net/vpn-policy-routing/files/README.md

   1 # VPN Policy-Based Routing
   2
   3 ## Description
   4
   5 This service allows you to define rules (policies) for routing traffic via WAN or your L2TP, Openconnect, OpenVPN, PPTP or Wireguard tunnels. Policies can be set based on any combination of local/remote ports, local/remote IPv4 or IPv6 addresses/subnets or domains. This service supersedes the ```VPN Bypass``` available on [GitHub](https://github.com/openwrt/packages/blob/master/net/vpnbypass/files/README.md)/[jsDelivr](https://cdn.jsdelivr.net/gh/openwrt/packages@master/net/vpnbypass/files/README.md) service, by supporting IPv6 and by allowing you to set explicit rules not just for WAN interface (bypassing OpenVPN tunnel), but for L2TP, Openconnect, OpenVPN, PPTP and Wireguard tunnels as well.
   6
   7 ## Features
   8
   9 ### Gateways/Tunnels
  10
  11 - Any policy can target either WAN or a VPN tunnel interface.
  12 - L2TP tunnels supported (with protocol names l2tp\*).
  13 - Openconnect tunnels supported (with protocol names openconnect\*).
  14 - OpenVPN tunnels supported (with device names tun\* or tap\*).<sup>[1](#footnote1)</sup> <sup>[2](#footnote2)</sup>
  15 - PPTP tunnels supported (with protocol names pptp\*).
  16 - Wireguard tunnels supported (with protocol names wireguard\*).
  17
  18 ### IPv4/IPv6/Port-Based Policies
  19
  20 - Policies based on local names, IPs or subnets. You can specify a single IP (as in ```192.168.1.70```) or a local subnet (as in ```192.168.1.81/29```) or a local device name (as in ```nexusplayer```). IPv6 addresses are also supported.
  21 - Policies based on local ports numbers. Can be set as an individual port number (```32400```), a range (```5060-5061```), a space-separated list (```80 8080```) or a combination of the above (```80 8080 5060-5061```). Limited to 15 space-separated entries per policy.
  22 - Policies based on remote IPs/subnets or domain names. Same format/syntax as local IPs/subnets.
  23 - Policies based on remote ports numbers. Same format/syntax and restrictions as local ports.
  24 - You can mix the IP addresses/subnets and device (or domain) names in one field separating them by space (like this: ```66.220.2.74 he.net tunnelbroker.net```).
  25 - See [Policy Options](#policy-options) section for more information.
  26
  27 ### DSCP Tag-Based Policies
  28
  29 You can also set policies for traffic with specific DSCP tag. On Windows 10, for example, you can mark traffic from specific apps with DSCP tags (instructions for tagging specific app traffic in Windows 10 can be found [here](http://serverfault.com/questions/769843/cannot-set-dscp-on-windows-10-pro-via-group-policy)).
  30
  31 ### Custom User Files
  32
  33 If the custom user file includes are set, the service will load and execute them after setting up ip tables and ipsets and processing policies. This allows, for example, to add large numbers of domains/IP addresses to ipsets without manually adding all of them to the config file.
  34
  35 Two example custom user-files are provided: ```/etc/vpn-policy-routing.aws.user``` and ```/etc/vpn-policy-routing.netflix.user```. They are provided to pull the AWS and Netflix IP addresses into the ```wan``` ipset respectively.
  36
  37 ### Strict Enforcement
  38
  39 - Supports strict policy enforcement, even if the policy interface is down -- resulting in network being unreachable for specific policy (enabled by default).
  40
  41 ### Use DNSMASQ ipset
  42
  43 - Service can be set to utilize ```dnsmasq```'s ```ipset``` support, which requires the ```dnsmasq-full``` package to be installed (see [How to install dnsmasq-full](#how-to-install-dnsmasq-full)). This significantly improves the start up time because ```dnsmasq``` resolves the domain names and adds them to appropriate ```ipset``` in background. Another benefit of using ```dnsmasq```'s ```ipset``` is that it also automatically adds third-level domains to the ```ipset```: if ```domain.com``` is added to the policy, this policy will affect all ```*.domain.com``` subdomains. This also works for top-level domains as well, a policy targeting the ```at``` for example, will affect all the ```*.at``` domains.
  44 - Please review the [Footnotes/Known Issues](#footnotesknown-issues) section, specifically [<sup>#5</sup>](#footnote5) and any other information in that section relevant to domain-based routing/DNS.
  45
  46 ### Customization
  47
  48 - Can be fully configured with ```uci``` commands or by editing ```/etc/config/vpn-policy-routing``` file.
  49 - Has a companion package (```luci-app-vpn-policy-routing```) so policies can be configured with Web UI.
  50
  51 ### Other Features
  52
  53 - Doesn't stay in memory, creates the routing tables and ```iptables``` rules/```ipset``` entries which are automatically updated when supported/monitored interface changes.
  54 - Proudly made in :maple_leaf: Canada :maple_leaf: , using locally-sourced electrons.
  55
  56 ## Screenshots (luci-app-vpn-policy-routing)
  57
  58 Service Status
  59 ![screenshot](https://cdn.jsdelivr.net/gh/stangri/openwrt_packages@master/screenshots/vpn-policy-routing/screenshot04-status.png "Service Status")
  60
  61 Configuration - Basic Configuration
  62 ![screenshot](https://cdn.jsdelivr.net/gh/stangri/openwrt_packages@master/screenshots/vpn-policy-routing/screenshot04-config-basic.png "Basic Configuration")
  63
  64 Configuration - Advanced Configuration
  65 ![screenshot](https://cdn.jsdelivr.net/gh/stangri/openwrt_packages@master/screenshots/vpn-policy-routing/screenshot04-config-advanced.png "Advanced Configuration")
  66
  67 Configuration - WebUI Configuration
  68 ![screenshot](https://cdn.jsdelivr.net/gh/stangri/openwrt_packages@master/screenshots/vpn-policy-routing/screenshot04-config-webui.png "WebUI Configuration")
  69
  70 Policies
  71 ![screenshot](https://cdn.jsdelivr.net/gh/stangri/openwrt_packages@master/screenshots/vpn-policy-routing/screenshot04-policies.png "Policies")
  72
  73 DSCP Tagging
  74 ![screenshot](https://cdn.jsdelivr.net/gh/stangri/openwrt_packages@master/screenshots/vpn-policy-routing/screenshot04-dscp.png "DSCP Tagging")
  75
  76 Custom User File Includes
  77 ![screenshot](https://cdn.jsdelivr.net/gh/stangri/openwrt_packages@master/screenshots/vpn-policy-routing/screenshot04-userfiles.png "Custom User File Includes")
  78
  79 ## How It Works
  80
  81 On start, this service creates routing tables for each supported interface (WAN/WAN6 and VPN tunnels) which are used to route specially marked packets. For the ```mangle``` table's ```PREROUTING```, ```FORWARD```, ```INPUT``` and ```OUTPUT``` chains, the service creates corresponding ```VPR_*``` chains to which policies are assigned. Evaluation and marking of packets happen in these ```VPR_*``` chains. If enabled, the service also creates the remote/local ipsets per each supported interface and the corresponding ```iptables``` rule for marking packets matching the ```ipset```. The service then processes the user-created policies.
  82
  83 ### Processing Policies
  84
  85 Each policy can result in either a new ```iptables``` rule or, if ```src_ipset``` or ```dest_ipset``` are enabled, an ```ipset``` or a ```dnsmasq```'s ```ipset``` entry.
  86
  87 - Policies with local MAC-addresses, IP addresses or local device names can be created as ```iptables``` rules or ```ipset``` entries.
  88 - Policies with local or remote ports are always created as ```iptables``` rules.
  89 - Policies with local or remote netmasks can be created as ```iptables``` rules or ```ipset``` entries.
  90 - Policies with **only** remote IP address or a domain name can be created as ```iptables``` rules or ```dnsmasq```'s ```ipset``` or an ```ipset``` (if enabled).
  91
  92 ### Policies Priorities
  93
  94 - If support for ```src_ipset``` and ```dest_ipset``` is disabled, then only ```iptables``` rules are created. The policy priority is the same as its order as listed in Web UI and ```/etc/config/vpn-policy-routing```. The higher the policy is in the Web UI and configuration file, the higher its priority is.
  95 - If support for ```src_ipset``` and ```dest_ipset``` is enabled, then the ```ipset``` entries have the highest priority (irrelevant of their position in the policies list) and the other policies are processed in the same order as they are listed in Web UI and ```/etc/config/vpn-policy-routing```.
  96 - If there are conflicting ```ipset``` entries for different interfaces, the priority is given to the interface which is listed first in the ```/etc/config/network``` file.
  97 - If set, the ```DSCP``` policies trump all other policies, including the ```ipset``` ones.
  98
  99 ## How To Install
 100
 101 Please make sure that the [requirements](#requirements) are satisfied and install ```vpn-policy-routing``` and ```luci-app-vpn-policy-routing``` from Web UI or connect to your router via ssh and run the following commands:
 102
 103 ```sh
 104 opkg update
 105 opkg install vpn-policy-routing luci-app-vpn-policy-routing
 106 ```
 107
 108 If these packages are not found in the official feed/repo for your version of OpenWrt/LEDE Project, you will need to add a custom repo to your router following instructions on [GitHub](https://github.com/stangri/openwrt_packages/blob/master/README.md#on-your-router)/[jsDelivr](https://cdn.jsdelivr.net/gh/stangri/openwrt_packages@master/README.md#on-your-router) first.
 109
 110 ### Requirements
 111
 112 This service requires the following packages to be installed on your router: ```ipset```, ```resolveip```, ```ip-full``` (or a ```busybox``` built with ```ip``` support), ```kmod-ipt-ipset``` and ```iptables```.
 113
 114 To satisfy the requirements, connect to your router via ssh and run the following commands:
 115
 116 ```sh
 117 opkg update; opkg install ipset resolveip ip-full kmod-ipt-ipset iptables
 118 ```
 119
 120 ### How to install dnsmasq-full
 121
 122 If you want to use ```dnsmasq```'s ```ipset``` support, you will need to install ```dnsmasq-full``` instead of the ```dnsmasq```. To do that, connect to your router via ssh and run the following command:
 123
 124 ```sh
 125 opkg update; opkg remove dnsmasq; opkg install dnsmasq-full;
 126 ```
 127
 128 ### Unmet dependencies
 129
 130 If you are running a development (trunk/snapshot) build of OpenWrt on your router and your build is outdated (meaning that packages of the same revision/commit hash are no longer available and when you try to satisfy the [requirements](#requirements) you get errors), please flash either current OpenWrt release image or current development/snapshot image.
 131
 132 ## Service Configuration Settings
 133
 134 As per screenshots above, in the Web UI the ```vpn-policy-routing``` configuration is split into ```Basic```, ```Advanced``` and ```WebUI``` settings. The full list of configuration parameters of ```vpn-policy-routing.config``` section is:
 135
 136 |Web UI Section|Parameter|Type|Default|Description|
 137 | --- | --- | --- | --- | --- |
 138 |Basic|enabled|boolean|0|Enable/disable the ```vpn-policy-routing``` service.|
 139 |Basic|verbosity|integer|2|Can be set to 0, 1 or 2 to control the console and system log output verbosity of the ```vpn-policy-routing``` service.|
 140 |Basic|strict_enforcement|boolean|1|Enforce policies when their interface is down. See [Strict enforcement](#strict-enforcement) for more details.|
 141 |Basic|dest_ipset|string|none|Enable/disable use of one of the ipset options for compatible remote policies (policies with only a remote hostname and no other fields set). This speeds up service start-up and operation. Currently supported options are ```none```,  ```ipset``` and ```dnsmasq.ipset``` (see [Use DNSMASQ ipset](#use-dnsmasq-ipset) for more details). Make sure the [requirements](#requirements) are met.|
 142 |Basic|src_ipset|boolean|0|Enable/disable use of ```ipset``` entries for compatible local policies (policies with only a local IP address or MAC address and no other fields set). Using ```ipset``` for local IPs/MACs is faster than using ```iptables``` rules, however it makes it impossible to enforce policies priority/order. Make sure the [requirements](#requirements) are met.|
 143 |Basic|ipv6_enabled|boolean|0|Enable/disable IPv6 support.|
 144 |Advanced|supported_interface|list/string||Allows to specify the space-separated list of interface names (in lower case) to be explicitly supported by the ```vpn-policy-routing``` service. Can be useful if your OpenVPN tunnels have dev option other than tun\* or tap\*.|
 145 |Advanced|ignored_interface|list/string||Allows to specify the space-separated list of interface names (in lower case) to be ignored by the ```vpn-policy-routing``` service. Can be useful if running both VPN server and VPN client on the router.|
 146 |Advanced|boot_timeout|number|30|Allows to specify the time (in seconds) for ```vpn-policy-routing``` service to wait for WAN gateway discovery on boot. Can be useful on devices with ADSL modem built in.|
 147 |Advanced|iptables_rule_option|append/insert|append|Allows to specify the iptables parameter for rules: ```-A``` for ```append``` and ```-I``` for ```insert```. Append is generally speaking more compatible with other packages/firewall rules. Recommended to change to ```insert``` only to enable compatibility with the ```mwan3``` package.|
 148 |Advanced|iprule_enabled|boolean|0|Add an ```ip rule```, not an ```iptables``` entry for policies with just the local address. Use with caution to manipulate policies priorities.|
 149 |Advanced|icmp_interface|string||Set the default ICMP protocol interface (interface name in lower case). Use with caution.|
 150 |Advanced|append_src_rules|string||Append local IP Tables rules. Can be used to exclude local IP addresses from destinations for policies with local address set.|
 151 |Advanced|append_dest_rules|string||Append local IP Tables rules. Can be used to exclude remote IP addresses from sources for policies with remote address set.|
 152 |Advanced|wan_tid|integer|201|Starting (WAN) Table ID number for tables created by the ```vpn-policy-routing``` service.|
 153 |Advanced|wan_mark|hexadecimal|0x010000|Starting (WAN) fw mark for marks used by the ```vpn-policy-routing``` service. High starting mark is used to avoid conflict with SQM/QoS, this can be changed by user. Change with caution together with ```fw_mask```.|
 154 |Advanced|fw_mask|hexadecimal|0xff0000|FW Mask used by the ```vpn-policy-routing``` service. High mask is used to avoid conflict with SQM/QoS, this can be changed by user. Change with caution together with ```wan_mark```.|
 155 |Web UI|webui_enable_column|boolean|0|Shows ```Enable``` checkbox column for policies, allowing to quickly enable/disable specific policy without deleting it.|
 156 |Web UI|webui_protocol_column|boolean|0|Shows ```Protocol``` column for policies, allowing to specify the protocol for ```iptables``` rules for policies.|
 157 |Web UI|webui_supported_protocol|list|0|List of protocols to display in the ```Protocol``` column for policies.|
 158 |Web UI|webui_chain_column|boolean|0|Shows ```Chain``` column for policies, allowing to specify ```PREROUTING``` (default), ```FORWARD```, ```INPUT```, or ```OUTPUT``` chain for ```iptables``` rules for policies.|
 159 |Web UI|webui_sorting|boolean|1|Shows the Up/Down buttons for policies, allowing you to move a policy up or down in the list/priority.|
 160 ||wan_dscp|integer||Allows use of [DSCP-tag based policies](#dscp-tag-based-policies) for WAN interface.|
 161 ||{interface_name}_dscp|integer||Allows use of [DSCP-tag based policies](#dscp-tag-based-policies) for a VPN interface.|
 162
 163 ### Default Settings
 164
 165 Default configuration has service disabled (use Web UI to enable/start service or run ```uci set vpn-policy-routing.config.enabled=1; uci commit vpn-policy-routing;```).
 166
 167 ### Policy Options
 168
 169 Each policy may have a combination of the options below, the ```name``` and ```interface```  options are required.
 170
 171 The ```src_addr```, ```src_port```, ```dest_addr``` and ```dest_port``` options supports parameter negation, for example if you want to **exclude** remote port 80 from the policy, set ```dest_port="!80"``` (notice lack of space between ```!``` and parameter).
 172
 173 |Option|Default|Description|
 174 | --- | --- | --- |
 175 |**name**||Policy name, it **must** be set.|
 176 |enabled|1|Enable/disable policy. To display the ```Enable``` checkbox column for policies in the WebUI, make sure to select ```Enabled``` for ```Show Enable Column``` in the ```Web UI``` tab.|
 177 |**interface**||Policy interface, it **must** be set.|
 178 |src_addr||List of space-separated local/source IP addresses, CIDRs, hostnames or mac addresses (colon-separated). You can also specify a local interface (like a specially created wlan) prepended by an ```@``` symbol.|
 179 |src_port||List of space-separated local/source ports or port-ranges.|
 180 |dest_addr||List of space-separated remote/target IP addresses, CIDRs or hostnames/domain names.|
 181 |dest_port||List of space-separated remote/target ports or port-ranges.|
 182 |proto|auto|Policy protocol, can be any valid protocol from ```/etc/protocols``` for CLI/uci or can be selected from the values set in ```webui_supported_protocol```. To display the ```Protocol``` column for policies in the WebUI, make sure to select ```Enabled``` for ```Show Protocol Column``` in the ```Web UI``` tab.<br/>Special cases: ```auto``` will try to intelligently insert protocol-agnostic policy and fall back to TCP/UDP if the protocol must be selected for specific policy; ```all``` will always insert a protocol-agnostic policy (which may fail depending on the policy).|
 183 |chain|PREROUTING|Policy chain, can be either ```PREROUTING```, ```FORWARDING```, ```INPUT``` or ```OUTPUT```. This setting is case-sensitive. To display the ```Chain``` column for policies in the WebUI, make sure to select ```Enabled``` for ```Show Chain Column``` in the ```Web UI``` tab.|
 184
 185 ### Custom User Files Include Options
 186
 187 |Option|Default|Description|
 188 | --- | --- | --- |
 189 |**path**||Path to a custom user file (in a form of shell script), it **must** be set.|
 190 |enabled|1|Enable/disable setting.|
 191
 192 ### Example Policies
 193
 194 #### Single IP, IP Range, Local Machine, Local MAC Address
 195
 196 The following policies route traffic from a single IP address, a range of IP addresses, a local machine (requires definition as DHCP host record in DHCP config), a MAC-address of a local device and finally all of the above via WAN.
 197
 198 ```text
 199 config policy
 200   option name 'Local IP'
 201   option interface 'wan'
 202   option src_addr '192.168.1.70'
 203
 204 config policy
 205   option name 'Local Subnet'
 206   option interface 'wan'
 207   option src_addr '192.168.1.81/29'
 208
 209 config policy
 210   option name 'Local Machine'
 211   option interface 'wan'
 212   option src_addr 'dell-ubuntu'
 213
 214 config policy
 215   option name 'Local MAC Address'
 216   option interface 'wan'
 217   option src_addr '00:0F:EA:91:04:08'
 218
 219 config policy
 220   option name 'Local Devices'
 221   option interface 'wan'
 222   option src_addr '192.168.1.70 192.168.1.81/29 dell-ubuntu 00:0F:EA:91:04:08'
 223
 224 ```
 225
 226 #### Logmein Hamachi
 227
 228 The following policy routes LogMeIn Hamachi zero-setup VPN traffic via WAN.
 229
 230 ```text
 231 config policy
 232   option name 'LogmeIn Hamachi'
 233   option interface 'wan'
 234   option dest_addr '25.0.0.0/8 hamachi.cc hamachi.com logmein.com'
 235 ```
 236
 237 #### SIP Port
 238
 239 The following policy routes standard SIP port traffic via WAN for both TCP and UDP protocols.
 240
 241 ```text
 242 config policy
 243   option name 'SIP Ports'
 244   option interface 'wan'
 245   option dest_port '5060'
 246   option proto 'tcp udp'
 247 ```
 248
 249 #### Plex Media Server
 250
 251 The following policies route Plex Media Server traffic via WAN. Please note, you'd still need to open the port in the firewall either manually or with the UPnP.
 252
 253 ```text
 254 config policy
 255   option name 'Plex Local Server'
 256   option interface 'wan'
 257   option src_port '32400'
 258
 259 config policy
 260   option name 'Plex Remote Servers'
 261   option interface 'wan'
 262   option dest_addr 'plex.tv my.plexapp.com'
 263 ```
 264
 265 #### Emby Media Server
 266
 267 The following policy route Emby traffic via WAN. Please note, you'd still need to open the port in the firewall either manually or with the UPnP.
 268
 269 ```text
 270 config policy
 271   option name 'Emby Local Server'
 272   option interface 'wan'
 273   option src_port '8096 8920'
 274
 275 config policy
 276   option name 'Emby Remote Servers'
 277   option interface 'wan'
 278   option dest_addr 'emby.media app.emby.media tv.emby.media'
 279 ```
 280
 281 #### Local OpenVPN Server + OpenVPN Client (Scenario 1)
 282
 283 If the OpenVPN client on your router is used as default routing (for the whole internet), make sure your settings are as following (three dots on the line imply other options can be listed in the section as well).
 284
 285 Relevant part of ```/etc/config/vpn-policy-routing```:
 286
 287 ```text
 288 config vpn-policy-routing 'config'
 289   list ignored_interface 'vpnserver'
 290   ...
 291
 292 config policy
 293   option name 'OpenVPN Server'
 294   option interface 'wan'
 295   option proto 'tcp'
 296   option src_port '1194'
 297   option chain 'OUTPUT'
 298 ```
 299
 300 The network/firewall/openvpn settings are below.
 301
 302 Relevant part of ```/etc/config/network``` (**DO NOT** modify default OpenWrt network settings for neither ```wan``` nor ```lan```):
 303
 304 ```text
 305 config interface 'vpnclient'
 306   option proto 'none'
 307   option ifname 'ovpnc0'
 308
 309 config interface 'vpnserver'
 310   option proto 'none'
 311   option ifname 'ovpns0'
 312   option auto '1'
 313 ```
 314
 315 Relevant part of ```/etc/config/firewall``` (**DO NOT** modify default OpenWrt firewall settings for neither ```wan``` nor ```lan```):
 316
 317 ```text
 318 config zone
 319   option name 'vpnclient'
 320   option network 'vpnclient'
 321   option input 'REJECT'
 322   option forward 'ACCEPT'
 323   option output 'REJECT'
 324   option masq '1'
 325   option mtu_fix '1'
 326
 327 config forwarding
 328   option src 'lan'
 329   option dest 'vpnclient'
 330
 331 config zone
 332   option name 'vpnserver'
 333   option network 'vpnserver'
 334   option input 'ACCEPT'
 335   option forward 'REJECT'
 336   option output 'ACCEPT'
 337   option masq '1'
 338
 339 config forwarding
 340   option src 'vpnserver'
 341   option dest 'wan'
 342
 343 config forwarding
 344   option src 'vpnserver'
 345   option dest 'lan'
 346
 347 config forwarding
 348   option src 'vpnserver'
 349   option dest 'vpnclient'
 350
 351 config rule
 352   option name 'Allow-OpenVPN-Inbound'
 353   option target 'ACCEPT'
 354   option src '*'
 355   option proto 'tcp'
 356   option dest_port '1194'
 357 ```
 358
 359 Relevant part of ```/etc/config/openvpn```:
 360
 361 ```text
 362 config openvpn 'vpnclient'
 363   option client '1'
 364   option dev_type 'tun'
 365   option dev 'ovpnc0'
 366   option proto 'udp'
 367   option remote 'some.domain.com 1197' # DO NOT USE PORT 1194 for VPN Client
 368   ...
 369
 370 config openvpn 'vpnserver'
 371   option port '1194'
 372   option proto 'tcp'
 373   option server '192.168.200.0 255.255.255.0'
 374   ...
 375 ```
 376
 377 #### Local OpenVPN Server + OpenVPN Client (Scenario 2)
 378
 379 If the OpenVPN client is **not** used as default routing and you create policies to selectively use the OpenVPN client, make sure your settings are as following (three dots on the line imply other options can be listed in the section as well).
 380
 381 Relevant part of ```/etc/config/vpn-policy-routing```:
 382
 383 ```text
 384 config vpn-policy-routing 'config'
 385   list ignored_interface 'vpnserver'
 386   option append_src_rules '! -d 192.168.200.0/24'
 387   ...
 388 ```
 389
 390 The network/firewall/openvpn settings are below.
 391
 392 Relevant part of ```/etc/config/network``` (**DO NOT** modify default OpenWrt network settings for neither ```wan``` nor ```lan```):
 393
 394 ```text
 395 config interface 'vpnclient'
 396   option proto 'none'
 397   option ifname 'ovpnc0'
 398
 399 config interface 'vpnserver'
 400   option proto 'none'
 401   option ifname 'ovpns0'
 402   option auto '1'
 403 ```
 404
 405 Relevant part of ```/etc/config/firewall``` (**DO NOT** modify default OpenWrt firewall settings for neither ```wan``` nor ```lan```):
 406
 407 ```text
 408 config zone
 409   option name 'vpnclient'
 410   option network 'vpnclient'
 411   option input 'REJECT'
 412   option forward 'ACCEPT'
 413   option output 'REJECT'
 414   option masq '1'
 415   option mtu_fix '1'
 416
 417 config forwarding
 418   option src 'lan'
 419   option dest 'vpnclient'
 420
 421 config zone
 422   option name 'vpnserver'
 423   option network 'vpnserver'
 424   option input 'ACCEPT'
 425   option forward 'REJECT'
 426   option output 'ACCEPT'
 427   option masq '1'
 428
 429 config forwarding
 430   option src 'vpnserver'
 431   option dest 'wan'
 432
 433 config forwarding
 434   option src 'vpnserver'
 435   option dest 'lan'
 436
 437 config forwarding
 438   option src 'vpnserver'
 439   option dest 'vpnclient'
 440
 441 config rule
 442   option name 'Allow-OpenVPN-Inbound'
 443   option target 'ACCEPT'
 444   option src '*'
 445   option proto 'tcp'
 446   option dest_port '1194'
 447 ```
 448
 449 Relevant part of ```/etc/config/openvpn```:
 450
 451 ```text
 452 config openvpn 'vpnclient'
 453   option client '1'
 454   option dev_type 'tun'
 455   option dev 'ovpnc0'
 456   option proto 'udp'
 457   option remote 'some.domain.com 1197' # DO NOT USE PORT 1194 for VPN Client
 458   list pull_filter 'ignore "redirect-gateway"' # for OpenVPN 2.4 and later
 459   option route_nopull '1' # for OpenVPN earlier than 2.4
 460   ...
 461
 462 config openvpn 'vpnserver'
 463   option port '1194'
 464   option proto 'tcp'
 465   option server '192.168.200.0 255.255.255.0'
 466   ...
 467 ```
 468
 469 #### Local Wireguard Server + Wireguard Client (Scenario 1)
 470
 471 Yes, I'm aware that technically there are no clients nor servers in Wireguard, it's all peers, but for the sake of README readability I will use the terminology similar to the OpenVPN Server + Client setups.
 472
 473 If the Wireguard tunnel on your router is used as default routing (for the whole internet), make sure your settings are as following (three dots on the line imply other options can be listed in the section as well).
 474
 475 Relevant part of ```/etc/config/vpn-policy-routing```:
 476
 477 ```text
 478 config vpn-policy-routing 'config'
 479   list ignored_interface 'wgserver'
 480   ...
 481
 482 config policy
 483   option name 'Wireguard Server'
 484   option interface 'wan'
 485   option proto 'udp'
 486   option src_port '61820'
 487   option chain 'OUTPUT'
 488 ```
 489
 490 The recommended network/firewall settings are below.
 491
 492 Relevant part of ```/etc/config/network``` (**DO NOT** modify default OpenWrt network settings for neither ```wan``` nor ```lan```):
 493
 494 ```text
 495 config interface 'wgclient'
 496   option proto 'wireguard'
 497   ...
 498
 499 config wireguard_wgclient
 500   list allowed_ips '0.0.0.0/0'
 501   list allowed_ips '::0/0'
 502   option endpoint_port '51820'
 503   option route_allowed_ips '1'
 504   ...
 505
 506 config interface 'wgserver'
 507   option proto 'wireguard'
 508   option listen_port '61820'
 509   list addresses '192.168.200.1'
 510   ...
 511
 512 config wireguard_wgserver
 513   list allowed_ips '192.168.200.2/32'
 514   option route_allowed_ips '1'
 515   ...
 516 ```
 517
 518 Relevant part of ```/etc/config/firewall``` (**DO NOT** modify default OpenWrt firewall settings for neither ```wan``` nor ```lan```):
 519
 520 ```text
 521 config zone
 522   option name 'wgclient'
 523   option network 'wgclient'
 524   option input 'REJECT'
 525   option forward 'ACCEPT'
 526   option output 'REJECT'
 527   option masq '1'
 528   option mtu_fix '1'
 529
 530 config forwarding
 531   option src 'lan'
 532   option dest 'wgclient'
 533
 534 config zone
 535   option name 'wgserver'
 536   option network 'wgserver'
 537   option input 'ACCEPT'
 538   option forward 'REJECT'
 539   option output 'ACCEPT'
 540   option masq '1'
 541
 542 config forwarding
 543   option src 'wgserver'
 544   option dest 'wan'
 545
 546 config forwarding
 547   option src 'wgserver'
 548   option dest 'lan'
 549
 550 config forwarding
 551   option src 'wgserver'
 552   option dest 'wgclient'
 553
 554 config rule
 555   option name 'Allow-WG-Inbound'
 556   option target 'ACCEPT'
 557   option src '*'
 558   option proto 'udp'
 559   option dest_port '61820'
 560 ```
 561
 562 #### Local Wireguard Server + Wireguard Client (Scenario 2)
 563
 564 Yes, I'm aware that technically there are no clients nor servers in Wireguard, it's all peers, but for the sake of README readability I will use the terminology similar to the OpenVPN Server + Client setups.
 565
 566 If the Wireguard client is **not** used as default routing and you create policies to selectively use the Wireguard client, make sure your settings are as following (three dots on the line imply other options can be listed in the section as well).
 567
 568 Relevant part of ```/etc/config/vpn-policy-routing```:
 569
 570 ```text
 571 config vpn-policy-routing 'config'
 572   list ignored_interface 'wgserver'
 573   option append_src_rules '! -d 192.168.200.0/24'
 574   ...
 575 ```
 576
 577 The recommended network/firewall settings are below.
 578
 579 Relevant part of ```/etc/config/network``` (**DO NOT** modify default OpenWrt network settings for neither ```wan``` nor ```lan```):
 580
 581 ```text
 582 config interface 'wgclient'
 583   option proto 'wireguard'
 584   ...
 585
 586 config wireguard_wgclient
 587   list allowed_ips '0.0.0.0/0'
 588   list allowed_ips '::0/0'
 589   option endpoint_port '51820'
 590   ...
 591
 592 config interface 'wgserver'
 593   option proto 'wireguard'
 594   option listen_port '61820'
 595   list addresses '192.168.200.1/24'
 596   ...
 597
 598 config wireguard_wgserver
 599   list allowed_ips '192.168.200.2/32'
 600   option route_allowed_ips '1'
 601   ...
 602 ```
 603
 604 Relevant part of ```/etc/config/firewall``` (**DO NOT** modify default OpenWrt firewall settings for neither ```wan``` nor ```lan```):
 605
 606 ```text
 607 config zone
 608   option name 'wgclient'
 609   option network 'wgclient'
 610   option input 'REJECT'
 611   option forward 'ACCEPT'
 612   option output 'REJECT'
 613   option masq '1'
 614   option mtu_fix '1'
 615
 616 config forwarding
 617   option src 'lan'
 618   option dest 'wgclient'
 619
 620 config zone
 621   option name 'wgserver'
 622   option network 'wgserver'
 623   option input 'ACCEPT'
 624   option forward 'REJECT'
 625   option output 'ACCEPT'
 626   option masq '1'
 627
 628 config forwarding
 629   option src 'wgserver'
 630   option dest 'wan'
 631
 632 config forwarding
 633   option src 'wgserver'
 634   option dest 'lan'
 635
 636 config forwarding
 637   option src 'wgserver'
 638   option dest 'wgclient'
 639
 640 config rule
 641   option name 'Allow-WG-Inbound'
 642   option target 'ACCEPT'
 643   option src '*'
 644   option proto 'udp'
 645   option dest_port '61820'
 646 ```
 647
 648 #### Netflix Domains
 649
 650 The following policy should route US Netflix traffic via WAN. For capturing international Netflix domain names, you can refer to the getdomainnames.sh-specific instructions on [GitHub](https://github.com/Xentrk/netflix-vpn-bypass/blob/master/README.md#ipset_netflix_domainssh)/[jsDelivr](https://cdn.jsdelivr.net/gh/Xentrk/openwrt_packages@master/netflix-vpn-bypass/README.md#ipset_netflix_domainssh) and don't forget to adjust them for OpenWrt. This may not work if Netflix changes things. For more reliable US Netflix routing you may want to consider using [custom user files](#custom-user-files).
 651
 652 ```text
 653 config policy
 654   option name 'Netflix Domains'
 655   option interface 'wan'
 656   option dest_addr 'amazonaws.com netflix.com nflxext.com nflximg.net nflxso.net nflxvideo.net dvd.netflix.com'
 657 ```
 658
 659 #### Example Custom User Files Includes
 660
 661 ```text
 662 config include
 663   option path '/etc/vpn-policy-routing.netflix.user'
 664
 665 config include
 666   option path '/etc/vpn-policy-routing.aws.user'
 667 ```
 668
 669 #### Basic OpenVPN Client Config
 670
 671 There are multiple guides online on how to configure the OpenVPN client on OpenWrt "the easy way", and they usually result either in a kill-switch configuration or configuration where the OpenVPN tunnel  cannot be properly (and separately from WAN) routed, either way, incompatible with the VPN Policy-Based Routing.
 672
 673 Below is the sample OpenVPN client configuration for OpenWrt which is guaranteed to work. If you have already deviated from the instructions below (ie: made any changes to any of the ```wan``` or ```lan``` configurations in either ```/etc/config/network``` or ```/etc/config/firewall```), you will need to start from scratch with a fresh OpenWrt install.
 674
 675 Relevant part of ```/etc/config/vpn-policy-routing```:
 676
 677 ```text
 678 config vpn-policy-routing 'config'
 679   list supported_interface 'vpnc'
 680   ...
 681 ```
 682
 683 The recommended network/firewall settings are below.
 684
 685 Relevant part of ```/etc/config/network``` (**DO NOT** modify default OpenWrt network settings for neither ```wan``` nor ```lan```):
 686
 687 ```text
 688 config interface 'vpnc'
 689   option proto 'none'
 690   option ifname 'ovpnc0'
 691 ```
 692
 693 Relevant part of ```/etc/config/firewall``` (**DO NOT** modify default OpenWrt firewall settings for neither ```wan``` nor ```lan```):
 694
 695 ```text
 696 config zone
 697   option name 'vpnc'
 698   option network 'vpnc'
 699   option input 'REJECT'
 700   option forward 'REJECT'
 701   option output 'ACCEPT'
 702   option masq '1'
 703   option mtu_fix '1'
 704
 705 config forwarding
 706   option src 'lan'
 707   option dest 'vpnc'
 708 ```
 709
 710 If you have a Guest Network, add the following to the ```/etc/config/firewall```:
 711
 712 ```text
 713 config forwarding
 714   option src 'guest'
 715   option dest 'vpnc'
 716 ```
 717
 718 Relevant part of ```/etc/config/openvpn``` (configure the rest of the client connection for your specifics by either referring to an existing ```.ovpn``` file or thru the OpenWrt uci settings):
 719
 720 ```text
 721 config openvpn 'vpnc'
 722   option enabled '1'
 723   option client '1'
 724   option dev_type 'tun'
 725   option dev 'ovpnc0'
 726   ...
 727 ```
 728
 729 ## Footnotes/Known Issues
 730
 731 1. <a name="footnote1"> </a> See [note about multiple OpenVPN clients](#multiple-openvpn-clients).
 732
 733 2. <a name="footnote2"> </a> If your ```OpenVPN``` interface has the device name different from tun\* or tap\*, is not up and is not explicitly listed in ```supported_interface``` option, it may not be available in the policies ```Interface``` drop-down within WebUI.
 734
 735 3. <a name="footnote3"> </a> If your default routing is set to the VPN tunnel, then the true WAN interface cannot be discovered using OpenWrt built-in functions, so service will assume your network interface ending with or starting with ```wan``` is the true WAN interface.
 736
 737 4. <a name="footnote4"> </a> The service does **NOT** support the "killswitch" router mode (where if you stop the VPN tunnel, you have no internet connection). For proper operation, leave all the default OpenWrt ```network``` and ```firewall``` settings for ```lan``` and ```wan``` intact.
 738
 739 5. <a name="footnote5"> </a> When using the ```dnsmasq.ipset``` option, please make sure to flush the DNS cache of the local devices, otherwise domain policies may not work until you do. If you're not sure how to flush the DNS cache (or if the device/OS doesn't offer an option to flush its DNS cache), reboot your local devices when starting to use the service and/or when connecting data-capable device to your WiFi.
 740
 741 ### Multiple OpenVPN Clients
 742
 743 If you use multiple OpenVPN clients on your router, the order in which their devices are named (tun0, tun1, etc) is not guaranteed by OpenWrt/LEDE Project. The following settings are recommended in this case.
 744
 745 For ```/etc/config/network```:
 746
 747 ```text
 748 config interface 'vpnclient0'
 749   option proto 'none'
 750   option ifname 'ovpnc0'
 751
 752 config interface 'vpnclient1'
 753   option proto 'none'
 754   option ifname 'ovpnc1'
 755 ```
 756
 757 For ```/etc/config/openvpn```:
 758
 759 ```text
 760 config openvpn 'vpnclient0'
 761   option client '1'
 762   option dev_type 'tun'
 763   option dev 'ovpnc0'
 764   ...
 765
 766 config openvpn 'vpnclient1'
 767   option client '1'
 768   option dev_type 'tun'
 769   option dev 'ovpnc1'
 770   ...
 771 ```
 772
 773 For ```/etc/config/vpn-policy-routing```:
 774
 775 ```text
 776 config vpn-policy-routing 'config'
 777   list supported_interface 'vpnclient0 vpnclient1'
 778   ...
 779 ```
 780
 781 ### A Word About Default Routing
 782
 783 Service does not alter the default routing. Depending on your VPN tunnel settings (and settings of the VPN server you are connecting to), the default routing might be set to go via WAN or via VPN tunnel. This service affects only routing of the traffic matching the policies. If you want to override default routing, follow the instructions below.
 784
 785 #### OpenVPN tunnel configured via uci (/etc/config/openvpn)
 786
 787 Set the following to the appropriate section of your ```/etc/config/openvpn```:
 788
 789 - For OpenVPN 2.4 and newer client config:
 790
 791     ```text
 792     list pull_filter 'ignore "redirect-gateway"'
 793     ```
 794
 795 - For OpenVPN 2.3 and older client config:
 796
 797     ```text
 798     option route_nopull '1'
 799     ```
 800
 801 - For your Wireguard (client) config:
 802
 803     ```text
 804     option route_allowed_ips '0'
 805     ```
 806
 807 #### OpenVPN tunnel configured with .ovpn file
 808
 809 Set the following to the appropriate section of your ```.ovpn``` file:
 810
 811 - For OpenVPN 2.4 and newer client ```.ovpn``` file:
 812
 813     ```text
 814     pull_filter 'ignore "redirect-gateway"'
 815     ```
 816
 817 - For OpenVPN 2.3 and older client ```.ovpn``` file:
 818
 819     ```text
 820     route_nopull '1'
 821     ```
 822
 823 #### Wireguard tunnel
 824
 825 - For your Wireguard (client) config:
 826
 827     ```text
 828     option route_allowed_ips '0'
 829     ```
 830
 831 - Routing Wireguard traffic may require setting `net.ipv4.conf.wg0.rp_filter = 2` in `/etc/sysctl.conf`. Please refer to [issue #41](https://github.com/stangri/openwrt_packages/issues/41) for more details.
 832
 833 ### A Word About HTTP/3 (QUICK)
 834
 835 If you want to target traffic using HTTP/3 protocol, you can use the ```AUTO``` as the protocol (the policy will be either protocol-agnostic or ```TCP/UDP```) or explicitly   use ```UDP``` as a protocol.
 836
 837 ### A Word About DNS-over-HTTPS
 838
 839 Some browsers, like [Mozilla Firefox](https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_about-dns-over-https) or [Google Chrome/Chromium](https://blog.chromium.org/2019/09/experimenting-with-same-provider-dns.html) have [DNS-over-HTTPS proxy](https://en.wikipedia.org/wiki/DNS_over_HTTPS) built-in. Their requests to web-sites cannot be affected if the ```dnsmasq.ipset``` is set for the ```dest_ipset``` option. To fix this, you can try either of the following:
 840
 841   1. Disable the DNS-over-HTTPS support in your browser and use the OpenWrt's ```net/https-dns-proxy``` (README on [GitHub](https://github.com/openwrt/packages/tree/master/net/https-dns-proxy)/[jsDelivr](https://cdn.jsdelivr.net/gh/stangri/openwrt_packages@master/https-dns-proxy/files/README.md)) package with optional ```https-dns-proxy``` WebUI/luci app. You can then continue to use ```dnsmasq.ipset``` setting for the ```dest_ipset``` in VPN Policy Routing.
 842
 843   2. Continue using DNS-over-HTTPS in your browser (which, by the way, also limits your options for router-level AdBlocking as described in ```dnsmasq.ipset``` option description here of ```net/simple-adblock``` README on [GitHub](https://github.com/openwrt/packages/tree/master/net/simple-adblock/files#dns-resolution-option)/[jsDelivr](https://cdn.jsdelivr.net/gh/stangri/openwrt_packages@master/simple-adblock/files/README.md#dns-resolution-option)), you than would either have to disable the  ```dest_ipset``` or switch it to ```ipset```. Please note, you will lose all the benefits of [```dnsmasq.ipset```](#use-dnsmasq-ipset) option.
 844
 845 ### A Word About Cloudflare's 1.1.1.1 App
 846
 847 Cloudflare has released an app for [iOS](https://itunes.apple.com/us/app/1-1-1-1-faster-internet/id1423538627) and [Android](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone), which can also be configured to route traffic thru their own VPN tunnel (WARP+).
 848
 849 If you use Cloudlfare's VPN tunnel (WARP+), none of the policies you set up with the VPN Policy Routing will take effect on your mobile device. Disable WARP+ for your home WiFi to keep VPN Policy Routing affecting your mobile device.
 850
 851 If you just use the private DNS queries (WARP), [A Word About DNS-over-HTTPS](#a-word-about-DNS-over-HTTPS) applies. You can also disable WARP for your home WiFi to keep VPN Policy Routing affecting your mobile device.
 852
 853 ## Discussion
 854
 855 Please head to [OpenWrt Forum](https://forum.openwrt.org/t/vpn-policy-based-routing-web-ui-discussion/10389) for discussions of this service.
 856
 857 ## Getting Help
 858
 859 If things are not working as intended, please include the following in your post:
 860
 861 - content of ```/etc/config/dhcp```
 862 - content of ```/etc/config/firewall```
 863 - content of ```/etc/config/network```
 864 - content of ```/etc/config/vpn-policy-routing```
 865 - the output of ```/etc/init.d/vpn-policy-routing support```
 866 - the output of ```/etc/init.d/vpn-policy-routing reload``` with verbosity setting set to 2
 867
 868 If you don't want to post the ```/etc/init.d/vpn-policy-routing support``` output in a public forum, there's a way to have the support details automatically uploaded to my account at paste.ee by running: ```/etc/init.d/vpn-policy-routing support -p```. You need to have the following packages installed to enable paste.ee upload functionality: ```curl libopenssl ca-bundle```.
 869
 870 WARNING: while paste.ee uploads are unlisted/not indexed at the web-site, they are still publicly available.
 871
 872 ## Thanks
 873
 874 I'd like to thank everyone who helped create, test and troubleshoot this service. Without contributions from [@hnyman](https://github.com/hnyman), [@dibdot](https://github.com/dibdot), [@danrl](https://github.com/danrl), [@tohojo](https://github.com/tohojo), [@cybrnook](https://github.com/cybrnook), [@nidstigator](https://github.com/nidstigator), [@AndreBL](https://github.com/AndreBL), [@dz0ny](https://github.com/dz0ny), rigorous testing/bugreporting by [@dziny](https://github.com/dziny), [@bluenote73](https://github.com/bluenote73), [@buckaroo](https://github.com/pgera), [@Alexander-r](https://github.com/Alexander-r), [n8v8R](https://github.com/n8v8R), [psherman](https://forum.openwrt.org/u/psherman), multiple contributions from [dl12345](https://github.com/dl12345), [trendy](https://forum.openwrt.org/u/trendy) and feedback from other OpenWrt users it wouldn't have been possible. Wireguard/IPv6 support is courtesy of [Mullvad](https://www.mullvad.net) and [IVPN](https://www.ivpn.net/).