im running transmission on my pi connected to openwrt running openvpn
the pi has ufw port 31603 open for transmission
i would like to forward tcp/udp for port 31603 from pi to gateway so as to bypass vpn
this does not seem to be working:
in the image above
192.168.42.100
is the static ip of the pi
192.168.0.1
is the gateway of the isp
egc
August 5, 2023, 7:22am
4
As you are using a VPN, maybe try Policy Based routing:
Simply set the Pi's IP address to use the WAN.
Problem in your case could be that traffic for the Pi enters the WAN but is routed out by default via the VPN and the firewall will not allow this?
Edit: I see you are already using PBR so forget the above, although you might specify an outgoing interface?
1 Like
no more space on router to install pbr
I only want transmission traffic to be routed to WAN, not all traffic from the pi
only need traffic from transmission port opened on the pi to be routed to wan, vpn does not allow torrent traffic
egc
August 5, 2023, 7:32am
6
If you already have made an extra routing table which uses the WAN by default you can use an iprule to route a sourceport via the WAN.
Using fwmark to do this was not successful in my hands
So in your case something like:
ip rule add sport 31603 table XXX
Where XXX is the table with WAN gateway as default
1 Like
root@OpenWrt:~# ip rule add sport 31603 table 100
ip: invalid argument 'sport' to 'ip'
egc
August 5, 2023, 8:04am
8
Is this a really old router with Kernel < 5.10 ?
It works on my router:
root@DL-WRX36:~# ip rule add sport 31603 table 100
root@DL-WRX36:~# ip rule show
0: from all lookup local
32765: from all sport 31603 lookup 100
32766: from all lookup main
32767: from all lookup default
root@DL-WRX36:~#
EDIT:
you might try:
ip rule add from all sport 31603 table 100
1 Like
ya
egc:
It works on my router:
mine gives me
root@OpenWrt:~# ip rule add sport 31603 table 100
ip: invalid argument 'sport' to 'ip'
root@OpenWrt:~# ip rule add from all sport 31603 table 100
ip: invalid argument 'sport' to 'ip'
root@OpenWrt:~#
root@OpenWrt:~# ip rule show
0: from all lookup local
1: from 192.168.42.100 iif br-lan lookup 100
10000: from 192.168.42.1 lookup 1
20000: from all to 192.168.42.1/24 lookup 1
32766: from all lookup main
32767: from all lookup default
90012: from all iif lo lookup 1
tried, no joy
egc
August 5, 2023, 8:19am
10
uname -r
The sport option is not available on earlier kernel versions, I am not sure exactly when it was added.
It looks like you are out of luck
1 Like
egc:
uname -r
root@OpenWrt:~# uname -r
5.10.176
root@OpenWrt:~#
daym
egc
August 5, 2023, 8:37am
12
ip rule help
should show what is available
root@DL-WRX36:~# ip rule help
Usage: ip rule { add | del } SELECTOR ACTION
ip rule { flush | save | restore }
ip rule [ list [ SELECTOR ]]
SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ]
[ fwmark FWMARK[/MASK] ]
[ iif STRING ] [ oif STRING ] [ pref NUMBER ] [ l3mdev ]
[ uidrange NUMBER-NUMBER ]
[ ipproto PROTOCOL ]
[ sport [ NUMBER | NUMBER-NUMBER ]
[ dport [ NUMBER | NUMBER-NUMBER ] ]
ACTION := [ table TABLE_ID ]
[ protocol PROTO ]
[ nat ADDRESS ]
[ realms [SRCREALM/]DSTREALM ]
[ goto NUMBER ]
SUPPRESSOR
SUPPRESSOR := [ suppress_prefixlength NUMBER ]
[ suppress_ifgroup DEVGROUP ]
TABLE_ID := [ local | main | default | NUMBER ]
root@DL-WRX36:~#
1 Like
root@OpenWrt:~# ip rule help
ip: invalid argument 'help' to 'ip'
root@OpenWrt:~#
egc:
DL-WRX36
looks cool
egc
August 5, 2023, 9:10am
14
Another idea maybe it is dependant on the ip package you have e.g. ip-full package versus something else.
So maybe by adding another package you can add it?
Just a wild guess
1 Like
just curious,
when you added
how did it look on luci, i mean where did the port number show up in luci network > routing > ip rules
egc:
LuCi Status > routing:
guess it does not show in
LuCi Status >network > routing > ip rules
anyway, thanks for your help, appreciate it
trendy
August 5, 2023, 2:18pm
19
Transmission doesn't use the same source port for outgoing connections, so trying to match on sport 31603 is futile.
1 Like
ive made a ufw rule on the pi to only allow that specific port
so even if transmission running on the pi is doing something dynamically, the pi will only allow outgoing connections through that port
dont know if that makes any sense, i dont have sport anyway