VPN policy based routing possible?

p4p4 · May 2, 2018, 11:41am

I am considering buying a Turris Omnia router. At the moment I am using a Linksys WRT1900ACS with LEDE firmware and OpenVPN client with policy based routing with the package:

github.com

stangri/openwrt_packages/blob/master/vpn-policy-routing/files/README.md

# VPN Policy-Based Routing

## Description
This service allows you to define rules (policies) for routing traffic via WAN or your L2TP, Openconnect, OpenVPN, PPTP or Wireguard tunnels. Policies can be set based on any combination of local/remote ports, local/remote IPv4 or IPv6 addresses/subnets or domains. This service supersedes the [VPN Bypass](https://github.com/openwrt/packages/blob/master/net/vpnbypass/files/README.md) service, by supporting IPv6 and by allowing you to set explicit rules not just for WAN interface (bypassing OpenVPN tunnel), but for L2TP, Openconnect, OpenVPN, PPTP and Wireguard tunnels as well.

## Features

#### Gateways/Tunnels
- Any policy can target either WAN or a VPN tunnel interface.
- L2TP tunnels supported (with protocol names l2tp\*).
- Openconnect tunnels supported (with protocol names openconnect\*).
- OpenVPN tunnels supported (with device names tun\* or tap\*).
- PPTP tunnels supported (with protocol names pptp\*).
- Wireguard tunnels supported (with protocol names wireguard\*).

#### IPv4/IPv6/Port-Based Policies
- Policies based on local names, IPs or subnets. You can specify a single IP (as in ```192.168.1.70```) or a local subnet (as in ```192.168.1.81/29```) or a local device name (as in ```nexusplayer```). IPv6 addresses are also supported.
- Policies based on local ports numbers. Can be set as an individual port number (```32400```), a range (```5060-5061```), a space-separated list (```80 8080```) or a combination of the above (```80 8080 5060-5061```). Limited to 15 space-separated entries per policy.
- Policies based on remote IPs/subnets or domain names. Same format/syntax as local IPs/subnets.
- Policies based on remote ports numbers. Same format/syntax and restrictions as local ports.

This file has been truncated. show original

Is it possible to use VPN policy based routing with Turris Omnia “out of the box”, or if not, can the VPN policy based routing LEDE package from stangri be installed?

Thank you for the support!

anon50890781 · May 2, 2018, 12:03pm

Out of the box is not working since the TO repo is currently different from upstream OpenWRT.

The current stable TO firmware is based on OpenWrt omnia 15.05 r47055 / LuCI 49c3edd5861fd032fa8379ceda525c27a908a114 branch (git-17.212.24321-49c3edd)

Just ran

opkg update; opkg install ca-certificates wget libopenssl
echo -e -n 'untrusted comment: LEDE usign key of Stan Grishin\nRWR//HUXxMwMVnx7fESOKO7x8XoW4/dRidJPjt91hAAU2L59mYvHy0Fa\n' > /tmp/stangri-repo.pub && opkg-key add /tmp/stangri-repo.pub
! grep -q 'stangri_repo' /etc/opkg/customfeeds.conf && echo 'src/gz stangri_repo https://raw.githubusercontent.com/stangri/openwrt-repo/master' >> /etc/opkg/customfeeds.conf
opkg update

and then from the LuCI inerface installed both - vpn-policy-routing and luci-app-vpn-policy-routing, which went without a hitch.

Mind you that I had ipset resolveip ip-full kmod-ipt-ipset iptables already installed and dnsmasq removed and dnsmasq-full installed previously.

Have not tested whether it works though, pending some setup of wireguard as choice of VPN

p4p4 · May 2, 2018, 6:47pm

Hi n8v8r

Thanks for the quick reply. That sounds promising!

anon50890781 · May 6, 2018, 5:40pm

The app received an update yesterday through the TO (feed) updater and that went ok too.

Just got around of actually testing it and albeit some error showing in the log (below) it is working (well), that is based on wireguard VPN and utilizing ipset and no iptables. The routes (and related tables) are showing in the LuCI status page.
And it pays to read through the how it works of the Readme as I missed at first

The policy priority is the same as its order as listed in Web UI and /etc/config/vpn-policy-routing. The higher the policy is in the Web UI and configuration file, the higher its priority is.

Had the lan subnet at the top and wondering why particular clients were not routed the other way. Dropping the lan subnet to the bottom of the order set it right and now partiular clients are routed one way and the remainder of the lan subnet another.

Thank you for creating awareness of this app in this forum, it makes routing so much easier…!

notice [32269]: Creating table ‘lan/br-lan/0.0.0.0’ [✗]
notice [32269]: Routing ‘’ via wan [✗]
notice [32269]: service started on wan/pppoe-wan/<ip.redacted> wg0/wg0/<ip.redacted> with errors [✗]
notice [32269]: ERROR: Failed to set up ‘lan/br-lan/0.0.0.0’
ERROR: policy comment is empty!

stangri · May 7, 2018, 1:45am

The bottom of README has the list of things to do in case of problems – can you PM me those?

anon50890781 · May 7, 2018, 8:15am

@stangri Thank you foremost for this usefull app and secondly for making the effort of registering in this forum.

PM sent

p4p4 · May 7, 2018, 7:24pm

I ordered a Turris Omnia 2GB WLAN today. I’ll report how good VPN PBR is working after I have set it up!

anon50890781 · May 7, 2018, 8:00pm

The error I reported was based on a misconception I had about some setting and @stangri sorted it out, thus no further error showing.

And it got another update today.

p4p4 · May 11, 2018, 8:21pm

I received my Turris Omnia 2GB WLAN today and configured VPN with policy based routing (PBR).

Two issues:

to get PBR routing working after a reboot of the router I have to press “save and apply” under the “policy based routing” settings, before that nothing is routed through the VPN tunnel
when installing dnsmasq-full I get the error:

Blockquote

WARNING: You probably just removed a package that was installed as part of a user list or the basic system. This package will return durring the next updater run. We suggest you disable the user list instead.
Installing dnsmasq-full (2.78-2) to root…

Blockquote

Does anybody have the same issues?

p4p4 · May 11, 2018, 8:36pm

(Just wanted to add to my previous post: I’m using Turris OS version 3.10, that was installed automatically when I set up the router)

anon50890781 · May 11, 2018, 8:36pm

The dnsmaqs warning is by design of TO, not sure how such things are handled in OpenWRT.
For it not to return (TO may force some of those basics back) it needs a /etc/updater/conf.d/user.lua file with content Uninstall("dnsmasq")

The first point might due to that PBR is starting at boot prior the ovpn tun is up.

Other than that you got it actually working?

p4p4 · May 11, 2018, 8:41pm

As soon as its started after boot by manually clicking "save and apply* it seems to be running fine. But I have a simple configuration with only one client going through the tunnel and the rest through WAN:

Local IP 192.168.1.110 VPN
IP Range 192.168.1.0/24 WAN

anon50890781 · May 11, 2018, 8:44pm

I am curious what would happen to PBR if the tunnel is interrupted for some reason and comes back online, i.e. whether it would require to click save and apply

To anwser that question -

vpn-policy-routing: service monitoring interfaces:

anon50890781 · May 11, 2018, 8:57pm

Just had a look into the syslog and PBR is starting prior the ovpn tun is up and thus failing to create a routing table for the tun iface at boot time

p4p4 · May 11, 2018, 9:14pm

is there any way to solve this issue? With the older Turris OS this wasn’t an issue?

anon50890781 · May 11, 2018, 9:26pm

Did not try OpenVPN with the previous firmware only Wireguard.

How did it work with the other router you initially mentioned (Linksys WRT1900ACS with LEDE firmware)?

p4p4 · May 12, 2018, 6:51am

If I remember correctly that wasn’t an issue
Upto now OpenVPN connection an PBR still functional (since 12h)

anon50890781 · May 12, 2018, 9:54am

Perhaps worthing noting that icmp and udp are not routed through the vpn iface designated by PBR, even with

/etc/config/vpn-policy-routing
  config vpn-policy-routing 'config'
	option udp_proto_enabled '1'

p4p4 · May 12, 2018, 1:28pm

How can I find out what traffic goes through the tunnel and which isn’t?

anon50890781 · May 12, 2018, 4:42pm

packet capture https://openwrt.org/docs/guide-user/firewall/capture-filter-inspect-packets on the router, or a tool like wireshark on one/any/all of the clients connecting to the outbound vpn interface on the router.

Latter (on the client) though may capture only the traffic of the client it is running on but not the entire vpn traffic on the router.