I have a fairly standard test setup.
Mullvad client with default route via Mullvad
This is the script I test with, nothing else is enabled for PBR.
I added ipchicken.com to the script for testing.
#!/bin/sh
# This file is heavily based on code from https://github.com/Xentrk/netflix-vpn-bypass/blob/master/IPSET_Netflix.sh
# Credits to https://forum.openwrt.org/u/dscpl for api.hackertarget.com code.
# Credits to https://github.com/kkeker and https://github.com/tophirsch for api.bgpview.io code.
TARGET_INTERFACE='wan'
TARGET_NFTSET_4="pbr_${TARGET_INTERFACE}_4_dst_ip_user"
TARGET_NFTSET_6="pbr_${TARGET_INTERFACE}_6_dst_ip_user"
TARGET_TABLE='inet fw4'
TARGET_ASN='2906'
TARGET_DL_FILE_4="/var/pbr_tmp_AS${TARGET_ASN}.ipv4"
# Uncomment the following line if you enabled ipv6 for pbr and want IPv6 entries added to the IPv6 set
# TARGET_DL_FILE_6="/var/pbr_tmp_AS${TARGET_ASN}.ipv6"
DB_SOURCE='ipinfo.io'
#DB_SOURCE='api.hackertarget.com'
#DB_SOURCE='api.bgpview.io'
REGEX_IPV4='[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\/[0-9]\{1,\}'
REGEX_IPV6='.*::.*'
_ret=0
if [ ! -s "$TARGET_DL_FILE_4" ]; then
if [ "$DB_SOURCE" = "ipinfo.io" ]; then
TARGET_URL="https://ipinfo.io/AS${TARGET_ASN}"
uclient-fetch --no-check-certificate -qO- "$TARGET_URL" 2>/dev/null | sed -n "s|\(.*\)/AS${TARGET_ASN}/\($REGEX_IPV4\)\"|\2|p" > "$TARGET_DL_FILE_4"
fi
if [ "$DB_SOURCE" = "api.hackertarget.com" ]; then
TARGET_URL="https://api.hackertarget.com/aslookup/?q=AS${TARGET_ASN}"
uclient-fetch --no-check-certificate -qO- "$TARGET_URL" 2>/dev/null | sed '1d' > "$TARGET_DL_FILE_4"
fi
if [ "$DB_SOURCE" = "api.bgpview.io" ]; then
TARGET_URL="https://api.bgpview.io/asn/${TARGET_ASN}/prefixes"
uclient-fetch --no-check-certificate -qO- "$TARGET_URL" 2>/dev/null | jsonfilter -e '@.data.ipv4_prefixes[*].prefix' > "$TARGET_DL_FILE_4"
fi
fi
if [ -s "$TARGET_DL_FILE_4" ]; then
params=
while read -r p; do params="${params:+$params, }${p}"; done < "$TARGET_DL_FILE_4"
[ -n "$params" ] && nft "add element $TARGET_TABLE $TARGET_NFTSET_4 { $params }" || _ret=1
#egc test rule for ipleak.net 95.85.16.212 and whatismyip.com: 172.66.40.87, 172.66.43.169 , ipchicken: 104.26.7.112, 104.26.6.112, 172.67.68.101
# NOTE these are subjetc to change so alwasy do an ndslookup to verify currenlty added ipchicken.com
nft "add element $TARGET_TABLE $TARGET_NFTSET_4 { 104.26.7.112, 104.26.6.112, 172.67.68.101 }"
fi
if [ -n "$TARGET_DL_FILE_6" ] && [ ! -s "$TARGET_DL_FILE_6" ]; then
if [ "$DB_SOURCE" = "ipinfo.io" ]; then
TARGET_URL="https://ipinfo.io/AS${TARGET_ASN}"
uclient-fetch --no-check-certificate -qO- "$TARGET_URL" 2>/dev/null | sed -n "s|\(.*\)/AS${TARGET_ASN}/\($REGEX_IPV6\)\"|\2|p" > "$TARGET_DL_FILE_6"
fi
fi
if [ -s "$TARGET_DL_FILE_6" ]; then
params=
while read -r p; do params="${params:+$params, }${p}"; done < "$TARGET_DL_FILE_6"
[ -n "$params" ] && nft "add element $TARGET_TABLE $TARGET_NFTSET_6 { $params }" || _ret=1
fi
return $_ret
nftl list ruleset shows all chains are made and targeted and when surfing to ipchicken.com from a LAN client (this is prerouting so only works for a LAN client) I see my WAN ip address.
chain pbr_prerouting {
ip daddr @pbr_wan_4_dst_ip_user counter packets 33 bytes 5127 goto pbr_mark_0x010000
ip6 daddr @pbr_wan_6_dst_ip_user counter packets 0 bytes 0 goto pbr_mark_0x010000
ip saddr @pbr_wan_4_src_ip_user counter packets 0 bytes 0 goto pbr_mark_0x010000
ip6 saddr @pbr_wan_6_src_ip_user counter packets 0 bytes 0 goto pbr_mark_0x010000
ether saddr @pbr_wan_4_src_mac_user counter packets 0 bytes 0 goto pbr_mark_0x010000
ether saddr @pbr_wan_6_src_mac_user counter packets 0 bytes 0 goto pbr_mark_0x010000
ip daddr @pbr_mullvad_se_4_dst_ip_user counter packets 0 bytes 0 goto pbr_mark_0x020000
ip6 daddr @pbr_mullvad_se_6_dst_ip_user counter packets 0 bytes 0 goto pbr_mark_0x020000
ip saddr @pbr_mullvad_se_4_src_ip_user counter packets 0 bytes 0 goto pbr_mark_0x020000
ip6 saddr @pbr_mullvad_se_6_src_ip_user counter packets 0 bytes 0 goto pbr_mark_0x020000
ether saddr @pbr_mullvad_se_4_src_mac_user counter packets 0 bytes 0 goto pbr_mark_0x020000
ether saddr @pbr_mullvad_se_6_src_mac_user counter packets 0 bytes 0 goto pbr_mark_0x020000
}
You can see the counter for ipchicken.com 04.26.6.112 counter packets 18 bytes 4540 being hit
set pbr_wan_4_dst_ip_user {
type ipv4_addr
flags interval
counter
auto-merge
comment ""
elements = { 23.246.0.0/18 counter packets 0 bytes 0, 37.77.184.0/21 counter packets 0 bytes 0,
45.57.0.0/17 counter packets 0 bytes 0, 104.26.6.112 counter packets 18 bytes 4540,
104.26.7.112 counter packets 0 bytes 0, 108.175.32.0/20 counter packets 0 bytes 0,
172.67.68.101 counter packets 0 bytes 0, 185.2.220.0/22 counter packets 0 bytes 0,
185.9.188.0/22 counter packets 0 bytes 0, 192.173.64.0/18 counter packets 0 bytes 0,
198.38.96.0/19 counter packets 0 bytes 0, 198.45.48.0/20 counter packets 0 bytes 0,
207.45.72.0/22 counter packets 0 bytes 0, 208.75.76.0/22 counter packets 0 bytes 0 }
when I have more time I will take a look into your script
