Policy based routing is not working as expected

Installing and Using OpenWrt Network and Wireless Configuration
1

I'm struggling to make it work the policy based routing package

OpenWRT version: LuCI openwrt-23.05 branch (git-24.073.29889-cd7e519) / OpenWrt 23.05.3 (r23809-234f1a2efa)
Router: ZTE mf283+

Screenshot from luci GUI pbr:

image
image1170×856 46.7 KB

Here is my config of pbr:

root@OpenWrt:~# cat /etc/config/pbr

config pbr 'config'
        option enabled '1'
        option verbosity '2'
        option strict_enforcement '1'
        option resolver_set 'none'
        option ipv6_enabled '0'
        list ignored_interface 'vpnserver'
        list ignored_interface 'wgserver'
        option boot_timeout '30'
        option rule_create_option 'add'
        option procd_reload_delay '1'
        option webui_show_ignore_target '0'
        list webui_supported_protocol 'all'
        list webui_supported_protocol 'tcp'
        list webui_supported_protocol 'udp'
        list webui_supported_protocol 'tcp udp'
        list webui_supported_protocol 'icmp'

config include
        option path '/usr/share/pbr/pbr.user.aws'
        option enabled '0'

config include
        option path '/usr/share/pbr/pbr.user.netflix'
        option enabled '0'

config policy
        option name 'Ip info'
        option dest_addr 'ipinfo.io'
        option interface 'wan2'
        option dest_port '443'
        option proto 'tcp'

config policy
        option name 'Ifconfig.me'
        option dest_addr 'ifconfig.me'
        option dest_port '443'
        option proto 'tcp'
        option interface 'wan2'

my network interfaces config:

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd86:21cb:520e::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '6t 2 3'
        option description 'LAN'

config device
        option name 'phy0-sta0'

config interface 'wan'
        option proto 'dhcp'
        option device 'eth0.2'
        option metric '10'
        option type 'bridge'

config switch_vlan
        option device 'switch0'
        option ports '6t 0'
        option vlan '2'
        option description 'WAN'

config switch_vlan
        option device 'switch0'
        option ports '6t 1'
        option vlan '3'
        option description 'WAN 2'

config device
        option name 'wwan0'

config device
        option name 'eth0.3'
        option type '8021q'
        option ifname 'eth0'
        option vid '3'

config interface 'wan2'
        option proto 'dhcp'
        option device 'eth0.3'
        option metric '20'
        option type 'bridge'

My problem is that policy i created is not working, i try to visit the ipinfo.io and ifconfig.me then i get the wan ip instead of the wan2 ip basically i doesn't work, also i'm connected through wireless

2

Please check

nft list ruleset | grep "xt_"

And install missing nftables mods to avoid xt bridge offloads
[https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables]

sorry edited in front of your eyes

3

its empty

root@OpenWrt:~# nft list ruleset | grep "xt "
root@OpenWrt:~#
4

Its underscore not space, sorry, try again...

5

its empty

root@OpenWrt:~# nft list ruleset | grep "xt_"
root@OpenWrt:~#
6

I'd advise you use resolver set support for domain names. I'm pretty sure README already contains that information, maybe you should peruse that.

7

I managed to make it worked, but i have problem which i created topic after this