Ok the info as follows:-
root@ArcherC7:~# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option nonwildcard '1'
option localservice '1'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
config dhcp 'lan'
option interface 'lan'
option ignore '1'
option start '100'
option leasetime '12h'
option limit '150'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
option start '100'
option leasetime '12h'
option limit '150'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
root@ArcherC7:~# cat /etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option synflood_protect '1'
option forward 'ACCEPT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
list network 'lan'
option forward 'ACCEPT'
config include
option path '/etc/firewall.user'
config zone
option name 'wan'
option input 'ACCEPT'
option output 'ACCEPT'
list network 'wan'
option forward 'REJECT'
config zone
option name 'vpn'
list network 'vpn'
option output 'ACCEPT'
option masq '1'
option input 'REJECT'
option forward 'REJECT'
config include 'pbr'
option fw4_compatible '1'
option type 'script'
option path '/usr/share/pbr/pbr.firewall.include'
config forwarding
option dest 'vpn'
option src 'lan'
root@ArcherC7:~# cat /etc/config/network
config interface 'loopback'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
option device 'lo'
config globals 'globals'
option ula_prefix 'fd7f:b723:61ba::/48'
config interface 'lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.100.1'
option ipaddr '192.168.100.2'
option device 'br-lan'
option metric '10'
list dns '103.86.96.100'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '2 3 4 5 0t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '1 6t'
config device
option type 'bridge'
option name 'br-lan'
list ports 'eth1'
list ports 'eth1.1'
config device
list ports 'eth0'
list ports 'eth0.2'
option type 'bridge'
option name 'br-wan'
option macaddr '98:DE:D0:C4:A8:E9'
config interface 'wan'
option device 'br-wan'
option proto 'static'
option netmask '255.255.255.0'
option ipaddr '192.168.1.2'
option gateway '192.168.1.1'
option metric '10'
list dns '103.86.96.100'
config interface 'vpn'
option proto 'wireguard'
list addresses '10.5.0.2'
option private_key 'OOT3uAgR0cX4Ls+w5Y1hfOpAqIFP97TgU24CslYAoE8='
list dns '103.86.96.100 103.86.99.100'
list dns '103.86.96.100'
list dns '103.86.99.100'
config wireguard_vpn
option public_key '0/x2PdBGfcIGr0ayFPFFjxcEEyhrlBRjR4kMcfwXJTU='
option persistent_keepalive '25'
list allowed_ips '0.0.0.0/0'
option endpoint_host '62.182.99.232'
option endpoint_port '51820'
root@ArcherC7:~# cat /etc/config/pbr
config pbr 'config'
option verbosity '2'
option strict_enforcement '1'
option resolver_set 'none'
option ipv6_enabled '0'
list ignored_interface 'vpnserver'
list ignored_interface 'wgserver'
option boot_timeout '30'
option rule_create_option 'add'
option procd_reload_delay '1'
option webui_show_ignore_target '0'
list webui_supported_protocol 'all'
list webui_supported_protocol 'tcp'
list webui_supported_protocol 'udp'
list webui_supported_protocol 'tcp udp'
list webui_supported_protocol 'icmp'
option enabled '1'
config include
option path '/usr/share/pbr/pbr.user.aws'
config include
option path '/usr/share/pbr/pbr.user.netflix'
config policy
option interface 'vpn'
option name 'Netflix'
option dest_addr 'amazonaws.com netflix.com nflxext.com nflximg.net nflx so.net nflxvideo.net dvd.netflix.com'
config policy
option name 'Plex/Emby Remote Servers'
option interface 'vpn'
option dest_addr 'plex.tv my.plexapp.com emby.media app.emby.media tv.em by.media app.plex.tv'
config policy
option interface 'vpn'
option name 'Prime'
option dest_addr 'primevideo.com amazonvideo.com'
config policy
option interface 'vpn'
option name 'Disney+'
option dest_addr 'bamtechmedia.com disneystreaming.com disneyplus.com'
config policy
option name 'Roku'
option dest_addr 'roku.com'
option interface 'vpn'
config policy
option interface 'vpn'
option name 'Hbomax'
option dest_addr 'hbomax.com'
config policy
option name 'WireGuard Server'
option src_port '51820'
option chain 'output'
option proto 'udp'
option interface 'vpn'
option enabled '0'
config policy
option name 'Plex/Emby Local Server'
option src_port '8096 8920 32400'
option enabled '0'
option interface 'lan'
root@ArcherC7:~# /etc/init.d/pbr status
============================================================
pbr - environment
pbr 1.0.1-3 running on OpenWrt 22.03.2. WAN (IPv4): lan/br-lan/192.168.100.1.
============================================================
Dnsmasq version 2.86 Copyright (c) 2000-2021 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP DHCPv6 no -Lua TFTP conntrack ipset auth cryptohash DNSSEC no-ID loop-detect inotify dumpf ile
============================================================
pbr chains - policies
chain pbr_forward {
}
chain pbr_input {
}
chain pbr_output {
}
chain pbr_prerouting {
ip daddr @pbr_vpn_4_dst_ip_cfg046ff5 goto pbr_mark_0x030000 comm ent "Netflix"
ip daddr @pbr_vpn_4_dst_ip_cfg046ff5 goto pbr_mark_0x030000 comm ent "Netflix"
ip daddr @pbr_vpn_4_dst_ip_cfg056ff5 goto pbr_mark_0x030000 comm ent "Plex/Emby Remote Servers"
ip daddr @pbr_vpn_4_dst_ip_cfg066ff5 goto pbr_mark_0x030000 comm ent "Prime"
ip daddr @pbr_vpn_4_dst_ip_cfg076ff5 goto pbr_mark_0x030000 comm ent "Disney+"
ip daddr @pbr_vpn_4_dst_ip_cfg086ff5 goto pbr_mark_0x030000 comm ent "Roku"
ip daddr @pbr_vpn_4_dst_ip_cfg096ff5 goto pbr_mark_0x030000 comm ent "Hbomax"
ip daddr @pbr_lan_4_dst_ip_user goto pbr_mark_0x010000
ip saddr @pbr_lan_4_src_ip_user goto pbr_mark_0x010000
ether saddr @pbr_lan_4_src_mac_user goto pbr_mark_0x010000
ip daddr @pbr_wan_4_dst_ip_user goto pbr_mark_0x020000
ip saddr @pbr_wan_4_src_ip_user goto pbr_mark_0x020000
ether saddr @pbr_wan_4_src_mac_user goto pbr_mark_0x020000
ip daddr @pbr_vpn_4_dst_ip_user goto pbr_mark_0x030000
ip saddr @pbr_vpn_4_src_ip_user goto pbr_mark_0x030000
ether saddr @pbr_vpn_4_src_mac_user goto pbr_mark_0x030000
}
chain pbr_postrouting {
}
============================================================
pbr chains - marking
chain pbr_mark_0x010000 {
counter packets 0 bytes 0 meta mark set meta mark & 0xff01ffff | 0x00010000
return
}
chain pbr_mark_0x020000 {
counter packets 0 bytes 0 meta mark set meta mark & 0xff02ffff | 0x00020000
return
}
chain pbr_mark_0x030000 {
counter packets 3662 bytes 250467 meta mark set meta mark & 0xff 03ffff | 0x00030000
return
}
============================================================
pbr nft sets
set pbr_vpn_4_dst_ip_cfg046ff5 {
type ipv4_addr
flags interval
auto-merge
comment "Netflix"
elements = { 3.251.50.149, 18.236.7.30,
34.218.19.240, 34.252.74.1,
44.226.113.145, 46.137.171.215,
50.17.247.9, 52.31.48.193,
54.74.73.31, 54.155.178.5,
72.21.206.80, 72.21.210.29,
107.20.175.192, 204.236.236.127,
207.45.72.201, 207.45.72.215,
207.171.166.22 }
}
set pbr_vpn_4_dst_ip_cfg056ff5 {
type ipv4_addr
flags interval
auto-merge
comment "Plex/Emby Remote Servers"
elements = { 18.200.51.241, 34.243.47.112,
52.48.60.59, 52.49.138.125,
104.18.18.96, 104.18.19.96,
173.230.139.54 }
}
set pbr_vpn_4_dst_ip_cfg066ff5 {
type ipv4_addr
flags interval
auto-merge
comment "Prime"
elements = { 18.154.206.17, 18.154.206.47,
18.154.206.122, 18.154.206.127 }
}
set pbr_vpn_4_dst_ip_cfg076ff5 {
type ipv4_addr
flags interval
auto-merge
comment "Disney+"
elements = { 34.110.155.89, 34.218.145.143,
54.71.61.241, 54.218.188.255,
139.104.192.37 }
}
set pbr_vpn_4_dst_ip_cfg086ff5 {
type ipv4_addr
flags interval
auto-merge
comment "Roku"
elements = { 162.159.135.11, 162.159.136.11 }
}
set pbr_vpn_4_dst_ip_cfg096ff5 {
type ipv4_addr
flags interval
auto-merge
comment "Hbomax"
elements = { 52.2.113.243, 52.24.7.205,
52.26.195.38, 52.26.195.185,
52.206.133.146, 52.206.158.144 }
}
set pbr_lan_4_dst_ip_user {
type ipv4_addr
policy memory
flags interval
auto-merge
comment ""
}
set pbr_lan_4_src_ip_user {
type ipv4_addr
policy memory
flags interval
auto-merge
comment ""
}
set pbr_lan_4_src_mac_user {
type ether_addr
policy memory
flags interval
auto-merge
comment ""
}
set pbr_wan_4_dst_ip_user {
type ipv4_addr
policy memory
flags interval
auto-merge
comment ""
}
set pbr_wan_4_src_ip_user {
type ipv4_addr
policy memory
flags interval
auto-merge
comment ""
}
set pbr_wan_4_src_mac_user {
type ether_addr
policy memory
flags interval
auto-merge
comment ""
}
set pbr_vpn_4_dst_ip_user {
type ipv4_addr
policy memory
flags interval
auto-merge
comment ""
}
set pbr_vpn_4_src_ip_user {
type ipv4_addr
policy memory
flags interval
auto-merge
comment ""
}
set pbr_vpn_4_src_mac_user {
type ether_addr
policy memory
flags interval
auto-merge
comment ""
}
============================================================
IPv4 table 256 route: default via 192.168.100.1 dev br-lan
IPv4 table 256 rule(s):
30000: from all fwmark 0x10000/0xff0000 lookup pbr_lan
IPv4 table 257 route: default via 192.168.1.1 dev br-wan
IPv4 table 257 rule(s):
30001: from all fwmark 0x20000/0xff0000 lookup pbr_wan
IPv4 table 258 route: default via 10.5.0.2 dev vpn
IPv4 table 258 rule(s):
30002: from all fwmark 0x30000/0xff0000 lookup pbr_vpn
root@ArcherC7:~# /etc/init.d/pbr reload
Activating traffic killswitch [✓]
Setting up routing for 'lan/br-lan/192.168.100.1' [✓]
Setting up routing for 'wan/br-wan/192.168.1.1' [✓]
Setting up routing for 'vpn/10.5.0.2' [✓]
Routing 'Netflix' via vpn [✗]
Routing 'Plex/Emby Remote Servers' via vpn [✓]
Routing 'Prime' via vpn [✓]
Routing 'Disney+' via vpn [✓]
Routing 'Roku' via vpn [✓]
Routing 'Hbomax' via vpn [✓]
Deactivating traffic killswitch [✓]
pbr 1.0.1-3 monitoring interfaces: wan vpn
pbr 1.0.1-3 (nft) started with gateways:
lan/br-lan/192.168.100.1
wan/br-wan/192.168.1.1 [✓]
vpn/10.5.0.2
ERROR: Insertion failed for IPv4 for policy Netflix
ERROR:
nft 'add rule inet fw4 pbr_prerouting ip daddr {} goto pbr_mark_0x030000 comment "Netflix"'
root@ArcherC7:~#
