1 # VPN Policy-Based Routing
5 This service allows you to define rules (policies) for routing traffic via WAN or your L2TP, Openconnect, OpenVPN, PPTP or Wireguard tunnels. Policies can be set based on any combination of local/remote ports, local/remote IPv4 or IPv6 addresses/subnets or domains. This service supersedes the [VPN Bypass](https://github.com/openwrt/packages/blob/master/net/vpnbypass/files/README.md) service, by supporting IPv6 and by allowing you to set explicit rules not just for WAN interface (bypassing OpenVPN tunnel), but for L2TP, Openconnect, OpenVPN, PPTP and Wireguard tunnels as well.
11 - Any policy can target either WAN or a VPN tunnel interface.
12 - L2TP tunnels supported (with protocol names l2tp\*).
13 - Openconnect tunnels supported (with protocol names openconnect\*).
14 - OpenVPN tunnels supported (with device names tun\* or tap\*).<sup>[1](#footnote1)</sup> <sup>[2](#footnote2)</sup>
15 - PPTP tunnels supported (with protocol names pptp\*).
16 - Wireguard tunnels supported (with protocol names wireguard\*).
18 ### IPv4/IPv6/Port-Based Policies
20 - Policies based on local names, IPs or subnets. You can specify a single IP (as in ```192.168.1.70```) or a local subnet (as in ```192.168.1.81/29```) or a local device name (as in ```nexusplayer```). IPv6 addresses are also supported.
21 - Policies based on local ports numbers. Can be set as an individual port number (```32400```), a range (```5060-5061```), a space-separated list (```80 8080```) or a combination of the above (```80 8080 5060-5061```). Limited to 15 space-separated entries per policy.
22 - Policies based on remote IPs/subnets or domain names. Same format/syntax as local IPs/subnets.
23 - Policies based on remote ports numbers. Same format/syntax and restrictions as local ports.
24 - You can mix the IP addresses/subnets and device (or domain) names in one field separating them by space (like this: ```66.220.2.74 he.net tunnelbroker.net```).
25 - See [Policy Options](#policy-options) section for more information.
27 ### DSCP Tag-Based Policies
29 You can also set policies for traffic with specific DSCP tag. On Windows 10, for example, you can mark traffic from specific apps with DSCP tags (instructions for tagging specific app traffic in Windows 10 can be found [here](http://serverfault.com/questions/769843/cannot-set-dscp-on-windows-10-pro-via-group-policy)).
33 If the custom user file includes are set, the service will load and execute them after setting up ip tables and ipsets and processing policies. This allows, for example, to add large numbers of domains/IP addresses to ipsets without manually adding all of them to the config file.
35 Two example custom user-files are provided: ```/etc/vpn-policy-routing.aws.user``` and ```/etc/vpn-policy-routing.netflix.user```. They are provided to pull the AWS and Netflix IP addresses into the ```wan``` ipset respectively.
37 ### Strict Enforcement
39 - Supports strict policy enforcement, even if the policy interface is down -- resulting in network being unreachable for specific policy (enabled by default).
43 - Service can be set to utilize ```dnsmasq```'s ```ipset``` support, which requires the ```dnsmasq-full``` package to be installed (see [How to install dnsmasq-full](#how-to-install-dnsmasq-full)). This significantly improves the start up time because ```dnsmasq``` resolves the domain names and adds them to appropriate ```ipset``` in background. Another benefit of using ```dnsmasq```'s ```ipset``` is that it also automatically adds third-level domains to the ```ipset```: if ```domain.com``` is added to the policy, this policy will affect all ```*.domain.com``` subdomains. This also works for top-level domains as well, a policy targeting the ```at``` for example, will affect all the ```*.at``` domains.
44 - Please review the [Footnotes/Known Issues](#footnotesknown-issues) section, specifically [<sup>#5</sup>](#footnote5) and any other information in that section relevant to domain-based routing/DNS.
48 - Can be fully configured with ```uci``` commands or by editing ```/etc/config/vpn-policy-routing``` file.
49 - Has a companion package (```luci-app-vpn-policy-routing```) so policies can be configured with Web UI.
53 - Doesn't stay in memory, creates the routing tables and ```iptables``` rules/```ipset``` entries which are automatically updated when supported/monitored interface changes.
54 - Proudly made in :maple_leaf: Canada :maple_leaf: , using locally-sourced electrons.
56 ## Screenshots (luci-app-vpn-policy-routing)
59 ![screenshot](https://raw.githubusercontent.com/stangri/openwrt_packages/master/screenshots/vpn-policy-routing/screenshot04-status.png "Service Status")
61 Configuration - Basic Configuration
62 ![screenshot](https://raw.githubusercontent.com/stangri/openwrt_packages/master/screenshots/vpn-policy-routing/screenshot04-config-basic.png "Basic Configuration")
64 Configuration - Advanced Configuration
65 ![screenshot](https://raw.githubusercontent.com/stangri/openwrt_packages/master/screenshots/vpn-policy-routing/screenshot04-config-advanced.png "Advanced Configuration")
67 Configuration - WebUI Configuration
68 ![screenshot](https://raw.githubusercontent.com/stangri/openwrt_packages/master/screenshots/vpn-policy-routing/screenshot04-config-webui.png "WebUI Configuration")
71 ![screenshot](https://raw.githubusercontent.com/stangri/openwrt_packages/master/screenshots/vpn-policy-routing/screenshot04-policies.png "Policies")
74 ![screenshot](https://raw.githubusercontent.com/stangri/openwrt_packages/master/screenshots/vpn-policy-routing/screenshot04-dscp.png "DSCP Tagging")
76 Custom User File Includes
77 ![screenshot](https://raw.githubusercontent.com/stangri/openwrt_packages/master/screenshots/vpn-policy-routing/screenshot04-userfiles.png "Custom User File Includes")
81 On start, this service creates routing tables for each supported interface (WAN/WAN6 and VPN tunnels) which are used to route specially marked packets. For the ```mangle``` table's ```PREROUTING```, ```FORWARD```, ```INPUT``` and ```OUTPUT``` chains, the service creates corresponding ```VPR_*``` chains to which policies are assigned. Evaluation and marking of packets happen in these ```VPR_*``` chains. If enabled, the service also creates the remote/local ipsets per each supported interface and the corresponding ```iptables``` rule for marking packets matching the ```ipset```. The service then processes the user-created policies.
83 ### Processing Policies
85 Each policy can result in either a new ```iptables``` rule or, if ```src_ipset``` or ```dest_ipset``` are enabled, an ```ipset``` or a ```dnsmasq```'s ```ipset``` entry.
87 - Policies with local MAC-addresses, IP addresses or local device names can be created as ```iptables``` rules or ```ipset``` entries.
88 - Policies with local or remote ports are always created as ```iptables``` rules.
89 - Policies with local or remote netmasks can be created as ```iptables``` rules or ```ipset``` entries.
90 - Policies with **only** remote IP address or a domain name can be created as ```iptables``` rules or ```dnsmasq```'s ```ipset``` or an ```ipset``` (if enabled).
92 ### Policies Priorities
94 - If support for ```src_ipset``` and ```dest_ipset``` is disabled, then only ```iptables``` rules are created. The policy priority is the same as its order as listed in Web UI and ```/etc/config/vpn-policy-routing```. The higher the policy is in the Web UI and configuration file, the higher its priority is.
95 - If support for ```src_ipset``` and ```dest_ipset``` is enabled, then the ```ipset``` entries have the highest priority (irrelevant of their position in the policies list) and the other policies are processed in the same order as they are listed in Web UI and ```/etc/config/vpn-policy-routing```.
96 - If there are conflicting ```ipset``` entries for different interfaces, the priority is given to the interface which is listed first in the ```/etc/config/network``` file.
97 - If set, the ```DSCP``` policies trump all other policies, including the ```ipset``` ones.
101 Please make sure that the [requirements](#requirements) are satisfied and install ```vpn-policy-routing``` and ```luci-app-vpn-policy-routing``` from Web UI or connect to your router via ssh and run the following commands:
105 opkg install vpn-policy-routing luci-app-vpn-policy-routing
108 If these packages are not found in the official feed/repo for your version of OpenWrt/LEDE Project, you will need to [add a custom repo to your router](https://github.com/stangri/openwrt_packages/blob/master/README.md#on-your-router) first.
112 This service requires the following packages to be installed on your router: ```ipset```, ```resolveip```, ```ip-full``` (or a ```busybox``` built with ```ip``` support), ```kmod-ipt-ipset``` and ```iptables```.
114 To satisfy the requirements, connect to your router via ssh and run the following commands:
117 opkg update; opkg install ipset resolveip ip-full kmod-ipt-ipset iptables
120 ### How to install dnsmasq-full
122 If you want to use ```dnsmasq```'s ```ipset``` support, you will need to install ```dnsmasq-full``` instead of the ```dnsmasq```. To do that, connect to your router via ssh and run the following command:
125 opkg update; opkg remove dnsmasq; opkg install dnsmasq-full;
128 ### Unmet dependencies
130 If you are running a development (trunk/snapshot) build of OpenWrt on your router and your build is outdated (meaning that packages of the same revision/commit hash are no longer available and when you try to satisfy the [requirements](#requirements) you get errors), please flash either current OpenWrt release image or current development/snapshot image.
132 ## Service Configuration Settings
134 As per screenshots above, in the Web UI the ```vpn-policy-routing``` configuration is split into ```Basic```, ```Advanced``` and ```WebUI``` settings. The full list of configuration parameters of ```vpn-policy-routing.config``` section is:
136 |Web UI Section|Parameter|Type|Default|Description|
137 | --- | --- | --- | --- | --- |
138 |Basic|enabled|boolean|0|Enable/disable the ```vpn-policy-routing``` service.|
139 |Basic|verbosity|integer|2|Can be set to 0, 1 or 2 to control the console and system log output verbosity of the ```vpn-policy-routing``` service.|
140 |Basic|strict_enforcement|boolean|1|Enforce policies when their interface is down. See [Strict enforcement](#strict-enforcement) for more details.|
141 |Basic|dest_ipset|string|none|Enable/disable use of one of the ipset options for compatible remote policies (policies with only a remote hostname and no other fields set). This speeds up service start-up and operation. Currently supported options are ```none```, ```ipset``` and ```dnsmasq.ipset``` (see [Use DNSMASQ ipset](#use-dnsmasq-ipset) for more details). Make sure the [requirements](#requirements) are met.|
142 |Basic|src_ipset|boolean|0|Enable/disable use of ```ipset``` entries for compatible local policies (policies with only a local IP address or MAC address and no other fields set). Using ```ipset``` for local IPs/MACs is faster than using ```iptables``` rules, however it makes it impossible to enforce policies priority/order. Make sure the [requirements](#requirements) are met.|
143 |Basic|ipv6_enabled|boolean|0|Enable/disable IPv6 support.|
144 |Advanced|supported_interface|list/string||Allows to specify the space-separated list of interface names (in lower case) to be explicitly supported by the ```vpn-policy-routing``` service. Can be useful if your OpenVPN tunnels have dev option other than tun\* or tap\*.|
145 |Advanced|ignored_interface|list/string||Allows to specify the space-separated list of interface names (in lower case) to be ignored by the ```vpn-policy-routing``` service. Can be useful if running both VPN server and VPN client on the router.|
146 |Advanced|boot_timeout|number|30|Allows to specify the time (in seconds) for ```vpn-policy-routing``` service to wait for WAN gateway discovery on boot. Can be useful on devices with ADSL modem built in.|
147 |Advanced|iptables_rule_option|append/insert|append|Allows to specify the iptables parameter for rules: ```-A``` for ```append``` and ```-I``` for ```insert```. Append is generally speaking more compatible with other packages/firewall rules. Recommended to change to ```insert``` only to improve compatibility with the ```mwan3``` package.|
148 |Advanced|iprule_enabled|boolean|0|Add an ```ip rule```, not an ```iptables``` entry for policies with just the local address. Use with caution to manipulate policies priorities.|
149 |Advanced|icmp_interface|string||Set the default ICMP protocol interface (interface name in lower case). Use with caution.|
150 |Advanced|append_src_rules|string||Append local IP Tables rules. Can be used to exclude local IP addresses from destinations for policies with local address set.|
151 |Advanced|append_dest_rules|string||Append local IP Tables rules. Can be used to exclude remote IP addresses from sources for policies with remote address set.|
152 |Advanced|wan_tid|integer|201|Starting (WAN) Table ID number for tables created by the ```vpn-policy-routing``` service.|
153 |Advanced|wan_mark|hexadecimal|0x010000|Starting (WAN) fw mark for marks used by the ```vpn-policy-routing``` service. High starting mark is used to avoid conflict with SQM/QoS, this can be changed by user. Change with caution together with ```fw_mask```.|
154 |Advanced|fw_mask|hexadecimal|0xff0000|FW Mask used by the ```vpn-policy-routing``` service. High mask is used to avoid conflict with SQM/QoS, this can be changed by user. Change with caution together with ```wan_mark```.|
155 |Web UI|webui_enable_column|boolean|0|Shows ```Enable``` checkbox column for policies, allowing to quickly enable/disable specific policy without deleting it.|
156 |Web UI|webui_protocol_column|boolean|0|Shows ```Protocol``` column for policies, allowing to specify the protocol for ```iptables``` rules for policies.|
157 |Web UI|webui_supported_protocol|list|0|List of protocols to display in the ```Protocol``` column for policies.|
158 |Web UI|webui_chain_column|boolean|0|Shows ```Chain``` column for policies, allowing to specify ```PREROUTING``` (default), ```FORWARD```, ```INPUT```, or ```OUTPUT``` chain for ```iptables``` rules for policies.|
159 |Web UI|webui_sorting|boolean|1|Shows the Up/Down buttons for policies, allowing you to move a policy up or down in the list/priority.|
160 ||wan_dscp|integer||Allows use of [DSCP-tag based policies](#dscp-tag-based-policies) for WAN interface.|
161 ||{interface_name}_dscp|integer||Allows use of [DSCP-tag based policies](#dscp-tag-based-policies) for a VPN interface.|
165 Default configuration has service disabled (use Web UI to enable/start service or run ```uci set vpn-policy-routing.config.enabled=1; uci commit vpn-policy-routing;```).
169 Each policy may have a combination of the options below, the ```name``` and ```interface``` options are required.
171 The ```src_addr```, ```src_port```, ```dest_addr``` and ```dest_port``` options supports parameter negation, for example if you want to **exclude** remote port 80 from the policy, set ```dest_port="!80"``` (notice lack of space between ```!``` and parameter).
173 |Option|Default|Description|
175 |**name**||Policy name, it **must** be set.|
176 |enabled|1|Enable/disable policy. To display the ```Enable``` checkbox column for policies in the WebUI, make sure to select ```Enabled``` for ```Show Enable Column``` in the ```Web UI``` tab.|
177 |**interface**||Policy interface, it **must** be set.|
178 |src_addr||List of space-separated local/source IP addresses, CIDRs, hostnames or mac addresses (colon-separated). You can also specify a local interface (like a specially created wlan) prepended by an ```@``` symbol.|
179 |src_port||List of space-separated local/source ports or port-ranges.|
180 |dest_addr||List of space-separated remote/target IP addresses, CIDRs or hostnames/domain names.|
181 |dest_port||List of space-separated remote/target ports or port-ranges.|
182 |proto|all|Policy protocol, can be any valid protocol from ```/etc/protocols``` for CLI/uci or can be selected from the values set in ```webui_supported_protocol```. To display the ```Protocol``` column for policies in the WebUI, make sure to select ```Enabled``` for ```Show Protocol Column``` in the ```Web UI``` tab.|
183 |chain|PREROUTING|Policy chain, can be either ```PREROUTING```, ```FORWARDING```, ```INPUT``` or ```OUTPUT```. This setting is case-sensitive. To display the ```Chain``` column for policies in the WebUI, make sure to select ```Enabled``` for ```Show Chain Column``` in the ```Web UI``` tab.|
185 ### Custom User Files Include Options
187 |Option|Default|Description|
189 |**path**||Path to a custom user file (in a form of shell script), it **must** be set.|
190 |enabled|1|Enable/disable setting.|
194 #### Single IP, IP Range, Local Machine, Local MAC Address
196 The following policies route traffic from a single IP address, a range of IP addresses, a local machine (requires definition as DHCP host record in DHCP config), a MAC-address of a local device and finally all of the above via WAN.
200 option name 'Local IP'
201 option interface 'wan'
202 option src_addr '192.168.1.70'
205 option name 'Local Subnet'
206 option interface 'wan'
207 option src_addr '192.168.1.81/29'
210 option name 'Local Machine'
211 option interface 'wan'
212 option src_addr 'dell-ubuntu'
215 option name 'Local MAC Address'
216 option interface 'wan'
217 option src_addr '00:0F:EA:91:04:08'
220 option name 'Local Devices'
221 option interface 'wan'
222 option src_addr '192.168.1.70 192.168.1.81/29 dell-ubuntu 00:0F:EA:91:04:08'
228 The following policy routes LogMeIn Hamachi zero-setup VPN traffic via WAN.
232 option name 'LogmeIn Hamachi'
233 option interface 'wan'
234 option dest_addr '25.0.0.0/8 hamachi.cc hamachi.com logmein.com'
239 The following policy routes standard SIP port traffic via WAN for both TCP and UDP protocols.
243 option name 'SIP Ports'
244 option interface 'wan'
245 option dest_port '5060'
246 option proto 'tcp udp'
249 #### Plex Media Server
251 The following policies route Plex Media Server traffic via WAN. Please note, you'd still need to open the port in the firewall either manually or with the UPnP.
255 option name 'Plex Local Server'
256 option interface 'wan'
257 option src_port '32400'
260 option name 'Plex Remote Servers'
261 option interface 'wan'
262 option dest_addr 'plex.tv my.plexapp.com'
265 #### Emby Media Server
267 The following policy route Emby traffic via WAN. Please note, you'd still need to open the port in the firewall either manually or with the UPnP.
271 option name 'Emby Local Server'
272 option interface 'wan'
273 option src_port '8096 8920'
276 option name 'Emby Remote Servers'
277 option interface 'wan'
278 option dest_addr 'emby.media app.emby.media tv.emby.media'
281 #### Local OpenVPN Server + OpenVPN Client (Scenario 1)
283 If the OpenVPN client on your router is used as default routing (for the whole internet), make sure your settings are as following (three dots on the line imply other options can be listed in the section as well).
285 Relevant part of ```/etc/config/vpn-policy-routing```:
288 config vpn-policy-routing 'config'
289 list ignored_interface 'vpnserver'
293 option name 'OpenVPN Server'
294 option interface 'wan'
296 option src_port '1194'
297 option chain 'OUTPUT'
300 The network/firewall/openvpn settings are below.
302 Relevant part of ```/etc/config/network``` (**DO NOT** modify default OpenWrt network settings for neither ```wan``` nor ```lan```):
305 config interface 'vpnclient'
307 option ifname 'ovpnc0'
309 config interface 'vpnserver'
311 option ifname 'ovpns0'
315 Relevant part of ```/etc/config/firewall``` (**DO NOT** modify default OpenWrt firewall settings for neither ```wan``` nor ```lan```):
319 option name 'vpnclient'
320 option network 'vpnclient'
321 option input 'REJECT'
322 option forward 'ACCEPT'
323 option output 'REJECT'
329 option dest 'vpnclient'
332 option name 'vpnserver'
333 option network 'vpnserver'
334 option input 'ACCEPT'
335 option forward 'REJECT'
336 option output 'ACCEPT'
340 option src 'vpnserver'
344 option src 'vpnserver'
348 option src 'vpnserver'
349 option dest 'vpnclient'
352 option name 'Allow-OpenVPN-Inbound'
353 option target 'ACCEPT'
356 option dest_port '1194'
359 Relevant part of ```/etc/config/openvpn```:
362 config openvpn 'vpnclient'
364 option dev_type 'tun'
367 option remote 'some.domain.com 1197' # DO NOT USE PORT 1194 for VPN Client
370 config openvpn 'vpnserver'
373 option server '192.168.200.0 255.255.255.0'
377 #### Local OpenVPN Server + OpenVPN Client (Scenario 2)
379 If the OpenVPN client is **not** used as default routing and you create policies to selectively use the OpenVPN client, make sure your settings are as following (three dots on the line imply other options can be listed in the section as well).
381 Relevant part of ```/etc/config/vpn-policy-routing```:
384 config vpn-policy-routing 'config'
385 list ignored_interface 'vpnserver'
386 option append_src_rules '! -d 192.168.200.0/24'
390 The network/firewall/openvpn settings are below.
392 Relevant part of ```/etc/config/network``` (**DO NOT** modify default OpenWrt network settings for neither ```wan``` nor ```lan```):
395 config interface 'vpnclient'
397 option ifname 'ovpnc0'
399 config interface 'vpnserver'
401 option ifname 'ovpns0'
405 Relevant part of ```/etc/config/firewall``` (**DO NOT** modify default OpenWrt firewall settings for neither ```wan``` nor ```lan```):
409 option name 'vpnclient'
410 option network 'vpnclient'
411 option input 'REJECT'
412 option forward 'ACCEPT'
413 option output 'REJECT'
419 option dest 'vpnclient'
422 option name 'vpnserver'
423 option network 'vpnserver'
424 option input 'ACCEPT'
425 option forward 'REJECT'
426 option output 'ACCEPT'
430 option src 'vpnserver'
434 option src 'vpnserver'
438 option src 'vpnserver'
439 option dest 'vpnclient'
442 option name 'Allow-OpenVPN-Inbound'
443 option target 'ACCEPT'
446 option dest_port '1194'
449 Relevant part of ```/etc/config/openvpn```:
452 config openvpn 'vpnclient'
454 option dev_type 'tun'
457 option remote 'some.domain.com 1197' # DO NOT USE PORT 1194 for VPN Client
458 list pull_filter 'ignore "redirect-gateway"' # for OpenVPN 2.4 and later
459 option route_nopull '1' # for OpenVPN earlier than 2.4
462 config openvpn 'vpnserver'
465 option server '192.168.200.0 255.255.255.0'
469 #### Local Wireguard Server + Wireguard Client (Scenario 1)
471 Yes, I'm aware that technically there are no clients nor servers in Wireguard, it's all peers, but for the sake of README readability I will use the terminology similar to the OpenVPN Server + Client setups.
473 If the Wireguard tunnel on your router is used as default routing (for the whole internet), make sure your settings are as following (three dots on the line imply other options can be listed in the section as well).
475 Relevant part of ```/etc/config/vpn-policy-routing```:
478 config vpn-policy-routing 'config'
479 list ignored_interface 'wgserver'
483 option name 'Wireguard Server'
484 option interface 'wan'
486 option src_port '61820'
487 option chain 'OUTPUT'
490 The recommended network/firewall settings are below.
492 Relevant part of ```/etc/config/network``` (**DO NOT** modify default OpenWrt network settings for neither ```wan``` nor ```lan```):
495 config interface 'wgclient'
496 option proto 'wireguard'
499 config wireguard_wgclient
500 list allowed_ips '0.0.0.0/0'
501 list allowed_ips '::0/0'
502 option endpoint_port '51820'
503 option route_allowed_ips '1'
506 config interface 'wgserver'
507 option proto 'wireguard'
508 option listen_port '61820'
509 list addresses '192.168.200.1'
512 config wireguard_wgserver
513 list allowed_ips '192.168.200.2/32'
514 option route_allowed_ips '1'
518 Relevant part of ```/etc/config/firewall``` (**DO NOT** modify default OpenWrt firewall settings for neither ```wan``` nor ```lan```):
522 option name 'wgclient'
523 option network 'wgclient'
524 option input 'REJECT'
525 option forward 'ACCEPT'
526 option output 'REJECT'
532 option dest 'wgclient'
535 option name 'wgserver'
536 option network 'wgserver'
537 option input 'ACCEPT'
538 option forward 'REJECT'
539 option output 'ACCEPT'
543 option src 'wgserver'
547 option src 'wgserver'
551 option src 'wgserver'
552 option dest 'wgclient'
555 option name 'Allow-WG-Inbound'
556 option target 'ACCEPT'
559 option dest_port '61820'
562 #### Local Wireguard Server + Wireguard Client (Scenario 2)
564 Yes, I'm aware that technically there are no clients nor servers in Wireguard, it's all peers, but for the sake of README readability I will use the terminology similar to the OpenVPN Server + Client setups.
566 If the Wireguard client is **not** used as default routing and you create policies to selectively use the Wireguard client, make sure your settings are as following (three dots on the line imply other options can be listed in the section as well).
568 Relevant part of ```/etc/config/vpn-policy-routing```:
571 config vpn-policy-routing 'config'
572 list ignored_interface 'wgserver'
573 option append_src_rules '! -d 192.168.200.0/24'
577 The recommended network/firewall settings are below.
579 Relevant part of ```/etc/config/network``` (**DO NOT** modify default OpenWrt network settings for neither ```wan``` nor ```lan```):
582 config interface 'wgclient'
583 option proto 'wireguard'
586 config wireguard_wgclient
587 list allowed_ips '0.0.0.0/0'
588 list allowed_ips '::0/0'
589 option endpoint_port '51820'
592 config interface 'wgserver'
593 option proto 'wireguard'
594 option listen_port '61820'
595 list addresses '192.168.200.1/24'
598 config wireguard_wgserver
599 list allowed_ips '192.168.200.2/32'
600 option route_allowed_ips '1'
604 Relevant part of ```/etc/config/firewall``` (**DO NOT** modify default OpenWrt firewall settings for neither ```wan``` nor ```lan```):
608 option name 'wgclient'
609 option network 'wgclient'
610 option input 'REJECT'
611 option forward 'ACCEPT'
612 option output 'REJECT'
618 option dest 'wgclient'
621 option name 'wgserver'
622 option network 'wgserver'
623 option input 'ACCEPT'
624 option forward 'REJECT'
625 option output 'ACCEPT'
629 option src 'wgserver'
633 option src 'wgserver'
637 option src 'wgserver'
638 option dest 'wgclient'
641 option name 'Allow-WG-Inbound'
642 option target 'ACCEPT'
645 option dest_port '61820'
650 The following policy should route US Netflix traffic via WAN. For capturing international Netflix domain names, you can refer to [these getdomainnames.sh-specific instructions](https://github.com/Xentrk/netflix-vpn-bypass#ipset_netflix_domainssh) and don't forget to adjust them for OpenWrt. This may not work if Netflix changes things. For more reliable US Netflix routing you may want to consider using [custom user files](#custom-user-files).
654 option name 'Netflix Domains'
655 option interface 'wan'
656 option dest_addr 'amazonaws.com netflix.com nflxext.com nflximg.net nflxso.net nflxvideo.net dvd.netflix.com'
659 #### Example Custom User Files Includes
663 option path '/etc/vpn-policy-routing.netflix.user'
666 option path '/etc/vpn-policy-routing.aws.user'
669 #### Basic OpenVPN Client Config
671 There are multiple guides online on how to configure the OpenVPN client on OpenWrt "the easy way", and they usually result either in a kill-switch configuration or configuration where the OpenVPN tunnel cannot be properly (and separately from WAN) routed, either way, incompatible with the VPN Policy-Based Routing.
673 Below is the sample OpenVPN client configuration for OpenWrt which is guaranteed to work. If you have already deviated from the instructions below (ie: made any changes to any of the ```wan``` or ```lan``` configurations in either ```/etc/config/network``` or ```/etc/config/firewall```), you will need to start from scratch with a fresh OpenWrt install.
675 Relevant part of ```/etc/config/vpn-policy-routing```:
678 config vpn-policy-routing 'config'
679 list supported_interface 'vpnc'
683 The recommended network/firewall settings are below.
685 Relevant part of ```/etc/config/network``` (**DO NOT** modify default OpenWrt network settings for neither ```wan``` nor ```lan```):
688 config interface 'vpnc'
690 option ifname 'ovpnc0'
693 Relevant part of ```/etc/config/firewall``` (**DO NOT** modify default OpenWrt firewall settings for neither ```wan``` nor ```lan```):
698 option network 'vpnc'
699 option input 'REJECT'
700 option forward 'REJECT'
701 option output 'ACCEPT'
710 If you have a Guest Network, add the following to the ```/etc/config/firewall```:
718 Relevant part of ```/etc/config/openvpn``` (configure the rest of the client connection for your specifics by either referring to an existing ```.ovpn``` file or thru the OpenWrt uci settings):
721 config openvpn 'vpnc'
724 option dev_type 'tun'
729 ## Footnotes/Known Issues
731 1. <a name="footnote1"> </a> See [note about multiple OpenVPN clients](#multiple-openvpn-clients).
733 2. <a name="footnote2"> </a> If your ```OpenVPN``` interface has the device name different from tun\* or tap\*, is not up and is not explicitly listed in ```supported_interface``` option, it may not be available in the policies ```Interface``` drop-down within WebUI.
735 3. <a name="footnote3"> </a> If your default routing is set to the VPN tunnel, then the true WAN interface cannot be discovered using OpenWrt built-in functions, so service will assume your network interface ending with or starting with ```wan``` is the true WAN interface.
737 4. <a name="footnote4"> </a> The service does **NOT** support the "killswitch" router mode (where if you stop the VPN tunnel, you have no internet connection). For proper operation, leave all the default OpenWrt ```network``` and ```firewall``` settings for ```lan``` and ```wan``` intact.
739 5. <a name="footnote5"> </a> When using the ```dnsmasq.ipset``` option, please make sure to flush the DNS cache of the local devices, otherwise domain policies may not work until you do. If you're not sure how to flush the DNS cache (or if the device/OS doesn't offer an option to flush its DNS cache), reboot your local devices when starting to use the service and/or when connecting data-capable device to your WiFi.
741 ### Multiple OpenVPN Clients
743 If you use multiple OpenVPN clients on your router, the order in which their devices are named (tun0, tun1, etc) is not guaranteed by OpenWrt/LEDE Project. The following settings are recommended in this case.
745 For ```/etc/config/network```:
748 config interface 'vpnclient0'
750 option ifname 'ovpnc0'
752 config interface 'vpnclient1'
754 option ifname 'ovpnc1'
757 For ```/etc/config/openvpn```:
760 config openvpn 'vpnclient0'
762 option dev_type 'tun'
766 config openvpn 'vpnclient1'
768 option dev_type 'tun'
773 For ```/etc/config/vpn-policy-routing```:
776 config vpn-policy-routing 'config'
777 list supported_interface 'vpnclient0 vpnclient1'
781 ### A Word About Default Routing
783 Service does not alter the default routing. Depending on your VPN tunnel settings (and settings of the VPN server you are connecting to), the default routing might be set to go via WAN or via VPN tunnel. This service affects only routing of the traffic matching the policies. If you want to override default routing, set the following:
785 - For OpenVPN 2.4 and newer client config:
788 list pull_filter 'ignore "redirect-gateway"'
791 - For OpenVPN 2.3 and older client config:
794 option route_nopull '1'
797 - For your Wireguard (client) config:
800 option route_allowed_ips '0'
803 - Routing Wireguard traffic requires setting `rp_filter = 2`. Please refer to [issue #41](https://github.com/stangri/openwrt_packages/issues/41) for more details.
805 ### A Word About HTTP/3 (QUICK)
807 If you want to target traffic using HTTP/3 protocol, you can use the ```AUTO``` as the protocol (the policy will be either protocol-agnostic or ```TCP/UDP```) or explicitly use ```UDP``` as a protocol.
809 ### A Word About DNS-over-HTTPS
811 Some browsers, like [Mozilla Firefox](https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_about-dns-over-https) or [Google Chrome/Chromium](https://blog.chromium.org/2019/09/experimenting-with-same-provider-dns.html) have [DNS-over-HTTPS proxy](https://en.wikipedia.org/wiki/DNS_over_HTTPS) built-in. Their requests to web-sites cannot be affected if the ```dnsmasq.ipset``` is set for the ```dest_ipset``` option. To fix this, you can try either of the following:
813 1. Disable the DNS-over-HTTPS support in your browser and use the OpenWrt's [net/https-dns-proxy](https://github.com/openwrt/packages/tree/master/net/https-dns-proxy) package and set it up either [manually](https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq_https-dns-proxy?s[]=https&s[]=dns&s[]=proxy) or auto-magically with [https-dns-proxy luci app](https://github.com/openwrt/luci/tree/master/applications/luci-app-https_dns_proxy). You can then continue to use ```dnsmasq.ipset``` setting for the ```dest_ipset``` in VPN Policy Routing.
815 2. Continue using DNS-over-HTTPS in your browser (which, by the way, also limits your options for router-level AdBlocking as described [in ```dnsmasq.ipset``` option description here](https://github.com/openwrt/packages/tree/master/net/simple-adblock/files#dns-resolution-option)), you than would either have to disable the ```dest_ipset``` or switch it to ```ipset```. Please note, you will lose all the benefits of [```dnsmasq.ipset```](#use-dnsmasq-ipset) option.
817 ### A Word About Cloudflare's 1.1.1.1 App
819 Cloudflare has released an app for [iOS](https://itunes.apple.com/us/app/1-1-1-1-faster-internet/id1423538627) and [Android](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone), which can also be configured to route traffic thru their own VPN tunnel (WARP+).
821 If you use Cloudlfare's VPN tunnel (WARP+), none of the policies you set up with the VPN Policy Routing will take effect on your mobile device. Disable WARP+ for your home WiFi to keep VPN Policy Routing affecting your mobile device.
823 If you just use the private DNS queries (WARP), [A Word About DNS-over-HTTPS](#a-word-about-DNS-over-HTTPS) applies. You can also disable WARP for your home WiFi to keep VPN Policy Routing affecting your mobile device.
827 Please head to [OpenWrt Forum](https://forum.openwrt.org/t/vpn-policy-based-routing-web-ui-discussion/10389) for discussions of this service.
831 If things are not working as intended, please include the following in your post:
833 - content of ```/etc/config/dhcp```
834 - content of ```/etc/config/firewall```
835 - content of ```/etc/config/network```
836 - content of ```/etc/config/vpn-policy-routing```
837 - the output of ```/etc/init.d/vpn-policy-routing support```
838 - the output of ```/etc/init.d/vpn-policy-routing reload``` with verbosity setting set to 2
840 If you don't want to post the ```/etc/init.d/vpn-policy-routing support``` output in a public forum, there's a way to have the support details automatically uploaded to my account at paste.ee by running: ```/etc/init.d/vpn-policy-routing support -p```. You need to have the following packages installed to enable paste.ee upload functionality: ```curl libopenssl ca-bundle```.
842 WARNING: while paste.ee uploads are unlisted/not indexed at the web-site, they are still publicly available.
846 I'd like to thank everyone who helped create, test and troubleshoot this service. Without contributions from [@hnyman](https://github.com/hnyman), [@dibdot](https://github.com/dibdot), [@danrl](https://github.com/danrl), [@tohojo](https://github.com/tohojo), [@cybrnook](https://github.com/cybrnook), [@nidstigator](https://github.com/nidstigator), [@AndreBL](https://github.com/AndreBL) and [@dz0ny](https://github.com/dz0ny) and rigorous testing/bugreporting by [@dziny](https://github.com/dziny), [@bluenote73](https://github.com/bluenote73), [@buckaroo](https://github.com/pgera), [@Alexander-r](https://github.com/Alexander-r), [n8v8R](https://github.com/n8v8R) and [psherman](https://forum.openwrt.org/u/psherman) it wouldn't have been possible. Wireguard/IPv6 support is courtesy of [Mullvad](https://www.mullvad.net), [IVPN](https://www.ivpn.net/) and [WireVPN](https://www.wirevpn.net).