Hi,
I am somehow having a hard time to get my openvpn connection to NordVPN to work everytime my router restart. it was working fine yesterday, but today it stopped working (we had an electric cut).
I can't see anything wrong in the log:
2023-05-05 13:35:01 [UNDEF] Inactivity timeout (--ping-restart), restarting
2023-05-05 13:35:01 SIGUSR1[soft,ping-restart] received, process restarting
2023-05-05 13:35:01 Restart pause, 5 second(s)
2023-05-05 13:35:06 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2023-05-05 13:35:06 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2023-05-05 13:35:06 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2023-05-05 13:35:06 TCP/UDP: Preserving recently used remote address: [AF_INET]90.207.238.161:1194
2023-05-05 13:35:06 Socket Buffers: R=[180224->180224] S=[180224->180224]
2023-05-05 13:35:06 UDP link local: (not bound)
2023-05-05 13:35:06 UDP link remote: [AF_INET]90.207.238.161:1194
Here is the result of the troubleshooting commands:
/etc/init.d/openvpn restart; sleep 10
# Log and status
logread -e openvpn; netstat -l -n -p | grep -e openvpn
# Runtime configuration
pgrep -f -a openvpn
ip address show; ip route show table all
ip rule show; ip -6 rule show; nft list ruleset
# Persistent configuration
uci show network; uci show firewall; uci show openvpn
head -v -n -0 /etc/openvpn/*.conf
- Result:
Fri May 5 13:37:30 2023 daemon.notice openvpn(FR)[7724]: OpenVPN 2.5.8 arm-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Fri May 5 13:37:30 2023 daemon.notice openvpn(FR)[7724]: library versions: OpenSSL 3.0.8 7 Feb 2023, LZO 2.10
Fri May 5 13:37:30 2023 daemon.notice openvpn(US)[7725]: OpenVPN 2.5.8 arm-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Fri May 5 13:37:30 2023 daemon.notice openvpn(US)[7725]: library versions: OpenSSL 3.0.8 7 Feb 2023, LZO 2.10
Fri May 5 13:37:30 2023 daemon.warn openvpn(FR)[7724]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri May 5 13:37:30 2023 daemon.warn openvpn(US)[7725]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri May 5 13:37:30 2023 daemon.notice openvpn(FR)[7724]: Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Fri May 5 13:37:30 2023 daemon.notice openvpn(FR)[7724]: Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Fri May 5 13:37:30 2023 daemon.notice openvpn(US)[7725]: Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Fri May 5 13:37:30 2023 daemon.notice openvpn(US)[7725]: Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Fri May 5 13:37:30 2023 daemon.notice openvpn(FR)[7724]: TCP/UDP: Preserving recently used remote address: [AF_INET]90.207.238.161:1194
Fri May 5 13:37:30 2023 daemon.notice openvpn(FR)[7724]: Socket Buffers: R=[180224->180224] S=[180224->180224]
Fri May 5 13:37:30 2023 daemon.notice openvpn(US)[7725]: TCP/UDP: Preserving recently used remote address: [AF_INET]90.207.238.161:1194
Fri May 5 13:37:30 2023 daemon.notice openvpn(US)[7725]: Socket Buffers: R=[180224->180224] S=[180224->180224]
Fri May 5 13:37:30 2023 daemon.notice openvpn(US)[7725]: UDP link local: (not bound)
Fri May 5 13:37:30 2023 daemon.notice openvpn(US)[7725]: UDP link remote: [AF_INET]90.207.238.161:1194
Fri May 5 13:37:30 2023 daemon.notice openvpn(FR)[7724]: UDP link local: (not bound)
Fri May 5 13:37:30 2023 daemon.notice openvpn(FR)[7724]: UDP link remote: [AF_INET]90.207.238.161:1194
udp 0 0 0.0.0.0:37944 0.0.0.0:* 7724/openvpn
udp 0 0 0.0.0.0:48314 0.0.0.0:* 7551/openvpn
udp 0 0 0.0.0.0:35018 0.0.0.0:* 7725/openvpn
7551 /usr/sbin/openvpn --status /var/run/openvpn.FR.status --cd /etc/openvpn/NordVPN --config /etc/openvpn/NordVPN/fr.ovpn --up /usr/libexec/openvpn-hotplug up FR --down /usr/libexec/openvpn-hotplug down FR --script-security 2
7724 /usr/sbin/openvpn --syslog openvpn(FR) --status /var/run/openvpn.FR.status --cd /etc/openvpn/NordVPN --config /etc/openvpn/NordVPN/fr.ovpn --up /usr/libexec/openvpn-hotplug up FR --down /usr/libexec/openvpn-hotplug down FR --script-security 2
7725 /usr/sbin/openvpn --syslog openvpn(US) --status /var/run/openvpn.US.status --cd /etc/openvpn/NordVPN --config /etc/openvpn/NordVPN/us.ovpn --up /usr/libexec/openvpn-hotplug up US --down /usr/libexec/openvpn-hotplug down US --script-security 2
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1508 qdisc mq state UP group default qlen 1024
link/ether 60:38:e0:c9:9e:f0 brd ff:ff:ff:ff:ff:ff
inet6 fe80::b539:cdfe:5cd0:41dc/64 scope link stable-privacy
valid_lft forever preferred_lft forever
3: lan4@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN group default qlen 1000
link/ether 60:38:e0:c9:9e:f0 brd ff:ff:ff:ff:ff:ff
4: lan3@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN group default qlen 1000
link/ether 60:38:e0:c9:9e:f0 brd ff:ff:ff:ff:ff:ff
5: lan2@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN group default qlen 1000
link/ether 60:38:e0:c9:9e:f0 brd ff:ff:ff:ff:ff:ff
6: lan1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP group default qlen 1000
link/ether 60:38:e0:c9:9e:f0 brd ff:ff:ff:ff:ff:ff
7: wan@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 62:38:e0:c9:9e:f0 brd ff:ff:ff:ff:ff:ff permaddr 60:38:e0:c9:9e:f0
inet 192.168.0.2/24 brd 192.168.0.255 scope global wan
valid_lft forever preferred_lft forever
inet6 fe80::640f:f22:379:70aa/64 scope link stable-privacy
valid_lft forever preferred_lft forever
10: mlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 60:38:e0:c9:9e:f3 brd ff:ff:ff:ff:ff:ff
inet6 fe80::9eb0:2f1b:1b50:88ca/64 scope link tentative stable-privacy
valid_lft forever preferred_lft forever
14: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 60:38:e0:c9:9e:f0 brd ff:ff:ff:ff:ff:ff
inet 192.168.7.1/24 brd 192.168.7.255 scope global br-lan
valid_lft forever preferred_lft forever
inet6 fd57:ae91:28f::1/60 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 fe80::9110:37f3:ebfc:6ed1/64 scope link stable-privacy
valid_lft forever preferred_lft forever
17: phy1-ap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP group default qlen 1000
link/ether 60:38:e0:c9:9e:f1 brd ff:ff:ff:ff:ff:ff
inet6 fe80::280:68f4:2a12:51dd/64 scope link stable-privacy
valid_lft forever preferred_lft forever
18: phy0-ap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP group default qlen 1000
link/ether 60:38:e0:c9:9e:f2 brd ff:ff:ff:ff:ff:ff
inet6 fe80::fc46:3815:984b:52a3/64 scope link stable-privacy
valid_lft forever preferred_lft forever
default via 192.168.0.1 dev wan table pbr_wan
192.168.7.0/24 dev br-lan table pbr_wan proto kernel scope link src 192.168.7.1
default via 192.168.0.1 dev wan proto static src 192.168.0.2
192.168.0.0/24 dev wan proto kernel scope link src 192.168.0.2
192.168.7.0/24 dev br-lan proto kernel scope link src 192.168.7.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
local 192.168.0.2 dev wan table local proto kernel scope host src 192.168.0.2
broadcast 192.168.0.255 dev wan table local proto kernel scope link src 192.168.0.2
local 192.168.7.1 dev br-lan table local proto kernel scope host src 192.168.7.1
broadcast 192.168.7.255 dev br-lan table local proto kernel scope link src 192.168.7.1
fd57:ae91:28f::/64 dev br-lan proto static metric 1024 pref medium
unreachable fd57:ae91:28f::/48 dev lo proto static metric 2147483647 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev br-lan proto kernel metric 256 pref medium
fe80::/64 dev wan proto kernel metric 256 pref medium
fe80::/64 dev phy0-ap0 proto kernel metric 256 pref medium
fe80::/64 dev phy1-ap0 proto kernel metric 256 pref medium
local ::1 dev lo table local proto kernel metric 0 pref medium
anycast fd57:ae91:28f:: dev br-lan table local proto kernel metric 0 pref medium
local fd57:ae91:28f::1 dev br-lan table local proto kernel metric 0 pref medium
anycast fe80:: dev eth0 table local proto kernel metric 0 pref medium
anycast fe80:: dev br-lan table local proto kernel metric 0 pref medium
anycast fe80:: dev wan table local proto kernel metric 0 pref medium
anycast fe80:: dev phy0-ap0 table local proto kernel metric 0 pref medium
anycast fe80:: dev phy1-ap0 table local proto kernel metric 0 pref medium
local fe80::280:68f4:2a12:51dd dev phy1-ap0 table local proto kernel metric 0 pref medium
local fe80::640f:f22:379:70aa dev wan table local proto kernel metric 0 pref medium
local fe80::9110:37f3:ebfc:6ed1 dev br-lan table local proto kernel metric 0 pref medium
local fe80::b539:cdfe:5cd0:41dc dev eth0 table local proto kernel metric 0 pref medium
local fe80::fc46:3815:984b:52a3 dev phy0-ap0 table local proto kernel metric 0 pref medium
multicast ff00::/8 dev eth0 table local proto kernel metric 256 pref medium
multicast ff00::/8 dev br-lan table local proto kernel metric 256 pref medium
multicast ff00::/8 dev wan table local proto kernel metric 256 pref medium
multicast ff00::/8 dev phy0-ap0 table local proto kernel metric 256 pref medium
multicast ff00::/8 dev phy1-ap0 table local proto kernel metric 256 pref medium
0: from all lookup local
30000: from all fwmark 0x10000/0xff0000 lookup pbr_wan
32766: from all lookup main
32767: from all lookup default
0: from all lookup local
32766: from all lookup main
table inet fw4 {
chain input {
type filter hook input priority filter; policy drop;
iifname "lo" accept comment "!fw4: Accept traffic from loopback"
ct state established,related accept comment "!fw4: Allow inbound established and related flows"
tcp flags syn / fin,syn,rst,ack jump syn_flood comment "!fw4: Rate limit TCP syn packets"
iifname { "tun0", "br-lan" } jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
iifname { "wan", "tun0", "tun1", "tun2", "tun3" } jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
iifname "tun0" jump input_FR comment "!fw4: Handle FR IPv4/IPv6 input traffic"
iifname "tun1" jump input_HK comment "!fw4: Handle HK IPv4/IPv6 input traffic"
iifname "tun3" jump input_US comment "!fw4: Handle US IPv4/IPv6 input traffic"
iifname "tun2" jump input_UK comment "!fw4: Handle UK IPv4/IPv6 input traffic"
jump handle_reject
}
chain forward {
type filter hook forward priority filter; policy drop;
ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
iifname { "tun0", "br-lan" } jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
iifname { "wan", "tun0", "tun1", "tun2", "tun3" } jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
iifname "tun0" jump forward_FR comment "!fw4: Handle FR IPv4/IPv6 forward traffic"
iifname "tun1" jump forward_HK comment "!fw4: Handle HK IPv4/IPv6 forward traffic"
iifname "tun3" jump forward_US comment "!fw4: Handle US IPv4/IPv6 forward traffic"
iifname "tun2" jump forward_UK comment "!fw4: Handle UK IPv4/IPv6 forward traffic"
jump upnp_forward comment "Hook into miniupnpd forwarding chain"
jump handle_reject
}
chain output {
type filter hook output priority filter; policy accept;
oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state established,related accept comment "!fw4: Allow outbound established and related flows"
oifname { "tun0", "br-lan" } jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
oifname { "wan", "tun0", "tun1", "tun2", "tun3" } jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
oifname "tun0" jump output_FR comment "!fw4: Handle FR IPv4/IPv6 output traffic"
oifname "tun1" jump output_HK comment "!fw4: Handle HK IPv4/IPv6 output traffic"
oifname "tun3" jump output_US comment "!fw4: Handle US IPv4/IPv6 output traffic"
oifname "tun2" jump output_UK comment "!fw4: Handle UK IPv4/IPv6 output traffic"
}
chain prerouting {
type filter hook prerouting priority filter; policy accept;
iifname { "tun0", "br-lan" } jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
}
chain handle_reject {
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject comment "!fw4: Reject any other traffic"
}
chain syn_flood {
limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
drop comment "!fw4: Drop excess packets"
}
chain input_lan {
jump accept_from_lan
}
chain output_lan {
jump accept_to_lan
}
chain forward_lan {
jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
jump accept_to_FR comment "!fw4: Accept lan to FR forwarding"
jump accept_to_HK comment "!fw4: Accept lan to HK forwarding"
jump accept_to_US comment "!fw4: Accept lan to US forwarding"
jump accept_to_UK comment "!fw4: Accept lan to UK forwarding"
jump accept_to_lan
}
chain helper_lan {
}
chain accept_from_lan {
iifname { "tun0", "br-lan" } counter packets 3100 bytes 224056 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}
chain accept_to_lan {
oifname { "tun0", "br-lan" } counter packets 57 bytes 10216 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}
chain input_wan {
meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
meta nfproto ipv4 meta l4proto igmp counter packets 29 bytes 928 accept comment "!fw4: Allow-IGMP"
meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . no-route, mld-listener-report . no-route, mld-listener-done . no-route, mld2-listener-report . no-route } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second counter packets 2 bytes 104 accept comment "!fw4: Allow-ICMPv6-Input"
icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 78 bytes 5408 accept comment "!fw4: Allow-ICMPv6-Input"
ip saddr 192.168.0.0/24 tcp dport 22 counter packets 0 bytes 0 accept comment "!fw4: NOWTV SSH"
ip saddr 192.168.0.0/24 udp dport 22 counter packets 0 bytes 0 accept comment "!fw4: NOWTV SSH"
ip saddr 192.168.0.0/24 tcp dport 80 counter packets 0 bytes 0 accept comment "!fw4: NOWTV ADMIN"
ip saddr 192.168.0.0/24 udp dport 80 counter packets 0 bytes 0 accept comment "!fw4: NOWTV ADMIN"
jump reject_from_wan
}
chain output_wan {
jump accept_to_wan
}
chain forward_wan {
icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
jump reject_to_wan
}
chain accept_to_wan {
meta nfproto ipv4 oifname { "wan", "tun0", "tun1", "tun2", "tun3" } ct state invalid counter packets 793 bytes 76299 drop comment "!fw4: Prevent NAT leakage"
oifname { "wan", "tun0", "tun1", "tun2", "tun3" } counter packets 6816 bytes 1223766 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
}
chain reject_from_wan {
iifname { "wan", "tun0", "tun1", "tun2", "tun3" } counter packets 878 bytes 166776 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}
chain reject_to_wan {
oifname { "wan", "tun0", "tun1", "tun2", "tun3" } counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}
chain input_FR {
jump reject_from_FR
}
chain output_FR {
jump reject_to_FR
}
chain forward_FR {
jump accept_to_FR
}
chain accept_to_FR {
meta nfproto ipv4 oifname "tun0" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
oifname "tun0" counter packets 0 bytes 0 accept comment "!fw4: accept FR IPv4/IPv6 traffic"
}
chain reject_from_FR {
iifname "tun0" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject FR IPv4/IPv6 traffic"
}
chain reject_to_FR {
oifname "tun0" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject FR IPv4/IPv6 traffic"
}
chain input_HK {
jump reject_from_HK
}
chain output_HK {
jump reject_to_HK
}
chain forward_HK {
jump accept_to_HK
}
chain accept_to_HK {
meta nfproto ipv4 oifname "tun1" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
oifname "tun1" counter packets 0 bytes 0 accept comment "!fw4: accept HK IPv4/IPv6 traffic"
}
chain reject_from_HK {
iifname "tun1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject HK IPv4/IPv6 traffic"
}
chain reject_to_HK {
oifname "tun1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject HK IPv4/IPv6 traffic"
}
chain input_US {
jump reject_from_US
}
chain output_US {
jump reject_to_US
}
chain forward_US {
jump accept_to_US
}
chain accept_to_US {
meta nfproto ipv4 oifname "tun3" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
oifname "tun3" counter packets 0 bytes 0 accept comment "!fw4: accept US IPv4/IPv6 traffic"
}
chain reject_from_US {
iifname "tun3" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject US IPv4/IPv6 traffic"
}
chain reject_to_US {
oifname "tun3" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject US IPv4/IPv6 traffic"
}
chain input_UK {
jump reject_from_UK
}
chain output_UK {
jump reject_to_UK
}
chain forward_UK {
jump accept_to_UK
}
chain accept_to_UK {
meta nfproto ipv4 oifname "tun2" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
oifname "tun2" counter packets 0 bytes 0 accept comment "!fw4: accept UK IPv4/IPv6 traffic"
}
chain reject_from_UK {
iifname "tun2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject UK IPv4/IPv6 traffic"
}
chain reject_to_UK {
oifname "tun2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject UK IPv4/IPv6 traffic"
}
chain dstnat {
type nat hook prerouting priority dstnat; policy accept;
jump upnp_prerouting comment "Hook into miniupnpd prerouting chain"
}
chain srcnat {
type nat hook postrouting priority srcnat; policy accept;
oifname { "wan", "tun0", "tun1", "tun2", "tun3" } jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
oifname "tun0" jump srcnat_FR comment "!fw4: Handle FR IPv4/IPv6 srcnat traffic"
oifname "tun1" jump srcnat_HK comment "!fw4: Handle HK IPv4/IPv6 srcnat traffic"
oifname "tun3" jump srcnat_US comment "!fw4: Handle US IPv4/IPv6 srcnat traffic"
oifname "tun2" jump srcnat_UK comment "!fw4: Handle UK IPv4/IPv6 srcnat traffic"
jump upnp_postrouting comment "Hook into miniupnpd postrouting chain"
}
chain srcnat_wan {
meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
}
chain srcnat_FR {
meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 FR traffic"
}
chain srcnat_HK {
meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 HK traffic"
}
chain srcnat_US {
meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 US traffic"
}
chain srcnat_UK {
meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 UK traffic"
}
chain raw_prerouting {
type filter hook prerouting priority raw; policy accept;
}
chain raw_output {
type filter hook output priority raw; policy accept;
}
chain mangle_prerouting {
type filter hook prerouting priority mangle; policy accept;
jump pbr_prerouting comment "Jump into pbr prerouting chain"
}
chain mangle_postrouting {
type filter hook postrouting priority mangle; policy accept;
jump pbr_postrouting comment "Jump into pbr postrouting chain"
}
chain mangle_input {
type filter hook input priority mangle; policy accept;
jump pbr_input comment "Jump into pbr input chain"
}
chain mangle_output {
type route hook output priority mangle; policy accept;
jump pbr_output comment "Jump into pbr output chain"
}
chain mangle_forward {
type filter hook forward priority mangle; policy accept;
iifname { "wan", "tun0", "tun1", "tun2", "tun3" } tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
oifname { "wan", "tun0", "tun1", "tun2", "tun3" } tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
iifname "tun0" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone FR IPv4/IPv6 ingress MTU fixing"
oifname "tun0" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone FR IPv4/IPv6 egress MTU fixing"
iifname "tun3" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone US IPv4/IPv6 ingress MTU fixing"
oifname "tun3" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone US IPv4/IPv6 egress MTU fixing"
iifname "tun2" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone UK IPv4/IPv6 ingress MTU fixing"
oifname "tun2" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone UK IPv4/IPv6 egress MTU fixing"
jump pbr_forward comment "Jump into pbr forward chain"
}
chain upnp_forward {
}
chain upnp_prerouting {
}
chain upnp_postrouting {
}
chain pbr_forward {
}
chain pbr_input {
}
chain pbr_output {
}
chain pbr_prerouting {
}
chain pbr_postrouting {
}
chain pbr_mark_0x010000 {
counter packets 0 bytes 0 meta mark set meta mark & 0xff01ffff | 0x00010000
return
}
}
network.loopback=interface
network.loopback.device='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd57:ae91:028f::/48'
network.@device[0]=device
network.@device[0].name='br-lan'
network.@device[0].type='bridge'
network.@device[0].ports='lan1' 'lan2' 'lan3' 'lan4'
network.lan=interface
network.lan.device='br-lan'
network.lan.proto='static'
network.lan.ipaddr='192.168.7.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.@device[1]=device
network.@device[1].name='wan'
network.@device[1].macaddr='62:38:e0:c9:9e:f0'
network.wan=interface
network.wan.device='wan'
network.wan.proto='dhcp'
network.wan6=interface
network.wan6.device='wan'
network.wan6.proto='dhcpv6'
network.fr=interface
network.fr.proto='none'
network.fr.delegate='0'
network.fr.device='tun0'
network.hk=interface
network.hk.proto='none'
network.hk.delegate='0'
network.hk.device='tun1'
network.uk=interface
network.uk.proto='none'
network.uk.delegate='0'
network.uk.device='tun2'
network.us=interface
network.us.proto='none'
network.us.delegate='0'
network.us.device='tun3'
firewall.@defaults[0]=defaults
firewall.@defaults[0].input='REJECT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].network='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[0].device='tun0'
firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].network='wan' 'wan6'
firewall.@zone[1].input='REJECT'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='REJECT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@zone[1].device='tun0' 'tun1' 'tun2' 'tun3'
firewall.lan_wan=forwarding
firewall.lan_wan.src='lan'
firewall.lan_wan.dest='wan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.miniupnpd=include
firewall.miniupnpd.type='script'
firewall.miniupnpd.path='/usr/share/miniupnpd/firewall.include'
firewall.@rule[9]=rule
firewall.@rule[9].name='NOWTV SSH'
firewall.@rule[9].target='ACCEPT'
firewall.@rule[9].src='wan'
firewall.@rule[9].src_ip='192.168.0.0/24'
firewall.@rule[9].dest_port='22'
firewall.@rule[9].family='ipv4'
firewall.@rule[10]=rule
firewall.@rule[10].name='NOWTV ADMIN'
firewall.@rule[10].src='wan'
firewall.@rule[10].src_ip='192.168.0.0/24'
firewall.@rule[10].dest_port='80'
firewall.@rule[10].target='ACCEPT'
firewall.@rule[10].family='ipv4'
firewall.@zone[2]=zone
firewall.@zone[2].input='REJECT'
firewall.@zone[2].forward='ACCEPT'
firewall.@zone[2].output='REJECT'
firewall.@zone[2].masq='1'
firewall.@zone[2].mtu_fix='1'
firewall.@zone[2].name='FR'
firewall.@zone[2].network='fr'
firewall.@forwarding[1]=forwarding
firewall.@forwarding[1].src='lan'
firewall.@forwarding[1].dest='FR'
firewall.@zone[3]=zone
firewall.@zone[3].name='HK'
firewall.@zone[3].input='REJECT'
firewall.@zone[3].output='REJECT'
firewall.@zone[3].forward='ACCEPT'
firewall.@zone[3].masq='1'
firewall.@zone[3].network='hk'
firewall.@forwarding[2]=forwarding
firewall.@forwarding[2].src='lan'
firewall.@forwarding[2].dest='HK'
firewall.@zone[4]=zone
firewall.@zone[4].input='REJECT'
firewall.@zone[4].forward='ACCEPT'
firewall.@zone[4].output='REJECT'
firewall.@zone[4].masq='1'
firewall.@zone[4].mtu_fix='1'
firewall.@zone[4].name='US'
firewall.@zone[4].network='us'
firewall.@forwarding[3]=forwarding
firewall.@forwarding[3].src='lan'
firewall.@forwarding[3].dest='US'
firewall.@zone[5]=zone
firewall.@zone[5].input='REJECT'
firewall.@zone[5].forward='ACCEPT'
firewall.@zone[5].output='REJECT'
firewall.@zone[5].masq='1'
firewall.@zone[5].mtu_fix='1'
firewall.@zone[5].name='UK'
firewall.@zone[5].network='uk'
firewall.@forwarding[4]=forwarding
firewall.@forwarding[4].src='lan'
firewall.@forwarding[4].dest='UK'
firewall.pbr=include
firewall.pbr.fw4_compatible='1'
firewall.pbr.type='script'
firewall.pbr.path='/usr/share/pbr/pbr.firewall.include'
openvpn.FR=openvpn
openvpn.FR.config='/etc/openvpn/NordVPN/fr.ovpn'
openvpn.FR.enabled='1'
openvpn.US=openvpn
openvpn.US.config='/etc/openvpn/NordVPN/us.ovpn'
openvpn.US.enabled='1'
openvpn.HK=openvpn
openvpn.HK.config='/etc/openvpn/NordVPN/hk.ovpn'
openvpn.UK=openvpn
openvpn.UK.config='/etc/openvpn/NordVPN/uk.ovpn'
head: /etc/openvpn/*.conf: No such file or directory