Morning,
I was hoping someone could provide me an example of how of set up some basic rules on pbr, as I keep getting DNS leaks.
I have a fresh install of openwrt 23.05.5, i have a wireguard "client" connecting to a commercial VPN provider (Mullvad), interface "mv1". I have installed dnsmasq-full as per docs. The default route is currently wan.
I have set all traffic to go through the VPN interface, this policy works. I have also set a specific domain to bypass the VPN and go out via wan an this policy works.
Im using the VPN providers DNS server, which is obviously only available to traffic that goes through the VPN tunnel. I have a public DNS server set to the wan interface.
The trouble I have is if i set a DNS policy to force all traffic to go through the vpn dns server it can't resolve the traffic that is going though the wan interface as the vpn dns server is private.
However if i disable this rule i get DNS leaks for traffic on the VPN interface, in that it also shows the wan dns resolver.
{
"kernel": "5.15.167",
"hostname": "OpenWrt",
"system": "ARMv8 Processor rev 3",
"model": "Raspberry Pi 4 Model B Rev 1.5",
"board_name": "raspberrypi,4-model-b",
"rootfs_type": "ext4",
"release": {
"distribution": "OpenWrt",
"version": "23.05.5",
"revision": "r24106-10cc5fcd00",
"target": "bcm27xx/bcm2711",
"description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
}
}
uci export dhcp
package dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option force '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config defaults
option syn_flood '1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'mv1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include 'pbr'
option fw4_compatible '1'
option type 'script'
option path '/usr/share/pbr/firewall.include'
uci export network
package network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdb5:7c80:032b::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.0.1'
option netmask '255.255.255.0'
config interface 'wan'
option proto 'pppoe'
option device 'eth1'
option username '###'
option password '###'
option ipv6 'auto'
option peerdns '0'
list dns '1.1.1.1'
config interface 'mv1'
option proto 'wireguard'
option private_key '###'
option listen_port '51820'
list addresses '###'
option delegate '0'
option force_link '1'
option defaultroute '0'
list dns '100.64.0.4'
config wireguard_mv1
option description '###'
option public_key '###'
list allowed_ips '0.0.0.0/0'
option endpoint_host '####
option endpoint_port '51820'
uci export pbr
package pbr
config pbr 'config'
option enabled '1'
option verbosity '2'
option strict_enforcement '1'
option resolver_set 'dnsmasq.nftset'
list resolver_instance '*'
option ipv6_enabled '0'
list ignored_interface 'vpnserver'
option boot_timeout '30'
option rule_create_option 'add'
option procd_boot_delay '0'
option procd_reload_delay '1'
option webui_show_ignore_target '0'
option nft_rule_counter '0'
option nft_set_auto_merge '1'
option nft_set_counter '0'
option nft_set_flags_interval '1'
option nft_set_flags_timeout '0'
option nft_set_policy 'performance'
list webui_supported_protocol 'all'
list webui_supported_protocol 'tcp'
list webui_supported_protocol 'udp'
list webui_supported_protocol 'tcp udp'
list webui_supported_protocol 'icmp'
list supported_interface 'mv1'
config include
option path '/usr/share/pbr/pbr.user.aws'
option enabled '0'
config include
option path '/usr/share/pbr/pbr.user.netflix'
option enabled '0'
config include
option path '/usr/share/pbr/pbr.user.wg_server_and_client'
option enabled '0'
config dns_policy
option name 'Redirect Local IP DNS'
option src_addr '192.168.0.0/24'
option dest_dns 'mv1'
option enabled '0'
config policy
option name 'Ignore Local Requests'
option interface 'ignore'
option dest_addr '10.0.0.0/24 10.0.1.0/24 192.168.100.0/24 192.168.1.0/24'
config policy
option name 'iptest'
option dest_addr 'dnsleaktest.com'
option interface 'wan'
config policy
option name 'lan'
option src_addr '192.168.0.0/24'
option interface 'mv1'
pbr - environment
pbr 1.1.6-22 running on OpenWrt 23.05.5.
Dnsmasq version 2.90 Copyright (c) 2000-2024 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP conntrack no-ipset nftset auth cryptohash DNSSEC no-ID loop-detect inotify dumpfile
pbr fw4 nft file: /usr/share/nftables.d/ruleset-post/30-pbr.nft
add chain inet fw4 pbr_mark_0x010000
add rule inet fw4 pbr_mark_0x010000 mark set mark and 0xff00ffff xor 0x010000
add rule inet fw4 pbr_mark_0x010000 return
add chain inet fw4 pbr_mark_0x020000
add rule inet fw4 pbr_mark_0x020000 mark set mark and 0xff00ffff xor 0x020000
add rule inet fw4 pbr_mark_0x020000 return
add rule inet fw4 pbr_prerouting ip daddr { 10.0.0.0/24, 10.0.1.0/24, 192.168.100.0/24, 192.168.1.0/24 } return comment "Ignore Local Requests"
add set inet fw4 pbr_wan_4_dst_ip_cfg076ff5 { type ipv4_addr; auto-merge; flags interval; policy performance; comment "iptest"; }
add rule inet fw4 pbr_prerouting ip daddr @pbr_wan_4_dst_ip_cfg076ff5 goto pbr_mark_0x010000 comment "iptest"
add rule inet fw4 pbr_prerouting ip saddr { 192.168.0.0/24 } goto pbr_mark_0x020000 comment "lan"
pbr chains - policies
chain pbr_forward { # handle 30
}
chain pbr_input { # handle 31
}
chain pbr_output { # handle 32
}
chain pbr_postrouting { # handle 34
}
chain pbr_prerouting { # handle 33
ip daddr { 10.0.0.0/23, 192.168.1.0/24, 192.168.100.0/24 } return comment "Ignore Local Requests" # handle 595
ip daddr @pbr_wan_4_dst_ip_cfg076ff5 goto pbr_mark_0x010000 comment "iptest" # handle 597
ip saddr 192.168.0.0/24 goto pbr_mark_0x020000 comment "lan" # handle 598
}
chain pbr_dstnat { # handle 29
}
pbr chains - marking
chain pbr_mark_0x010000 { # handle 588
meta mark set meta mark & 0xff01ffff | 0x00010000 # handle 589
return # handle 590
}
chain pbr_mark_0x020000 { # handle 591
meta mark set meta mark & 0xff02ffff | 0x00020000 # handle 592
return # handle 593
}
pbr nft sets
set pbr_wan_4_dst_ip_cfg076ff5 { # handle 596
type ipv4_addr
flags interval
auto-merge
comment "iptest"
elements = { ######### }
}
dnsmasq sets
nftset=/dnsleaktest.com/4#inet#fw4#pbr_wan_4_dst_ip_cfg076ff5 # iptest
IPv4 table 256 route: default via 1####### dev pppoe-wan
IPv4 table 256 rule(s):
30000: from all fwmark 0x10000/0xff0000 lookup pbr_wan
IPv4 table 257 route: default via 10.###### dev mv1
IPv4 table 257 rule(s):
29998: from all fwmark 0x20000/0xff0000 lookup pbr_mv1
/etc/init.d/pbr reload
Using wan interface (on_start): wan
Found wan gateway (on_start): 1#######
Setting up routing for 'wan/pppoe-wan/1########' [✓]
Setting up routing for 'mv1/10.#######' [✓]
Routing 'Ignore Local Requests' via ignore [✓]
Routing 'iptest' via wan [✓]
Routing 'lan' via mv1 [✓]
Installing fw4 nft file [✓]
pbr 1.1.6-22 monitoring interfaces: wan mv1
Restarting dnsmasq [✓]
pbr 1.1.6-22 (fw4 nft file mode) started with gateways:
wan/pppoe-wan/1######[✓]
mv1/10.#####
