will find their way back when they return inbound from the VPN Client ISP.

You need to review the RPDB rules, and remove the OpenVPN subnet entries

Code:

ip rule

i.e. if they are defined in the VPN Client Selective Routing GUI then remove them or manually issue the appropriate delete command

Code:

ip rule del prio nnnn

Xentrk · Oct 14, 2019

PeterV said:

Hi.
I found incompatibility of selective routing with SkyNet.
SkyNet during update process did a firewall restart.
It is clear any selective routing rules ...

Code:

2019-10-14T01:25:01+03:00 192.168.99.1 Skynet: [%] New Version Detected - Updating To v6.8.8 (fc4a4faf0394ad20cac1efed649caad7)
2019-10-14T01:25:03+03:00 192.168.99.1 Skynet: [%] Restarting Firewall Service
2019-10-14T01:25:03+03:00 192.168.99.1 rc_service: service 6334:notify_rc restart_firewall
2019-10-14T01:25:03+03:00 192.168.99.1 custom_script: Running /jffs/scripts/service-event (args: restart firewall)
2019-10-14T01:25:03+03:00 192.168.99.1 service-event: Started for event restart of service firewall
2019-10-14T01:25:04+03:00 192.168.99.1 nat: apply nat rules (/tmp/nat_rules_ppp0_eth0)
2019-10-14T01:25:04+03:00 192.168.99.1 custom_script: Running /jffs/scripts/firewall-start (args: ppp0)

After that I have the next result of iptables -t mangle -L PREROUTING

Code:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
MARK       all  --  anywhere             anywhere             MARK xset 0x1/0x7

That makes sense as restarting the firewall wipes the iptable rules. For now, placing the commands in /jffs/scripts/nat-start will fix the issue after a firewall restart.

nat-start

Code:

#!/bin/sh

### IPSET Shell Script Method

sh /jffs/scripts/x3mRouting/load_AMAZON_ipset_iface.sh 1 AMAZON_US US
sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 1 NETFLIX AS2906

sh /jffs/scripts/x3mRouting/load_DNSMASQ_ipset_iface.sh 3 BBC_WEB bbc.co.uk,bbc.com,bbc.gscontxt.net,bbci.co.uk,bbctvapps.co.uk,ssl-bbcsmarttv.2cnt.net,llnwd.net
sh /jffs/scripts/x3mRouting/load_DNSMASQ_ipset_iface.sh 5 CBS_WEB cbs.com,cbsnews.com,cbssports.com,cbsaavideo.com,omtrdc.net,akamaihd.net,irdeto.com,cbsi.com,cbsig.net
sh /jffs/scripts/x3mRouting/load_DNSMASQ_ipset_iface.sh 1 HULU_WEB hulu.com,hulustream.com,akamaihd.net
sh /jffs/scripts/x3mRouting/load_DNSMASQ_ipset_iface.sh 5 MOVETV movetv.com

It appears I will have to recommend that users place the command in both /jffs/scripts/nat-start and /jffs/scripts/x3mRouting/vpnclientX-route-up to resolve. But I need to get to work now and will look into some more tonight.

Xentrk · Oct 14, 2019

Chrisgtl said:
I have a problem trying to install this.

Option ==> 2
Installing jq (1.6-1) to root...
Downloading http://bin.entware.net/aarch64-k3.10/jq_1.6-1_aarch64-3.10.ipk
Collected errors:
* opkg_install_pkg: Package size mismatch: jq is 109237 bytes, expecting 10923s
* opkg_install_cmd: Cannot install package jq.
An error occurred installing jq

Looks like an entware issue. You can try the commands below or try updating entware using the "ep" option in AMTM.

Code:

opkg update
opkg upgrade
opkg install jq

Laxarus · Oct 15, 2019

Xentrk said:
Did you try using another browser. I found a recent reference about the error online. https://superuser.com/questions/148...-pr-connect-reset-error-in-firefoxs-incognito

If there are sites you want to access over the VPN that your ISP is blocking, find out the IP address of the domain using the nslookup command. You can create a manual IPSET list in /opt/tmp directory. Open the file in an editor and enter the ip addresses. Then, use the MANUAL script script to route the traffic:

sh load_MANUAL_ipset_iface.sh 3 BBC

Okay, I installed x3mRouting succesfully (op2 and op3).
Created a file (named rlist) containing every ip I found through nslookup. Every line contains single ip.
Placed this file into the /opt/tmp folder
SSHed router
navigated to the jffs/scripts/x3mRouting
run the below command
sh load_MANUAL_ipset_iface.sh 2 rlist

Code:

(load_MANUAL_ipset_iface.sh): 17278 Starting Script Execution
(load_MANUAL_ipset_iface.sh): 17278 IPSET created: List hash:net family inet hashsize 1024 maxelem 65536
(load_MANUAL_ipset_iface.sh): 17278 Selective Routing Rule via VPN Client 2 created TAG fwmark 0x2000/0x2000
(load_MANUAL_ipset_iface.sh): 17278 Ending Script Execution

After that I accessed the webgui of the router and enabled client 2.

DNS configuration is exclusive
Force Internet traffic through tunnel is set to Policy Rules (Strict).
The list is empty.
After that I am stuck.
I think something going wrong with the IPSET creation because when I try to delete the list I just created I get an error msg like that
sh load_MANUAL_ipset_iface.sh 2 rlist del

Code:

25451 Error attempting to delete IPSET rlist!

Martineau · Oct 15, 2019

Laxarus said:
I think something going wrong with the IPSET creation because when I try to delete the list I just created I get an error msg like that
sh load_MANUAL_ipset_iface.sh 2 rlist del

Code:

25451 Error attempting to delete IPSET rlist!

After running

Code:

sh load_MANUAL_ipset_iface.sh 2 rlist

you can manually check if the IPSET is created correctly (it should list the IPs imported from/opt/tmp/rlist)

Code:

ipset list rlist

I suspect that

Code:

sh load_MANUAL_ipset_iface.sh 2 rlist del

does actually physically delete the IPSET, but spuriously reports the error.

PeterV · Oct 15, 2019

Xentrk said:
That makes sense as restarting the firewall wipes the iptable rules. For now, placing the commands in /jffs/scripts/nat-start will fix the issue after a firewall restart.

nat-start

It appears I will have to recommend that users place the command in both /jffs/scripts/nat-start and /jffs/scripts/x3mRouting/vpnclientX-route-up to resolve. But I need to get to work now and will look into some more tonight.

Thanks for the idea.

Now I created two files
/jffs/scripts/nat-start

Code:

#!/bin/sh
sh /jffs/scripts/x3mRouting/nat-start $@

and

/jffs/scripts/x3mRouting/nat-start

Code:

#!/bin/sh
###########################################################################################################
# Script: nat-start
# Based on script openvpn-event from Xentrk for x3mRouting project
###########################################################################################################
# Script: openvpn-event
# Author: Xentrk
# Last Updated Date: 3-June-2019
#
# Description:
#   Original Script by John9527:
#   https://www.snbforums.com/threads/fork-asuswrt-merlin-374-43-lts-releases-v39e3.18914/page-238#post-294825
#
#   Modified by Xentrk for x3mRouting project
############################################################################################################
# shellcheck disable=SC2154
PROJECT_REPO="/jffs/scripts/x3mRouting"

scr_name="$(basename "$0")[$$]"
for vpn_id in $(ip rule | grep -oE 'ovpnc[1-5]' | sed 's/ovpnc//')
do
    vpn_if=tun1"$vpn_id"

    vpn_addr=$(ifconfig $vpn_if | grep -oE 'inet addr:[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/inet addr://')

    if [ "$vpn_addr" = "" ]; then
      continue
    fi

    vpn_mtu=$(ifconfig $vpn_if | grep -oiE 'mtu:[0-9]{1,4}' | sed 's/mtu://i')

    # Call appropriate script based on script_type
    vpn_script_name=vpnclient"$vpn_id"-route-up
    vpn_script_params="$vpn_mtu $vpn_mtu $vpn_addr"

    if [ -f "$PROJECT_REPO/$vpn_script_name" ]; then
      echo "Running $PROJECT_REPO/$vpn_script_name $vpn_script_params" | logger -t "$scr_name"
      sh $PROJECT_REPO/"$vpn_script_name" "$vpn_script_params"
    else
      echo "Script not defined for event: ""$vpn_script_name" | logger -t "$scr_name"
      continue
    fi

done

And it works ;-)
But only for clients. I have no openvpn server

Xentrk · Oct 16, 2019

PeterV said:

Thanks for the idea.

Now I created two files
/jffs/scripts/nat-start

Code:

#!/bin/sh
sh /jffs/scripts/x3mRouting/nat-start $@

and

/jffs/scripts/x3mRouting/nat-start

Code:

#!/bin/sh
###########################################################################################################
# Script: nat-start
# Based on script openvpn-event from Xentrk for x3mRouting project
###########################################################################################################
# Script: openvpn-event
# Author: Xentrk
# Last Updated Date: 3-June-2019
#
# Description:
#   Original Script by John9527:
#   https://www.snbforums.com/threads/fork-asuswrt-merlin-374-43-lts-releases-v39e3.18914/page-238#post-294825
#
#   Modified by Xentrk for x3mRouting project
############################################################################################################
# shellcheck disable=SC2154
PROJECT_REPO="/jffs/scripts/x3mRouting"

scr_name="$(basename "$0")[$$]"
for vpn_id in $(ip rule | grep -oE 'ovpnc[1-5]' | sed 's/ovpnc//')
do
    vpn_if=tun1"$vpn_id"

    vpn_addr=$(ifconfig $vpn_if | grep -oE 'inet addr:[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/inet addr://')

    if [ "$vpn_addr" = "" ]; then
      continue
    fi

    vpn_mtu=$(ifconfig $vpn_if | grep -oiE 'mtu:[0-9]{1,4}' | sed 's/mtu://i')

    # Call appropriate script based on script_type
    vpn_script_name=vpnclient"$vpn_id"-route-up
    vpn_script_params="$vpn_mtu $vpn_mtu $vpn_addr"

    if [ -f "$PROJECT_REPO/$vpn_script_name" ]; then
      echo "Running $PROJECT_REPO/$vpn_script_name $vpn_script_params" | logger -t "$scr_name"
      sh $PROJECT_REPO/"$vpn_script_name" "$vpn_script_params"
    else
      echo "Script not defined for event: ""$vpn_script_name" | logger -t "$scr_name"
      continue
    fi

done

And it works ;-)
But only for clients. I have no openvpn server

Thanks for reporting back.

Did you test by issuing the command "service restart_firewall".

What I was recommending is to put the contents of /jffs/scripts/x3mRouting/vpnclientX-route-up inside of /jffs/scripts/nat-start. But your solution should work too. Please note that when /jffs/scripts/nat-start is called, it doesn't pass the VPN parameters though. The "$@" parameter won't have any values. You can add the line echo $@ > /jffs/scripts/nat-start-parms to the /jffs/scripts/nat-start script to log the parms to see what if anything is being passed.

Xentrk · Oct 16, 2019

Laxarus said:
Okay, I installed x3mRouting successfully (op2 and op3).

Edit:

It was my original intent that people would select either option 2 or option 3 - but not both at the same time. However, they can coexist peacefully if you install option 2 first before installing option 3. Option 3 gives you the modified OpenVPN Client screen to selectively route IPSET lists thru an OpenVPN Client.

If you install option 2, an entry gets created in /jffs/scripts/init-start that mounts some custom code. If you then install option 3, the install script deletes the line created by option 2 and inserts a line that also mounts custom code associated with option 3. The only difference is the mounting of the customized OpenVPN Client screen. The other two files being mounted are the same in both options. I have ran with this setup for several months and didn't experience any conflicts.

You can use the command below to see if traffic is traversing the chain:

Code:

iptables -nvL PREROUTING -t mangle --line

The output will display the number of packets and bytes traversing the iptables rule which can be used as confirmation that traffic is being routed according to the rule

Laxarus · Oct 16, 2019

Xentrk said:
Edit:

It was my original intent that people would select either option 2 or option 3 - but not both at the same time. However, they can coexist peacefully if you install option 2 first before installing option 3. Option 3 gives you the modified OpenVPN Client screen to selectively route IPSET lists thru an OpenVPN Client.

If you install option 2, an entry gets created in /jffs/scripts/init-start that mounts some custom code. If you then install option 3, the install script deletes the line created by option 2 and inserts a line that also mounts custom code associated with option 3. The only difference is the mounting of the customized OpenVPN Client screen. The other two files being mounted are the same in both options. I have ran with this setup for several months and didn't experience any conflicts.

You can use the command below to see if traffic is traversing the chain:

Code:

iptables -nvL PREROUTING -t mangle --line

The output will display the number of packets and bytes traversing the iptables rule which can be used as confirmation that traffic is being routed according to the rule

Okay deleted the x3m and reinstalled. After that only installed op3.
Then created the IPSET with

Code:

sh load_MANUAL_ipset_iface.sh 2 rlist

Code:

(load_MANUAL_ipset_iface.sh): 23737 Starting Script Execution
(load_MANUAL_ipset_iface.sh): 23737 IPSET created: rlist hash:net family inet ha                             shsize 1024 maxelem 65536
(load_MANUAL_ipset_iface.sh): 23737 Selective Routing Rule via VPN Client 2 crea                             ted TAG fwmark 0x2000/0x2000
(load_MANUAL_ipset_iface.sh): 23737 Ending Script Execution

run

Code:

ipset list rlist

to see if it was created. and yes ips are listed with this command.

Code:

Name: rlist
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 7204
References: 1
Number of entries: 131
Members:
...
...
.
.

Checking with

Code:

iptables -nvL PREROUTING -t mangle --line

I got

Code:

Chain PREROUTING (policy ACCEPT 16984 packets, 6855K bytes)
num   pkts bytes target     prot opt in     out     source               destination
1     617K   73M MARK       all  --  *      *       192.168.1.0/24       192.168.1.2          MARK set 0x9
2     617K   73M RETURN     all  --  *      *       192.168.1.0/24       192.168.1.2
3      150 32450 MARK       all  --  br0    *       0.0.0.0/0            0.0.0.0/0            match-set rlist dst MARK or 0x2000

However, I check from browser to one of the listed websites, it doesn't seem to route through VPN.
2nd VPN client is ON and connected with Policy Rules (Strict) and exclusive DNS

PeterV · Oct 16, 2019

Laxarus said:
Okay deleted the x3m and reinstalled. After that only installed op3.

However, I check from browser to one of the listed websites, it doesn't seem to route through VPN.
2nd VPN client is ON and connected with Policy Rules (Strict) and exclusive DNS

Did you create the at least one client record in on vpnclient page ? I.e. dummyvpn ?
Without it the appropriate routing didn't created.

Check by

Code:

 ip route show table ovpncX

where X - your vpnclient number

PeterV · Oct 16, 2019

Xentrk said:
Thanks for reporting back.

Did you test by issuing the command "service restart_firewall".

What I was recommending is to put the contents of /jffs/scripts/x3mRouting/vpnclientX-route-up inside of /jffs/scripts/nat-start. But your solution should work too. Please note that when /jffs/scripts/nat-start is called, it doesn't pass the VPN parameters though. The "$@" parameter won't have any values. You can add the line echo $@ > /jffs/scripts/nat-start-parms to the /jffs/scripts/nat-start script to log the parms to see what if anything is being passed.

Yes, it was checked.
Moreover - it will run all possible vpnclientX-route-up, depending on the presence of appropriate rule in

Code:

ip rule

.
If rule is exists - it has sense to run appropriate route-up. And I can forget about it for a future.
When I will use other ovpn client, then now - it will run appropriate route-up
Moreover - I made a generation all params, which was usually passed to such scripts. Except a true remote MTU.
But, with your idea has a reason too

Laxarus · Oct 16, 2019

PeterV said:
Did you create the at least one client record in on vpnclient page ? I.e. dummyvpn ?
Without it the appropriate routing didn't created.

Check by

Code:

ip route show table ovpncX

where X - your vpnclient number

Yep that was the problem. Now it seemed to be fixed and properly routing. Thanks for the help @PeterV @Xentrk

Kingp1n · Oct 16, 2019

@Xentrk, recently my letgo app (us.letgo.com/en) to sell/buy items online no longer work with my VPN. What wld the easiest way to bypass VPN?

Xentrk · Oct 17, 2019

Laxarus said:
Yep that was the problem. Now it seemed to be fixed and properly routing. Thanks for the help @PeterV @Xentrk

Whoot! Glad you got it working.

Xentrk · Oct 17, 2019

Kingp1n said:
@Xentrk, recently my letgo app (us.letgo.com/en) to sell/buy items online no longer work with my VPN. What wld the easiest way to bypass VPN?

Strange that site is blocking VPN. But some sites do that if someone tried to launch a DoS attach against the site using the VPN server you connect to.

I recommend using the DNSMASQ script to route the domain to the WAN0 interface per the example below:

Code:

sh /jffs/scripts/x3mRouting/load_DNSMASQ 0 LETGO us.letgo.com

Code:

nslookup us.letgo.com
Server:  bcm-adds1.bdms.co.th
Address:  10.154.10.31

Non-authoritative answer:
Name:    e6368.dscj.akamaiedge.net
Addresses:  2001:fb0:1019:1ac::18e0
          2001:fb0:1019:1be::18e0
          23.53.99.203
Aliases:  us.letgo.com
          us.letgo.com-v1.edgekey.net

I also suggest adding an IP address lookup site like whatismyip.com to the list so you can easily confirm if the traffic is routing to the WAN. If you go whatismyip.com, it should report your WAN IP address and not the VPN. Check that the list is populated after doing a lookup or accessing the website:

Code:

ipset -L LETGO

Kingp1n · Oct 17, 2019

Xentrk said:
Strange that site is blocking VPN. But some sites do that if someone tried to launch a DoS attach against the site using the VPN server you connect to.

I recommend using the DNSMASQ script to route the domain to the WAN0 interface per the example below:

Code:

sh /jffs/scripts/x3mRouting/load_DNSMASQ 0 LETGO us.letgo.com

Do I add this to the nat-start file?

Xentrk · Oct 23, 2019

Kingp1n said:
Do I add this to the nat-start file?

Yes.

Exciting · Oct 24, 2019

I am trying to route netflix traffic over vpn1 and have run into a snag with a chromecast. The routing works using the netflix app on my android phone but when I try to cast to the chromecast I get the dreaded proxy error.

I believe the problem lies within the hard coded DNS on the chromecasts, also I have read that the chromecasts now use DNS over TLS.

I am using the shell script method and this is my nat-start file.

Code:

#!/bin/sh

### IPSET Shell Script Method

sh /jffs/scripts/x3mRouting/load_ASN_ipset_iface.sh 1 NETFLIX AS2906
sh /jffs/scripts/x3mRouting/load_DNSMASQ_ipset_iface.sh 1 NETFLIX1 amazonaws.com,netflix.com,nflxext.com,nflximg.net,nflxso.net,nflxvideo.net,nflximg.com,netflix.net,nflxext.com,nflxso.net
iptables -t nat -A PREROUTING -s 192.168.0.0/24 -d 8.8.4.4 -p udp --dport 53 -j DNAT --to 162.168.0.1
iptables -t nat -A PREROUTING -s 192.168.0.0/24 -d 8.8.8.8 -p udp --dport 53 -j DNAT --to 162.168.0.1
iptables -t nat -A PREROUTING -s 192.168.0.0/24 -d 8.8.4.4 -p tcp --dport 53 -j DNAT --to 162.168.0.1
iptables -t nat -A PREROUTING -s 192.168.0.0/24 -d 8.8.8.8 -p tcp --dport 53 -j DNAT --to 162.168.0.1
ip6tables -I FORWARD --destination 2001:4860:4860::8844 -j REJECT
ip6tables -I FORWARD --destination 2001:4860:4860::8888 -j REJECT
iptables -A INPUT -p tcp --destination-port 853 -j DROP
iptables -A OUTPUT -p tcp --destination-port 853 -j DROP

What am I doing something wrong here?
Should I be using something like this instead of the PREROUTING/FORWARD/IN/OUT rules to route requests from the chromecast to port 53 and port 853(DoT) to vpn1?

Code:

iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range <CHROMECAST_IP> -p tcp -m multiport --dport 53,853 -j MARK --set-mark 0x1000/0x1000
iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range <CHROMECAST_IP> -p udp -m multiport --dport 53,853 -j MARK --set-mark 0x1000/0x1000

Also, thanks for the excellent work on this project Xentrk.

Chrisgtl · Oct 25, 2019

Does option 2 only work with final firmwares? ie doesn't work with Alpha/Beta?

Thread starter	Title	Forum	Replies	Date
C	How do I get x3mrouting working with AdGuard Home ?	Asuswrt-Merlin AddOns	6	Sep 11, 2024
A	x3mRouting x3mRouting vs Domain based VPN routing	Asuswrt-Merlin AddOns	29	Apr 29, 2024
K	DomainVPNRouting Domain VPN Routing help	Asuswrt-Merlin AddOns	4	Sep 8, 2024
A	DomainVPNRouting Domain VPN Routing Question	Asuswrt-Merlin AddOns	24	Apr 21, 2024
	DomainVPNRouting Domain-based VPN routing script	Asuswrt-Merlin AddOns	2	Feb 11, 2024
R	DomainVPNRouting Domain VPN Routing	Asuswrt-Merlin AddOns	91	Jan 22, 2024

x3mRouting x3mRouting ~ Selective Routing for Asuswrt-Merlin Firmware

Senior Member

Part of the Furniture

Part of the Furniture

Part of the Furniture

Regular Contributor

Part of the Furniture

Regular Contributor

Part of the Furniture

Part of the Furniture

Regular Contributor

Regular Contributor

Regular Contributor

Regular Contributor

Very Senior Member

Part of the Furniture

Part of the Furniture

Very Senior Member

Part of the Furniture

New Around Here

Regular Contributor

Similar threads

Similar threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest