Policy-Based-Routing (pbr) package discussion

I have amneziawg installed through third party packages. On PBR version 14 everything works. After updating to r18, the service does not start.

root@OpenWrt:/etc/init.d# ./pbr restart
Forwarding is disabled
Resetting routing [✓]
Resetting resolver [✓]
pbr 1.2.2-r18 (nft mode) stopped [✓]
Processing environment (on_start) [✗]
WARNING: Uplink/WAN interface is still down, going back to boot mode.
Setting interface trigger for wan [✓]
Setting interface trigger for wwan [✓]
Setting interface trigger for tgp [✓]
Setting trigger (on_boot) [✓]
Forwarding is enabled

AmeziaWG is not an officially supported interface in PBR, it uses WireGuard under the hood so probably will work.

The messages indicates your wan interface is not up, see if this applies:

See the read.me: https://docs.mossdef.org/pbr/1.2.2/#service-configuration-settings

Hidden uplink_interface string wan Explicitly defines the logical OpenWrt interface name used for upstream gateway calculations, which is necessary only if your primary IPv4 WAN interface is not named ‘wan’.
Hidden uplink_interface6 string wan6 Explicitly defines the logical OpenWrt interface name used for the upstream IPv6 gateway, necessary if your IPv6 WAN interface is not named ‘wan6’.

Under my testing my phone useing Wireguard with Proton working fine when tested but over night connecting stop work.
Have to remove macaddress and routing restart PBR and readded everything then starteted to work agian.

I think i found problem, have set dns in Wireguard and in DNS policies. Removed dns in DNS Policies seems fix it, lets see

WireGuard servers sometimes go down because they are overcrowded or broken or taken offline for maintenance
I have several to different locations and if one goes down I use another

1 Like

I had to go for pbr-1.2.2-r19.4.bash as my internet connection to several clients went down every 30 minutes for a couple of seconds and pbr was showing errors in the logs. With r19.4.bash everything seems to be fine and my gateways are also showing up again. I hope that a new official update/release will fix this issue in the near future.

Thanks for confirming.
The problem you had could be related to wan6 lease renewal.
The warnings you have caused a display issue which caused the wan6 bypass not working.
This is solved in r19.4.
This fix is incorporated in the upcoming r20 release

@egc please see if the following improvements are possible.

  1. uplink interface selection using Luci
    Currently we have to configure it in the configuration file that is not always convenient.

  2. better handling of gateways in Luci
    If a non-default interface is used as uplink (like mifi, lte, etc.) no gateway information is shown on pbr Luci page until wan is set as ignored in pbr. At the same time pbr operates as intended and log shows proper gateway detection.

That of course is possible, feel free to make a PR but otherwise I will put it on the list and discuss it with Stan.

About this

Can you give an example both from Luci and with output of service pbr restart
Also please add output of:

service pbr support
ubus call service list "{ 'name': 'pbr' }"

I assume you have correctly set up the uplink interface

~# uci get pbr.config.uplink_interface
mifi
~# ubus call service list "{ 'name': 'pbr' }"
{
        "pbr": {
                "instances": {
                        "main": {
                                "running": false,
                                "command": [
                                        "/bin/true"
                                ],
                                "term_timeout": 5,
                                "exit_code": 0,
                                "data": {
                                        "gateways": [

                                        ]
                                }
                        }
                }
        }
}
~# service pbr restart
Resetting routing [✓]
Resetting resolver [✓]
pbr 1.2.2-r18 (fw4 nft file mode) stopped [✓]
Processing environment (on_start) [✓]
Setting up routing for 'wan/eth0.2/-' [✓]
Setting up routing for 'mifi/usb0/192.168.8.1' [✓]
Setting up routing for 'wwan/-' [✗]
Routing 'my phone' via wwan [✓]
Installing fw4 nft file [✓]
Setting interface trigger for wan [✓]
Setting interface trigger for mifi [✓]
Setting interface trigger for wwan [✓]
pbr 1.2.2-r18 monitoring interfaces: wan mifi wwan
pbr 1.2.2-r18 started with gateways:
wan/eth0.2/-
mifi/usb0/192.168.8.1 [✓]
WARNING: Unknown Gateway for device 'eth0.2'.
WARNING: Unknown Gateway for device ''.
WARNING: Warnings encountered, please check https://docs.openwrt.melmac.ca/pbr/1.2.2/#warning-messages-details.
ERROR: Failed to set up 'wwan/-'!
ERROR: Errors encountered, please check https://docs.openwrt.melmac.ca/pbr/1.2.2/#error-messages-details!

Let's add wan to ignore list:

~# ubus call service list "{ 'name': 'pbr' }"
{
        "pbr": {
                "instances": {
                        "main": {
                                "running": false,
                                "command": [
                                        "/bin/true"
                                ],
                                "term_timeout": 5,
                                "exit_code": 0,
                                "data": {
                                        "gateways": [
                                                {
                                                        "name": "mifi",
                                                        "device_ipv4": "usb0",
                                                        "gateway_ipv4": "192.168.8.1",
                                                        "device_ipv6": "usb0",
                                                        "gateway_ipv6": "-",
                                                        "default": true,
                                                        "action": "create",
                                                        "table_id": "256",
                                                        "mark": "0x010000",
                                                        "priority": "30000"
                                                }
                                        ]
                                }
                        }
                }
        }
}

Please start testing 1.2.2-r19.4

That at least will show all gateways.

See:

1 Like

I should have noticed this earlier. It works, thank you.

1 Like

Tested 4 days ago... :slightly_smiling_face:

1 Like

I've been running 19.4 since Saturday the 11th...No problems here.

PBR-1.2.2-r20 is available at stangri's repo, it has all the fixes from the interim build 1.2.2-3-r19.4
Compared to 1.2.2-r18, the issue with displaying interfaces/gateways has been resolved.
This issue was triggered by a warning, which caused a json problem and was also responsible for breaking the wan6 bypass on lease renewal.
Furthermore the display of an absent gateway has been changed from – to 0.0.0.0/::0.
Displaying IPv6 gateway’s when IPv6 was disabled has been removed

You can get pbr-1.2.2.-r20 from Stangri's repo by using SSH to connect to your router and executing the following script.
You do not have to copy and execute line by line but you can copy everything e.g. by clicking on the icon in the upper right hand corner and just paste at the command line:
As always make a backup of your settings first

Master and 25.12 branch (APK)

cd /tmp
wget https://apk.openwrt.melmac.ca/apk.openwrt.melmac.ca.pem -O /etc/apk/keys/apk.openwrt.melmac.ca.pem
#Get packages
wget -O pbr.apk https://github.com/mossdef-org/pbr/releases/download/v1.2.2-20/pbr-1.2.2-20_openwrt-25.12_noarch.apk
wget -O luci-app-pbr.apk https://github.com/mossdef-org/luci-app-pbr/releases/download/v1.2.2-20/luci-app-pbr-1.2.2-20_openwrt-25.12_noarch.apk
service pbr stop
#remove existing
apk del luci-app-pbr pbr
mv /etc/init.d/pbr /etc/init.d/pbr-old	>/dev/null 2>&1   # backup old pbr in case it is not removed
apk add --allow-untrusted ./*.apk
service pbr start

Branch 24.10 (IPK)

cd /tmp 
wget -O pbr.ipk https://github.com/mossdef-org/pbr/releases/download/v1.2.2-20/pbr-1.2.2-20_openwrt-24.10_all.ipk
wget -O luci-app-pbr.ipk https://github.com/mossdef-org/luci-app-pbr/releases/download/v1.2.2-20/luci-app-pbr-1.2.2-20_openwrt-24.10_all.ipk 
service pbr stop 
opkg remove luci-app-pbr pbr
mv /etc/init.d/pbr /etc/init.d/pbr-old	>/dev/null 2>&1   # backup old pbr in case it is not removed
opkg install ./*.ipk 
service pbr start
2 Likes

Thanks for testing please test 1.2.2-r20 see above

If there are no showstoppers this will be the next official PBR 1.2.2 build. This might be one of the last 1.2.2 builds as there is a transition to build 1.2.3 which is an ucode port

Just installed and at first glance seems to working. Let test it!
1.2.2-r20

1 Like

Many thanks

Im on 24.10.7 and I thought that the wan6 release renewal issue is only related to 25.12.5 builds.

1.2.2.-r20 seems to run fine but still with errors and no IPv6 address is showing up when IPv6 support is enabled...

Wed Jul 15 15:37:13 2026 user.notice pbr [11784]: WARNING: Unknown IPv6 Gateway for interface:'wan6' device:'eth1.7'.
Wed Jul 15 15:37:13 2026 user.notice pbr [11784]: Using uplink IPv4 interface (on_start): wan [✓]
Wed Jul 15 15:37:13 2026 user.notice pbr [11784]: Found uplink IPv4 gateway (on_start): x.x.x.x [✓]
Wed Jul 15 15:37:13 2026 user.notice pbr [11784]: Using uplink IPv6 interface (on_start): wan6 [✓]
Wed Jul 15 15:37:15 2026 user.notice pbr [11784]: Processing environment (on_start) WARNING: Unknown IPv6 Gateway for interface:'wan6' device:'eth1.7'.
Wed Jul 15 15:37:15 2026 user.notice pbr [11784]: [✓]
Wed Jul 15 15:37:15 2026 user.notice pbr [11784]: Forwarding is disabled
Wed Jul 15 15:37:16 2026 user.notice pbr [11784]: WARNING: Unknown IPv6 Gateway for interface:'wan6' device:'eth1.7'.

If you do not have problems with wan6 lease renewal then you are fine.

To be sure we are all on the same page:
If you have a functioning ipv6 with wan6 then PBR sets a trigger on wan6.
This trigger is executed by procd if anything changes on said interface.

If there is a wan (ipv4) lease renewal nothing actually changes on the interface and there is no trigger raised/

If a lease renewal is taking place for wan6 (IPv6) then the preferred life time is changed, it is debatable if this should raise a trigger but it is raised anyway so PBR reacts.

PBR reloads the interface. If you have strict enforcement enabled then the routing of wan6 is reloaded, during this reloading forwarding of all lan traffic stops to prevent any leakage.
Resulting in a small (1-2 sec) disruption of traffic.

Lease time of ipv6 is sometimes very short resulting in frequent disruptions, of course if your lease time is very long you will hardly notice.

Moving forward, a wan6 bypass was created so that the wan6 interface was not reloaded if the gateway address did not change.

This wan6 bypass was not working if a warning or error was raised due to a json bug.

This should all be resolved in 1.2.2-r20.

But chances are you did not notice anything and if so you are fine, if not upgrade to 1.2.2-r20 :slight_smile:

Then you probably do not have an IPv6 gateway and thus no IPv6 PBR routing via the wan6.

No problem if you are only doing IPv6 routing via e.g. your WireGuard interface, but it is something you need to research if you want to do IPv6 routing via your wan6