PBR failure to setup with 2 VPNs

Installing and Using OpenWrt Network and Wireless Configuration
1

I am setting up 2 OpenVPN Clients on the router, leveraging PBR. When I set the first one, all is fine and the PBR runs perfectly. After setting the second one in the same exact way, I get this error. I can browse the internet, but the location for the VPN is random.

Is there anything else missing I shall install?

Failed to set up 'wan/192.168.70.254'!
Failed to set up 'tunuk/tun0/10.8.0.2'!
Failed to set up 'tunsw/tun1/10.8.0.2'!
Failed to set up any gateway!

PBR Configuration:

config pbr 'config'
        option verbosity '2'
        option strict_enforcement '1'
        option ipv6_enabled '0'
        list ignored_interface 'vpnserver'
        list ignored_interface 'wgserver'
        option boot_timeout '30'
        option rule_create_option 'add'
        option procd_reload_delay '1'
        option webui_show_ignore_target '0'
        list webui_supported_protocol 'all'
        list webui_supported_protocol 'tcp'
        list webui_supported_protocol 'udp'
        list webui_supported_protocol 'tcp udp'
        list webui_supported_protocol 'icmp'
        option resolver_set 'none'
        option enabled '1'
        list supported_interface 'tunuk'
        list supported_interface 'tunsw'

config include
        option path '/usr/share/pbr/pbr.user.aws'
        option enabled '0'

config include
        option path '/usr/share/pbr/pbr.user.netflix'
        option enabled '0'

config policy
        option name 'Plex/Emby Local Server'
        option interface 'wan'
        option src_port '8096 8920 32400'
        option enabled '0'

config policy
        option name 'Plex/Emby Remote Servers'
        option interface 'wan'
        option dest_addr 'plex.tv my.plexapp.com emby.media app.emby.media tv.emby.media'
        option enabled '0'

config policy
        option name 'WireGuard Server'
        option interface 'wan'
        option src_port '51820'
        option chain 'output'
        option proto 'udp'
        option enabled '0'

config policy
        option name 'VPNUK'
        option src_addr '192.168.2.1/24'
        option interface 'tunuk'

config policy
        option name 'VPNSW'
        option src_addr '192.168.3.1/24'
        option interface 'tunsw'

Network Configuration

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fdbc:c17a:44c1::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'br-uk'
        list ports 'wlan1-1'

config interface 'intuk'
        option proto 'static'
        option device 'br-uk'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config interface 'tunuk'
        option proto 'none'
        option device 'tun0'
        option auto '0'

config device
        option type 'bridge'
        list ports 'wlan1-2'
        option name 'br-sw'

config interface 'intsw'
        option proto 'static'
        option device 'br-sw'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.0'

config interface 'tunsw'
        option proto 'none'
        option device 'tun1'
        option auto '0'
2

Thanks to this article I found the issue: (https://www.leowkahman.com/2016/06/19/conditional-multiple-openvpn-routing-hostname-ip/)

The 2 VPNs shall not have the same IPs.

1 Like
3

Yes, this is not a problem of PBR only, but a router in general cannot have the same network in different interfaces.

2 Likes