Policy-Based-Routing (pbr) package discussion

powtrix · 2024-10-26T15:47:33.068Z

The interface ovpn0 or tun0 didnt list as valid interfaces in current version.

See restart output:

pbr.cfg0c6ff5.name=hub-usb-exboom validates as string with true
pbr.cfg0c6ff5.enabled is unset and defaults to bool 1
pbr.cfg0c6ff5.interface=tun0 validates as or("ignore", "tor", regex("xray_.*"), uci("network", "@interface")) with false
pbr.cfg0c6ff5.proto is unset and defaults to or(string) (null)
pbr.cfg0c6ff5.chain is unset and defaults to or("", "forward", "input", "output", "prerouting", "postrouting", "FORWARD", "INPUT", "OUTPUT", "PREROUTING", "POSTROUTING") prerouting
pbr.cfg0c6ff5.src_addr=00:e0:4c:xx.xx.xx validates as list(neg(or(host,network,macaddr,string))) with true
pbr.cfg0c6ff5.src_port is unset and defaults to list(neg(or(portrange,string))) (null)
pbr.cfg0c6ff5.dest_addr is unset and defaults to list(neg(or(host,network,string))) (null)
pbr.cfg0c6ff5.dest_port is unset and defaults to list(neg(or(portrange,string))) (null)
Routing 'hub-usb-exboom' via  [✗]

Interface:

root@GT-AC5300:~# uci show network.ovpn0
network.ovpn0=interface
network.ovpn0.proto='none'
network.ovpn0.device='tun0'
network.ovpn0.delegate='0'

mets · 2024-10-26T16:11:07.167Z

I will provide debug info at my first opportunity.
The 1.1.7-29 release has killed domain name based routing by pbr for me. Will advise.

stangri · 2024-10-26T16:56:35.981Z

mori:

As you may already know, /etc/init.d/dnsmasq in dnsmasq 2.90-r3 seems to be trying to load a directory for each dnsmasq instance, such as /tmp/dnsmasq.cfg01411c.d, rather than the /tmp/dnsmasq.d directory.

Thank you for bringing this to my attention, I've left a comment on the PR which included the change, I strongly feel we should bring back the default confdir inclusion in all instances. Let's see what transpires before I make any changes.

stangri · 2024-10-26T17:00:25.458Z

O-S-T:

Error on reload with policy "ip test"

This doesn't seem to be policy-related, I may have not cherry-picked the fix for "reload" for the release version. Can you try service pbr restart instead?

stangri · 2024-10-26T17:02:31.370Z

powtrix:

The interface ovpn0 or tun0 didnt list as valid interfaces in current version.

Please post everything included in README->Getting Help. If you could also try to include the OpenVPN interface in supported interfaces and see if it validates there, it would help. I actually haven't touched the validation part of the code in a while so I'm confused as to why this changed for you. Which version did you upgrade from?

stangri · 2024-10-26T17:07:44.785Z

mori:

I did it. but opkg likes r21 rather than 29, I think

Yes, any package release with the r prefix is considered to be higher than any package release without the r. The back story of this is that for the APK support the build system for snapshots now adds r to all package release versions (while the APK is not a default package manager even for snapshots and most likely won't even be an option for 24.xx), while the current release (23.05) build tools create packages without the r in the package release.

You can try opkg install --force-downgrade /tmp/*.ipk.

stangri · 2024-10-26T17:09:59.785Z

Sorry about:

Multiple replies instead of one reply with multiple answers -- my browser is weirdly crashing on a lot of things and I didn't have time to look into it before replying.
Potentially missing something which needs my attention, post again (with the output from README->Getting Help).
Dragging my feet about implementing @egc's IPv6 fixes, I hope to do something about it this weekend.

mets · 2024-10-26T17:17:53.901Z

So it appears my issue was caused by DNS lookups not hitting the dnsmasq-full on the router but an alternate recursor on the network. Will confirm.

O-S-T · 2024-10-26T18:02:25.315Z

thank you. Some fantastic advice, I have made the amendments you suggested.

I have disabled the static route for my wireguard DNS and set a pbr policy for "remote address" 100.64.0.4/32 to go through interface mv1 (VPN DNS server) but now all my DNS requests are going through the wan interface, (1.1.1.1)

Unfortunately setting the time delay hasn't fixed the problem.
I can also look to upgrade the pbr version if this is likely the cause.

Screenshot_2024-10-26_19-01-351086×501 47.5 KB

O-S-T · 2024-10-26T18:17:48.255Z

stangri:

service pbr restart

Hi, thank you for your help.

with "ip test" policy enabled an aforementioned option delay to pbr config.

service pbr restart

root@OpenWrt:~# service pbr restart
Removing routing for 'wan/pppoe-wan/#########' [✓]
Removing routing for 'mv1/#########' [✓]
Restarting dnsmasq [✓]
pbr 1.1.6-22 (fw4 nft file mode) stopped [✓]
Using wan interface (on_start): wan 
Found wan gateway (on_start): ########## 
Setting up routing for 'wan/pppoe-wan/##########' [✓]
Setting up routing for 'mv1/#######' [✓]
Routing 'Ignore Local Requests' via wan [✓]
Routing 'WGserver' via mv1 [✓]
Routing 'mv_dns' via mv1 [✓]
Routing 'LAN' via mv1 [✓]
Routing 'ip test' via wan [✓]
Running /usr/share/pbr/pbr.user.wg_server_and_client [✓]
Installing fw4 nft file [✓]
pbr 1.1.6-22 monitoring interfaces: wan mv1 
pbr 1.1.6-22 (fw4 nft file mode) started with gateways:
wan/pppoe-wan/############# [✓]
mv1/###########

however "ip test" policy still being ignored, website https://www.dnsleaktest.com shows my vpn ip when the policy was to go though wan.

also from a PC on my network:
dig yahoo.com | grep time

;; communications error to 192.168.0.1#53: timed out
;; Query time: 36 msec

egc · 2024-10-26T18:47:25.205Z

I assume that you have set 1.1.1.1 as DNS interface on the WAN?
Now both 1.1.1.1 and 100.64.0.4 should be used as DNS forwarder by DNS.
You can check this with logread -e dnsmasq | grep nameserver

DNSMasq will use the quickest so that could be 1.1.1.1

You can opt to remove the WAN DNS (1.1.1.1) but the 100.64.0.4 DNS server is only available after the tunnel is up and for the tunnel to go up you need proper DNS for NTP and resolving of domain names so that is not an option.

There are scripts which replace the used DNS server(s) with only the WG DNS server after the tunnel is up, but it is easier to use DNS policies within PBR to designate a specific DNS server to a specific LAN device or whole interface.
Check if DNS policies are available for you in the PBR GUI.

As noted this is not compatible with a DNS hijacking rule!

O-S-T · 2024-10-26T19:03:49.142Z

egc:

logread -e dnsmasq | grep nameserver

thank you. i was hoping to just use pbr for dns policy, keeping the complexity to a minimum. i assume my use case is fairly typical / simple.

i am debting a fresh install of openwrt as I have previously installed and removed adguard home and currently have adblock installed but disabled for configuration.

I suppose its possible that some residual config wth AGH has remained and is messing up the correct function of my DNS resolvers.

 logread -e dnsmasq | grep nameserver
Sat Oct 26 17:13:55 2024 daemon.info dnsmasq[1]: using nameserver 100.64.0.4#53
Sat Oct 26 17:13:55 2024 daemon.info dnsmasq[1]: using nameserver 1.1.1.1#53
Sat Oct 26 17:15:21 2024 daemon.info dnsmasq[1]: using nameserver 100.64.0.4#53
Sat Oct 26 17:15:21 2024 daemon.info dnsmasq[1]: using nameserver 1.1.1.1#53
Sat Oct 26 17:49:32 2024 daemon.info dnsmasq[1]: using nameserver 100.64.0.4#53
Sat Oct 26 17:49:32 2024 daemon.info dnsmasq[1]: using nameserver 1.1.1.1#53

egc · 2024-10-26T19:05:56.757Z

That looks good.
Just use PBR DNS policies (if available in your build) and disable the DNS hijacking rule

egc · 2024-10-26T19:10:46.784Z

Found it I think:
In 1.1.6-20 there are two functions uci_get_device()

uci_get_device() { uci_get 'network' "$1" 'device' || uci_get 'network' "$1" 'dev'; }

and

uci_get_device() {
	local __tmp
	__tmp="$(uci_get 'network' "$2" 'device')"
	[ -z "$__tmp" ] && unset "$1" && return 1
	eval "$1=$__tmp"
}

The latter one has disappeared in later builds and it looks like that is the correct one

powtrix · 2024-10-26T21:49:02.512Z

I upgraded from custom feed: src/gz stangri_repo https://repo.openwrt.melmac.net - pbr and luci-app-pbr, and it was working on previous version.

the current settings:

system board

{
	"kernel": "5.15.167",
	"hostname": "GT-AC5300",
	"system": "ARMv8 Processor rev 0",
	"model": "Asus GT-AC5300",
	"board_name": "asus,gt-ac5300",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.5",
		"revision": "r24106-10cc5fcd00",
		"target": "bcm4908/generic",
		"description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
	}
}

dhcp

package dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option local '/lan/'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '0'
	option confdir '/tmp/dnsmasq.d'
	option domain 'trix.lan'
	option port '53'
	option localuse '1'
	option proxydnssec '1'
	option noresolv '1'
	list notinterface 'wan'
	option nonegcache '1'
	option strictorder '1'
	option dnsseccheckunsigned '0'
	option quietdhcp '1'
	list server '127.0.0.53' # dnscrypt-proxy2
	list interface 'lan'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list dhcp_option '42,192.168.100.1'
	list dhcp_option '6,192.168.100.1'
	option leasetime '10m'
	option ra_useleasetime '1'
	option ndp 'hybrid'
	option preferred_lifetime '5m'
	option force '1'
	option ra_default '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
	option ra_useleasetime '0'

config host
	option name 'xxx-wire'
	option dns '1'
	option mac 'D8:77:8B:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wire'
	option dns '1'
	option mac '80:8f:e8:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wire'
	option dns '1'
	option mac '80:8f:e8:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wire'
	option dns '1'
	option mac '30:e1:f1:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name xxx-sala'
	option dns '1'
	option mac '50:FD:D5:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-quarto1'
	option dns '1'
	option mac '50:FD:D5:9B:B2:82'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wifi'
	option dns '1'
	option mac 'FC:03:9F:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wire'
	option dns '1'
	option mac 'FC:03:9F:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wifi'
	option dns '1'
	option mac '00:25:d3:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wire'
	option dns '1'
	option mac '00:90:f5:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wifi'
	option dns '1'
	option mac 'c8:8a:9a:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wire'
	option dns '1'
	option mac '00:e0:4d:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wifi'
	option dns '1'
	option mac 'F8:16:54:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wire'
	option dns '1'
	option mac 'F8:16:54:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wifi'
	option dns '1'
	option mac '7C:A7:B0:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wire'
	option dns '1'
	option ip '192.168.100.xxx'
	list mac '78:D9:5E:xx.xx.xx'

config host
	option name 'xxx-wifi'
	option dns '1'
	option mac 'd0:6f:4a:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-wire'
	option dns '1'
	option mac 'd0:6f:4a:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-xx'
	option dns '1'
	option ip '192.168.100.xxx'
	list mac '7E:A8:4B:xx.xx.xx'
	list tag 'nordvpn'

config host
	option name 'xxx-xx'
	option dns '1'
	option mac '06:23:45:xx.xx.xx'
	option ip '192.168.100.xxx'

config host
	option name 'xxx-m31'
	option dns '1'
	option mac '68:7d:6b:xx.xx.xx'
	option ip '192.168.100.xxx'

config tag 'nordvpn'
	list dhcp_option '6,10.5.0.1'

firewall

package firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option drop_invalid '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'DROP'
	option masq '1'
	option mtu_fix '1'
	list network 'wan0'
	list network 'wan1'
	list network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Ping (Block)'
	option src 'wan'
	option proto 'icmp'
	option family 'ipv4'
	option target 'DROP'
	list icmp_type 'echo-request'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'vpn'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list device 'ovpn+'
	list device 'wg+'
	list device 'tun+'

config forwarding
	option src 'lan'
	option dest 'vpn'

config redirect 'ntp_lan123'
	option target 'DNAT'
	option name 'NTP (lan, 123)'
	option src 'lan'
	option src_dport '123'
	option proto 'udp'
	option dest_port '123'

config rule
	option name 'Block-zzz'
	option src 'lan'
	list src_ip '192.168.100.zzz'
	option dest '*'
	option target 'DROP'
	option dest_port '16001'

config rule
	option name 'Block MAC on WAN'
	option src 'lan'
	option dest 'wan'
	option target 'REJECT'
	list proto 'all'
	list src_mac '78:D9:5E:zz.zz.zz'
	list src_mac '7C:A7:B0:zz.zz.zz'
	list src_mac 'D0:6F:4A:zz.zz.zz'
	list src_mac 'D0:6F:4A:zz.zz.zz'

config redirect 'adblock_lan53'
	option name 'Adblock DNS (lan, 53)'
	option src 'lan'
	option proto 'tcp udp'
	option src_dport '53'
	option dest_port '53'
	option target 'DNAT'
	option family 'any'

config include 'bcp38'
	option type 'script'
	option path '/usr/lib/bcp38/run.sh'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/firewall.include'

network

package network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fda8:5083:e292::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan2'
	list ports 'lan5'
	list ports 'sw'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.100.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option proto 'pppoe'
	option device 'lan1'
	option keepalive '10 5'
	option username 'xxx'
	option password 'zzz'
	option ipv6 '0'
	option peerdns '0'
	list dns '127.0.0.53'
	option metric '10'
	option demand '0'
	option sourcefilter '0'
	option delegate '0'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'xxxxxxxx...='
	option delegate '0'
	option mtu '1412'
	list addresses '10.2.0.2/24'

config wireguard_wg0
	option description 'xxx-secure-xx'
	option public_key 'xxxxxxxx....='
	list allowed_ips '0.0.0.0/0'
	option endpoint_host 'xxx.xxx.xxx.xxx'
	option endpoint_port '51820'
	option persistent_keepalive '25'

config interface 'ovpn0'
	option proto 'none'
	option device 'tun0'
	option delegate '0'
	list dns '10.5.0.1'

config interface 'ovpn1'
	option proto 'none'
	option device 'tun1'

config interface 'ovpn2'
	option proto 'none'
	option device 'tun2'
	option delegate '0'

config interface 'wan1'
	option proto 'dhcp'
	option device 'lan6'
	option keepalive '5 5'

config device
	option name 'lan6'
	option ipv6 '0'

config device
	option name 'lan1'

pbr

package pbr

config pbr 'config'
	option verbosity '2'
	option strict_enforcement '1'
	option boot_timeout '30'
	option rule_create_option 'add'
	option procd_boot_delay '1'
	option procd_reload_delay '1'
	list webui_supported_protocol 'all'
	list webui_supported_protocol 'tcp'
	list webui_supported_protocol 'udp'
	list webui_supported_protocol 'tcp udp'
	list webui_supported_protocol 'icmp'
	option ipv6_enabled '0'
	option resolver_set 'dnsmasq.nftset'
	option enabled '1'
	option webui_show_ignore_target '1'
	option nft_rule_counter '0'
	option nft_set_auto_merge '1'
	option nft_set_counter '0'
	option nft_set_flags_interval '1'
	option nft_set_flags_timeout '0'
	option nft_set_policy 'performance'
	option procd_wan_interface 'wan'
	list supported_interface 'tun*'
	list supported_interface 'wg*'
	list supported_interface 'ovpn*'

config policy
	option interface 'ignore'
	option name 'default'
	option dest_addr '192.168.100.0/24'

config policy
	option name 'twitter'
	option dest_addr 'file:///data/tools/pbr/lists/twitter.txt'
	option interface 'wg0'
	option enabled '0'

config policy
	option name 'stb-xxx'
	option src_addr '7C:A7:B0:xx.xx.xx 78:D9:5E:xx.xx.xx'
	option interface 'wg0'
	option proto 'tcp udp'

config policy
	option name 'stb-zzz'
	option src_addr 'd0:6f:4a:zz.zz.zz'
	option interface 'wg0'

config include
	option path '/usr/share/pbr/pbr.user.aws'
	option enabled '0'

config include
	option path '/usr/share/pbr/pbr.user.netflix'
	option enabled '0'

config policy
	option name 'cel-zzz'
	option src_addr '06:23:45:zz.zz.zz'
	option interface 'wg0'

config policy
	option name 'pc-zz'
	option src_addr 'c8:8a:9a:xx.xx.xx 00:e0:4d:zz.zz.zz'
	option interface 'wg0'

config policy
	option name 'pc-zzz'
	option src_addr '00:25:D3:zz.zz.zz'
	option interface 'wg0'

config include
	option enabled '0'
	option path '/data/tools/pbr/google1'

config policy
	option name 'hub-usb-exboom'
	option src_addr '00:e0:4c:xx.xx.xx'
	option interface 'tun0'

config policy
	option name 'EA8500'
	option src_addr '14:91:82:xx.xx.xx'
	option interface 'wg0'
	option enabled '0'

config policy
	option name 'pc-zzz'
	option src_addr '00:d7:6d:zz.zz.zz c4:cb:e1:xx.xx.xx'
	option interface 'wg0'

config include
	option enabled '0'
	option path '/data/tools/pbr/cloud'

config include
	option path '/usr/share/pbr/pbr.user.netflix'
	option enabled '0'

config dns_policy
	option name 'Redirect Local IP DNS'
	option src_addr '06:23:45:xx.xx.xx c8:8a:9a:xx.xx.xx 00:e0:4d:xx.xx.xx'
	option dest_dns 'wg0'
	option enabled '0'

pbr.status

root@GT-AC5300:~# /etc/init.d/pbr status

pbr - environment
pbr 1.1.7-29 running on OpenWrt 23.05.5.

Dnsmasq version 2.90  Copyright (c) 2000-2024 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP conntrack no-ipset nftset auth cryptohash DNSSEC no-ID loop-detect inotify dumpfile

pbr fw4 nft file: /usr/share/nftables.d/ruleset-post/30-pbr.nft
add chain inet fw4 pbr_mark_0x010000
add rule inet fw4 pbr_mark_0x010000  mark set mark and 0xff00ffff xor 0x010000
add rule inet fw4 pbr_mark_0x010000 return
add chain inet fw4 pbr_mark_0x020000
add rule inet fw4 pbr_mark_0x020000  mark set mark and 0xff00ffff xor 0x020000
add rule inet fw4 pbr_mark_0x020000 return
add chain inet fw4 pbr_mark_0x030000
add rule inet fw4 pbr_mark_0x030000  mark set mark and 0xff00ffff xor 0x030000
add rule inet fw4 pbr_mark_0x030000 return
add rule inet fw4 pbr_prerouting ip daddr { 192.168.100.0/24 }  return comment "default"
add rule inet fw4 pbr_prerouting ether saddr { 7C:A7:B0:xx.xx.xx, 78:D9:5E:xx.xx.xx }  goto pbr_mark_0x020000 comment "stb-xxx"
add rule inet fw4 pbr_prerouting ether saddr { d0:6f:4a:xx.xx.xx }  goto pbr_mark_0x020000 comment "stb-xxx"
add rule inet fw4 pbr_prerouting ether saddr { 06:23:45:xx.xx.xx }  goto pbr_mark_0x020000 comment "cel-xxx"
add rule inet fw4 pbr_prerouting ether saddr { c8:8a:9a:xx.xx.xx, 00:e0:4d:xx.xx.xx }  goto pbr_mark_0x020000 comment "pc-xxx"
add rule inet fw4 pbr_prerouting ether saddr { 00:25:D3:xx.xx.xx }  goto pbr_mark_0x020000 comment "pc-xxx"
add rule inet fw4 pbr_prerouting ether saddr { 00:d7:6d:xx.xx.xx, c4:cb:e1:xx.xx.xx }  goto pbr_mark_0x020000 comment "pc-xxx"

pbr chains - policies
	chain pbr_forward { # handle 39
	}
	chain pbr_input { # handle 40
	}
	chain pbr_output { # handle 41
	}
	chain pbr_postrouting { # handle 43
	}
	chain pbr_prerouting { # handle 42
		ip daddr 192.168.100.0/24 return comment "default" # handle 1328
		ether saddr { 78:d9:5e:xx.xx.xx, 7c:a7:b0:xx.xx.xx } goto pbr_mark_0x020000 comment "stb-xxx" # handle 1330
		ether saddr d0:6f:4a:xx.xx.xx goto pbr_mark_0x020000 comment "stb-xxx" # handle 1331
		ether saddr 06:23:45:xx.xx.xx goto pbr_mark_0x020000 comment "cel-xxx" # handle 1332
		ether saddr { 00:e0:4d:xx.xx.xx, c8:8a:9a:xx.xx.xx } goto pbr_mark_0x020000 comment "pc-xxx" # handle 1334
		ether saddr 00:25:d3:xx.xx.xx goto pbr_mark_0x020000 comment "pc-xxx" # handle 1335
		ether saddr { 00:d7:6d:xxx, c4:cb:e1:xx.xx.xx } goto pbr_mark_0x020000 comment "pc-xxx" # handle 1337
	}
	chain pbr_dstnat { # handle 38
	}

pbr chains - marking
	chain pbr_mark_0x010000 { # handle 1319
		meta mark set meta mark & 0xff01ffff | 0x00010000 # handle 1320
		return # handle 1321
	}
	chain pbr_mark_0x020000 { # handle 1322
		meta mark set meta mark & 0xff02ffff | 0x00020000 # handle 1323
		return # handle 1324
	}
	chain pbr_mark_0x030000 { # handle 1325
		meta mark set meta mark & 0xff03ffff | 0x00030000 # handle 1326
		return # handle 1327
	}

pbr nft sets

IPv4 table 256 route: default via 152.xxx.xxx.xxx dev pppoe-wan 
IPv4 table 256 rule(s):
30000:	from all fwmark 0x10000/0xff0000 lookup pbr_wan
IPv4 table 257 route: default via 10.2.0.2 dev wg0 
IPv4 table 257 rule(s):
29998:	from all fwmark 0x20000/0xff0000 lookup pbr_wg0
IPv4 table 258 route: unreachable default 
IPv4 table 258 rule(s):
29996:	from all fwmark 0x30000/0xff0000 lookup pbr_wan1

pbr.reload

root@GT-AC5300:~# /etc/init.d/pbr reload
Using wan interface (on_start): wan 
Found wan gateway (on_start): 152.xxx.xxx.xxx 
Setting up routing for 'wan/pppoe-wan/152.xxx.xxx.xxx' [✓]
Setting up routing for 'wg0/10.2.0.2' [✓]
Setting up routing for 'wan1/lan6/0.0.0.0' [✓]
Routing 'default' via ignore [✓]
Routing 'stb-xxx' via wg0 [✓]
Routing 'stb-xxx' via wg0 [✓]
Routing 'cel-xxx' via wg0 [✓]
Routing 'pc-xxx' via wg0 [✓]
Routing 'pc-xxx' via wg0 [✓]
pbr.cfg0c6ff5.name=hub-usb-exboom validates as string with true
pbr.cfg0c6ff5.enabled is unset and defaults to bool 1
pbr.cfg0c6ff5.interface=tun0 validates as or("ignore", "tor", regex("xray_.*"), uci("network", "@interface")) with false
pbr.cfg0c6ff5.proto is unset and defaults to or(string) (null)
pbr.cfg0c6ff5.chain is unset and defaults to or("", "forward", "input", "output", "prerouting", "postrouting", "FORWARD", "INPUT", "OUTPUT", "PREROUTING", "POSTROUTING") prerouting
pbr.cfg0c6ff5.src_addr=00:e0:4c:xx:xx:xx validates as list(neg(or(host,network,macaddr,string))) with true
pbr.cfg0c6ff5.src_port is unset and defaults to list(neg(or(portrange,string))) (null)
pbr.cfg0c6ff5.dest_addr is unset and defaults to list(neg(or(host,network,string))) (null)
pbr.cfg0c6ff5.dest_port is unset and defaults to list(neg(or(portrange,string))) (null)
Routing 'hub-usb-exboom' via  [✗]
Routing 'pc-xxx' via wg0 [✓]
Installing fw4 nft file [✓]
pbr 1.1.7-29 monitoring interfaces: wan0 wan1 wan wg0 
pbr 1.1.7-29 (fw4 nft file mode) started with gateways:
wan/pppoe-wan/152.255.239.159 [✓]
wg0/10.2.0.2
wan1/lan6/0.0.0.0
ERROR: Policy 'hub-usb-exboom' has no assigned interface!

pbr.status

root@GT-AC5300:~# /etc/init.d/pbr status

pbr - environment
pbr 1.1.7-29 running on OpenWrt 23.05.5.

Dnsmasq version 2.90  Copyright (c) 2000-2024 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP conntrack no-ipset nftset auth cryptohash DNSSEC no-ID loop-detect inotify dumpfile

pbr fw4 nft file: /usr/share/nftables.d/ruleset-post/30-pbr.nft
add chain inet fw4 pbr_mark_0x010000
add rule inet fw4 pbr_mark_0x010000  mark set mark and 0xff00ffff xor 0x010000
add rule inet fw4 pbr_mark_0x010000 return
add chain inet fw4 pbr_mark_0x020000
add rule inet fw4 pbr_mark_0x020000  mark set mark and 0xff00ffff xor 0x020000
add rule inet fw4 pbr_mark_0x020000 return
add chain inet fw4 pbr_mark_0x030000
add rule inet fw4 pbr_mark_0x030000  mark set mark and 0xff00ffff xor 0x030000
add rule inet fw4 pbr_mark_0x030000 return
add rule inet fw4 pbr_prerouting ip daddr { 192.168.100.0/24 }  return comment "default"
add rule inet fw4 pbr_prerouting ether saddr { 7C:A7:B0:xx.xx, 78:D9:5E:xx.xx.xx }  goto pbr_mark_0x020000 comment "stb-xxx"
add rule inet fw4 pbr_prerouting ether saddr { d0:6f:4a:xx.xx }  goto pbr_mark_0x020000 comment "stb-xxx"
add rule inet fw4 pbr_prerouting ether saddr { 06:23:45:xx.xx }  goto pbr_mark_0x020000 comment "cel-xxx"
add rule inet fw4 pbr_prerouting ether saddr { c8:8a:9a:xx.xx, 00:e0:4d:xx.xx.xx }  goto pbr_mark_0x020000 comment "pc-xxx"
add rule inet fw4 pbr_prerouting ether saddr { 00:25:D3:xx.xx }  goto pbr_mark_0x020000 comment "pc-xxx"
add rule inet fw4 pbr_prerouting ether saddr { 00:d7:6d:xx.xx, c4:cb:e1:xx.xx.xx }  goto pbr_mark_0x020000 comment "pc-xxx"

pbr chains - policies
	chain pbr_forward { # handle 39
	}
	chain pbr_input { # handle 40
	}
	chain pbr_output { # handle 41
	}
	chain pbr_postrouting { # handle 43
	}
	chain pbr_prerouting { # handle 42
		ip daddr 192.168.100.0/24 return comment "default" # handle 1484
		ether saddr { 78:d9:5e:xx.xx.xx, 7c:a7:b0:xx.xx.xx } goto pbr_mark_0x020000 comment "stb-xxx" # handle 1486
		ether saddr d0:6f:4a:xx.xx.xx goto pbr_mark_0x020000 comment "stb-xxx" # handle 1487
		ether saddr 06:23:45:xx.xx.xx goto pbr_mark_0x020000 comment "cel-xxx" # handle 1488
		ether saddr { 00:e0:4d:xx.xx.xx, c8:8a:9a:xx:xx:xx } goto pbr_mark_0x020000 comment "pc-xxx" # handle 1490
		ether saddr 00:25:d3:xx.xx.xx goto pbr_mark_0x020000 comment "pc-xxx" # handle 1491
		ether saddr { 00:d7:6d:xx.xx.xx, c4:cb:e1:xx.xx.xx } goto pbr_mark_0x020000 comment "pc-xxxx" # handle 1493
	}
	chain pbr_dstnat { # handle 38
	}

pbr chains - marking
	chain pbr_mark_0x010000 { # handle 1475
		meta mark set meta mark & 0xff01ffff | 0x00010000 # handle 1476
		return # handle 1477
	}
	chain pbr_mark_0x020000 { # handle 1478
		meta mark set meta mark & 0xff02ffff | 0x00020000 # handle 1479
		return # handle 1480
	}
	chain pbr_mark_0x030000 { # handle 1481
		meta mark set meta mark & 0xff03ffff | 0x00030000 # handle 1482
		return # handle 1483
	}

pbr nft sets

IPv4 table 256 route: default via 152.xxx.xxx.xxx dev pppoe-wan 
IPv4 table 256 rule(s):
30000:	from all fwmark 0x10000/0xff0000 lookup pbr_wan
IPv4 table 257 route: default via 10.2.0.2 dev wg0 
IPv4 table 257 rule(s):
29998:	from all fwmark 0x20000/0xff0000 lookup pbr_wg0
IPv4 table 258 route: unreachable default 
IPv4 table 258 rule(s):
29996:	from all fwmark 0x30000/0xff0000 lookup pbr_wan1

stangri · 2024-10-27T03:18:45.404Z

Thanks Erik, pushed pbr 1.1.7-31 with the fix.

powtrix · 2024-10-27T04:48:51.694Z

Thanks for the fix.

pbr.reload

root@GT-AC5300:~# service pbr reload
Using wan interface (on_start): wan
Found wan gateway (on_start): 152.xxxx
Setting up routing for 'wan/pppoe-wan/152.xxxx' [✓]
Setting up routing for 'wg0/10.2.0.2' [✓]
Setting up routing for 'ovpn0/tun0/10.96.0.18' [✓]
Setting up routing for 'ovpn1/tun1/0.0.0.0' [✓]
Setting up routing for 'ovpn2/tun2/10.100.0.2' [✓]
Setting up routing for 'wan1/lan6/0.0.0.0' [✓]
Routing 'default' via ignore [✓]
Routing 'stb-xxxx' via wg0 [✓]
Routing 'stb-xxxx' via wg0 [✓]
Routing 'cel-xxxx' via wg0 [✓]
Routing 'pc-xxxx' via wg0 [✓]
Routing 'pc-xxxx' via wg0 [✓]
Routing 'hub-usb-exboom' via ovpn0 [✓]
Routing 'pc-xxxx' via wg0 [✓]
Installing fw4 nft file [✓]
pbr 1.1.7-31 monitoring interfaces: wan0 wan1 wan wg0 ovpn0 ovpn1 ovpn2
pbr 1.1.7-31 (fw4 nft file mode) started with gateways:
wan/pppoe-wan/152.xxxx [✓]
wg0/10.2.0.2
ovpn0/tun0/10.96.0.18
ovpn1/tun1/0.0.0.0
ovpn2/tun2/10.100.0.2
wan1/lan6/0.0.0.0

mori · 2024-10-27T04:56:59.940Z

stangri:

You can try opkg install --force-downgrade /tmp/*.ipk.

That worked fine, thank you!!

root@OpenWrt-FG52E:~# opkg remove luci-i18n-pbr-ja luci-app-pbr pbr
root@OpenWrt-FG52E:~# opkg install --force-downgrade /tmp/pbr_1.1.7-31_all.ipk /tmp/luci-app-pbr_1.1.7-31_all.ipk
  /tmp/luci-i18n-pbr-ja_24.299.60972\~4c08b34_all.ipk

quyenvsp · 2024-10-27T05:08:10.375Z

Hi, pbr 1.1.7 removed ipset support but I am using AdGuardHome which not support nftables set yet. So can someone please guide correct way to use pbr 1.1.7 with AdGuardHome or I must wait AGH support nftables?

Current I need double config for AGH forwarding to DNSMasq follow below comment, but not sure this way best or not?

github.com/AdguardTeam/AdGuardHome

Add support for nftables set

opened 04:50PM - 11 Nov 22 UTC

mm2231031

feature request

### Prerequisites - [X] I have checked the [Wiki](https://github.com/AdguardTea…m/AdGuardHome/wiki) and [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions) and found no answer - [X] I have searched other issues and found no duplicates - [X] I want to request a feature or enhancement and not ask a question ### Description #### What problem are you trying to solve? Now that nftables is widely used, some systems no longer support the ipset function. It is reasonable to add support for nftset now. #### Proposed solution Dnsmasq v2.87 has added support for nfset. #### Alternatives considered #### Additional information

powtrix · 2024-10-27T06:01:26.937Z

As you said, its not supported. Replace agh with adblock + dnscrypt-proxy2.