Ip4table creates unwanted ip rules

Installing and Using OpenWrt Network and Wireless Configuration
1

I have a super expensive data plan I only want to use for out of bands access when normal internet doesn't work. I tried to set ip4table to 1000 on the interface, but to my surprise I see traffic is still routed through the interface.

OpenWRT creates rule 10000,20000 and 90002. How can I get rid of those? I want to use my own fwmark/conntrack rule.

# ip rule
0:      from all lookup local 
10000:  from 192.168.1.2 lookup 1000 
20000:  from all to 192.168.1.2/24 lookup 1000 
32766:  from all lookup main 
32767:  from all lookup default 
90002:  from all iif lo lookup 1000
2

Simply make the priority of your rules less than or equal to 9999. I do this quite regularly.

screen03
screen03574×155 8.61 KB

config rule                          
        option src '192.168.1.2/32'
        option priority '9997'         
        option lookup '1000'  

config rule                          
        option dest '192.168.1.2/32' ##?? you used /24
        option priority '9998'         
        option lookup '1000'  

config rule                          
        option in 'lo'          
        option priority '9999'         
        option lookup '1000'
3

Thank you! I ended up copying the kernel rules to pref 2000 now and putting unreachable on the end. Seems like that makes it ignore all the OpenWRT stuff.

0:      from all lookup local 

2000:   from all lookup main
2001:   from all lookup default
2002:   from all unreachable

10000:  from 192.168.1.2 lookup 1000 
20000:  from all to 192.168.1.2/24 lookup 1000 
32766:  from all lookup main 
32767:  from all lookup default 
90002:  from all iif lo lookup 1000
4

Glad you got it working!

There's one thing I overlooked:

  • Did you install something that created 10000, 20000 and 90002?
  • What's table 1000?

I don't have those rules or tables on any of my OpenWrt devices. When I drafted my reply, I mistakenly assumed those where your rules needing to have a lower priority.

5

OpenWRT/netifd adds them when I use ip4table.

table 1000 is the value I put into ip4table.

This was a bit confusing to me since I first tested my setup on my desktop and NetworkManager's ipv4.route-table does not create such rules.

6

Perhaps I misunderstand what's occurring. I've never had rules appear with those priorities before. Interesting. Then again, I always specify the priority.