Port route from lan to wan to bypass vpn

im running transmission on my pi connected to openwrt running openvpn

the pi has ufw port 31603 open for transmission

i would like to forward tcp/udp for port 31603 from pi to gateway so as to bypass vpn

this does not seem to be working:


in the image above
192.168.42.100 is the static ip of the pi
192.168.0.1 is the gateway of the isp

Route LAN to VPN with WAN port forwarding

2 Likes

doesn't work :confused:

As you are using a VPN, maybe try Policy Based routing:

Simply set the Pi's IP address to use the WAN.

Problem in your case could be that traffic for the Pi enters the WAN but is routed out by default via the VPN and the firewall will not allow this?

Edit: I see you are already using PBR so forget the above, although you might specify an outgoing interface?

1 Like

no more space on router to install pbr

I only want transmission traffic to be routed to WAN, not all traffic from the pi

only need traffic from transmission port opened on the pi to be routed to wan, vpn does not allow torrent traffic

If you already have made an extra routing table which uses the WAN by default you can use an iprule to route a sourceport via the WAN.

Using fwmark to do this was not successful in my hands

So in your case something like:
ip rule add sport 31603 table XXX

Where XXX is the table with WAN gateway as default

1 Like
root@OpenWrt:~# ip rule add sport 31603 table 100
ip: invalid argument 'sport' to 'ip'

Is this a really old router with Kernel < 5.10 ?

It works on my router:

root@DL-WRX36:~# ip rule add sport 31603 table 100
root@DL-WRX36:~# ip rule show
0:      from all lookup local
32765:  from all sport 31603 lookup 100
32766:  from all lookup main
32767:  from all lookup default
root@DL-WRX36:~#

EDIT:
you might try:
ip rule add from all sport 31603 table 100

1 Like

ya

mine gives me

root@OpenWrt:~# ip rule add sport 31603 table 100
ip: invalid argument 'sport' to 'ip'
root@OpenWrt:~# ip rule add from all sport 31603 table 100
ip: invalid argument 'sport' to 'ip'
root@OpenWrt:~#
root@OpenWrt:~# ip rule show
0:	from all lookup local 
1:	from 192.168.42.100 iif br-lan lookup 100 
10000:	from 192.168.42.1 lookup 1 
20000:	from all to 192.168.42.1/24 lookup 1 
32766:	from all lookup main 
32767:	from all lookup default 
90012:	from all iif lo lookup 1

tried, no joy :confused:

uname -r

The sport option is not available on earlier kernel versions, I am not sure exactly when it was added.
It looks like you are out of luck :frowning:

1 Like
root@OpenWrt:~# uname -r
5.10.176
root@OpenWrt:~#

daym :frowning:

pepe-funny

ip rule help should show what is available

root@DL-WRX36:~# ip rule help
Usage: ip rule { add | del } SELECTOR ACTION
       ip rule { flush | save | restore }
       ip rule [ list [ SELECTOR ]]
SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ]
            [ fwmark FWMARK[/MASK] ]
            [ iif STRING ] [ oif STRING ] [ pref NUMBER ] [ l3mdev ]
            [ uidrange NUMBER-NUMBER ]
            [ ipproto PROTOCOL ]
            [ sport [ NUMBER | NUMBER-NUMBER ]
            [ dport [ NUMBER | NUMBER-NUMBER ] ]
ACTION := [ table TABLE_ID ]
          [ protocol PROTO ]
          [ nat ADDRESS ]
          [ realms [SRCREALM/]DSTREALM ]
          [ goto NUMBER ]
          SUPPRESSOR
SUPPRESSOR := [ suppress_prefixlength NUMBER ]
              [ suppress_ifgroup DEVGROUP ]
TABLE_ID := [ local | main | default | NUMBER ]
root@DL-WRX36:~#
1 Like
root@OpenWrt:~# ip rule help
ip: invalid argument 'help' to 'ip'
root@OpenWrt:~#

ming

looks cool :slight_smile:

Another idea maybe it is dependant on the ip package you have e.g. ip-full package versus something else.
So maybe by adding another package you can add it?

Just a wild guess

1 Like

appreciate your support :+1:

just curious,

when you added

how did it look on luci, i mean where did the port number show up in luci network > routing > ip rules

LuCi Status > routing:

1 Like

guess it does not show in
LuCi Status >network > routing > ip rules

anyway, thanks for your help, appreciate it :slight_smile:

Transmission doesn't use the same source port for outgoing connections, so trying to match on sport 31603 is futile.

1 Like

ive made a ufw rule on the pi to only allow that specific port

so even if transmission running on the pi is doing something dynamically, the pi will only allow outgoing connections through that port

dont know if that makes any sense, i dont have sport anyway :confused: