@stangri Thank you for PBR once again.
There's just a couple of things ive noticed.
Firstly, in the README, (unless i missed it) i dont see anywhere where you talk about a Killswitch in PBR in its default mode when a LAN device has a policy to WG, if "strictly enforce policies when their gateway is down" ACTUALLY means this is an actual Killswitch which really, does what it says and indeed there is no traffic unless WG is connected. Is there a reason you dont state this in the README? The only thing stated is that PBR doesnt support a Killswitch in router mode, and that footnote is a bit confusing when someone first reads it.
Secondly, i noticed an ISP IP leak to any device that has a policy to WG when the router boots up just before pbr starts up and just after the network is up, so for about 10 seconds the real IP is leaked to these devices.
I managed to fix this by adding 2 custom service scripts which start on bootup and basically blocks the WAN Output before pbr starts, for anyone who is interested here they are:
Stage 1: The early kill switch script (S20)
This script runs after the main firewall service has started but before the network interfaces are fully up, implementing a strict DROP policy.
vi /etc/init.d/S20-pbr-early-killswitch
S20-pbr-early-killswitch
#!/bin/sh /etc/rc.common
# This script creates an early kill switch that blocks all traffic
# until the PBR watchdog script removes it.
START=20
STOP=90
start() {
logger -t pbr-early-killswitch "Applying PBR early kill switch..."
uci set firewall.@zone[2].output='DROP'
uci commit firewall
/etc/init.d/firewall restart
logger -t pbr-early-killswitch "PBR early kill switch active."
}
stop() {
# The watchdog script will trigger a firewall reload,
# which automatically removes the rules added here.
logger -t pbr-early-killswitch "PBR early kill switch stop called. Firewall will be reloaded."
}
Prepare script:
chmod +x /etc/init.d/S20-pbr-early-killswitch
/etc/init.d/S20-pbr-early-killswitch enable
Stage 2: The PBR watchdog script (S99)
This script runs later in the boot process. It continuously checks for the PBR's VPN interface to be active. When it is, the script reloads the firewall, removing the kill switch and allowing normal PBR routing.
vi /etc/init.d/S99-pbr-watchdog
S99-pbr-watchdog
#!/bin/sh /etc/rc.common
# This script waits for the PBR VPN interface to come up,
# then reloads the firewall to disable the early kill switch.
START=99
STOP=10
INTERFACE="wg0" # <<< Set this to your PBR's VPN interface
start() {
logger -t pbr-watchdog "Starting PBR watchdog. Waiting for interface $INTERFACE..."
# Loop and wait for the VPN interface to be detected and up
while true; do
if ip link show "$INTERFACE" 2>/dev/null | grep -q ",UP,"; then
break
fi
sleep 5
done
sleep 5
logger -t pbr-watchdog "Interface $INTERFACE is up. Reloading firewall to remove early kill switch."
# Reloading the firewall causes it to flush all existing rules
# and re-apply the full configuration, including PBR rules.
uci set firewall.@zone[2].output='ACCEPT'
uci commit firewall
/etc/init.d/firewall restart
logger -t pbr-watchdog "PBR watchdog finished. Kill switch disengaged."
}
stop() {
: # This script is a one-shot process and does not need a complex stop handler.
}
Prepare script:
chmod +x /etc/init.d/S99-pbr-watchdog
/etc/init.d/S99-pbr-watchdog enable
reboot
To test this working, on CLI from a LAN device thats on pbr, keep entering the following: curl wtfismyip.com/text few seconds after router bootup until your WG connects
If there is anyone that knows the equivalent firewall rule in nftables, that i think would be better and faster than using UCI.
If this issue can somehow be fixed on pbr to stop bootup IP leaks, before pbr starts, then it would be great to do without these scripts.
