I'm having a bit of trouble with outgoing traffic from the router itself.
The goal:
I want all traffic from the router itself, eg: dns, updates, packages, blocklists, ipsets.. to go over a vpn. So I created the following firewall rules:
allow vpn-connections to wan
mark 0x10 ipv4/6 from this device to wan
block everything from this device to wan
and added a routing rule:
mark '0x10' lookup '21' priority '30000'
somehow this does not work, and im breaking my brain over what it could be.
From superfluous description it looks like you mark then drop packets and they never reach routing. mark action is not final like accept/reject/drop, next rule(s) count
Can you show:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
nft list ruleset # only {} brackets , hook lines and mark and drop lines
Obviously edit away static IP addresses and all other secrets.
Yes, that's what I had, before vpn1 as default and exceptions for wan, however i found out that vpn2 and vpn3 would travel over vpn1 even if they have their own tables. I saw the counters from vpn1 growing equally to vpn3 when something was d/l over vpn3.
For lan I cannot setup a static rule, because I need some exclusions to go through wan, hence the dynamic rule.
So what am I missing then ?
traffic goes to firewall
firewall rule marks traffic matching conditions with a value
traffic goes to routing
routing rule matches traffic marked value and routes to specified table
I feel so lost
If I setup a vpn without a zone it would be for router only ?, and then make exceptions end-points. Because as far as I understand each subsequent vpn would need to bypass the first because of the change in default route ?
edit:
I looked at the routes, and its messed up:
# ip route
default dev vpn proto static scope link
<endpoint_vpn_ip> via <modem-ip> dev eth0 proto static
<endpoint_vpn_ip> via <modem-ip> dev eth0 proto static
<endpoint_vpn_ip> dev vpn1 proto static scope link
<endpoint_vpn_ip> dev vpn1 proto static scope link
I thought I would get something like this:
default dev vpn proto static scope link
<endpoint_vpn_ip> via <modem-ip> dev eth0 proto static
<endpoint_vpn_ip> via <modem-ip> dev eth0 proto static
<endpoint_vpn_ip> via <modem-ip> dev eth0 proto static
<endpoint_vpn_ip> via <modem-ip> dev eth0 proto static