[Solved] How to route specific domains through WireGuard VPN using PBR?

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,

I'm looking for some help with "pbr" because I'm new to it and don't know much about it beyond a few forum posts and guides I've read about creating policies.

My goal is to route certain websites that are blocked in my country (for example, Tenor) through a WireGuard VPN interface using "luci-app-pbr". The VPN itself works perfectly when I connect devices directly to it, but routing specific domains through "pbr" does not seem to work reliably.

What happens is that the website often returns "NXDOMAIN" errors and fails to load. Occasionally it will work, but most of the time it doesn't.

Things I've already tried:

  • Disabling "https-dns-proxy". This seemed to help somewhat, but then Tenor images would not load correctly. I would only see the GIF names/placeholders instead of the actual images.
  • Removing IPv6 from my interfaces and WireGuard configuration, so everything is IPv4-only.
  • Verifying that the WireGuard VPN itself is working correctly. If I connect directly through the VPN, the blocked websites load fine.

My current setup includes:

  • "pbr" version: "1.2.2-r18"
  • "dnsmasq-full"
  • "adblock-lean"
  • "https-dns-proxy"
  • WireGuard VPN client (Mullvad VPN) and using Mullvad's DNS through DHCP 6 Option
  • Multiple VLANs:
    • Main network (VLAN 1)
    • Guest network (VLAN 8)
    • WireGuard/VPN network (VLAN 15)
  • Three separate "dnsmasq" instances:
    • "lan"
    • "guest"
    • "vpn.lan"

Previously I was using AdGuard Home, and I had a custom upstream DNS configuration for Tenor domains using DoH servers. That setup worked fine, but AdGuard Home was using more resources than I wanted.

Since switching to "dnsmasq-full", "adblock-lean", and "https-dns-proxy", I haven't been able to get "pbr" working properly for these blocked websites.

If anyone is willing to help, I can provide configuration files. Just let me know which ones you need ("pbr", "network", "firewall", "dhcp", WireGuard, etc.) and I'll post them.

Does anyone know what could be causing this?

Thanks!

2
dhcp config 
config odhcpd 'odhcpd'
        option leasefile '/tmp/odhcpd.leases'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
        option piodir '/tmp/odhcpd-piodir'
        option hostsdir '/tmp/hosts'

config dnsmasq 'guest_dns'
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/guest.lan/'
        option domain 'guest.lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases.guest'
        option localservice '1'
        option dnsforwardmax '500'
        option dhcpleasemax '150'
        list interface 'guest'
        list notinterface 'loopback'
        list addnmount '/bin/busybox'
        list addnmount '/var/run/adblock-lean/abl-blocklist.gz'
        list addnmount '/var/run/pbr.dnsmasq'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'
        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        option doh_backup_noresolv '-1'
        option noresolv '1'
        list doh_backup_server '/mask.icloud.com/'
        list doh_backup_server '/mask-h2.icloud.com/'
        list doh_backup_server '/use-application-dns.net/'
        list doh_backup_server '127.0.0.1#5053'
        list doh_backup_server '127.0.0.1#5054'
        list doh_server '127.0.0.1#5053'
        list doh_server '127.0.0.1#5054'

config dhcp 'guest'
        option instance 'guest_dns'
        option interface 'guest'
        option start '100'
        option limit '100'
        option leasetime '1h'
        list dhcp_option '6,192.168.8.1'

config dnsmasq 'lan_vpn_dns'
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/vpn.lan/'
        option domain 'vpn.lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases.lan_vpn'
        option localservice '1'
        option dnsforwardmax '500'
        option dhcpleasemax '150'
        list interface 'lan_vpn'
        list notinterface 'loopback'
        list rebind_domain 'lan'
        list addnmount '/bin/busybox'
        list addnmount '/var/run/adblock-lean/abl-blocklist.gz'
        list addnmount '/var/run/pbr.dnsmasq'
        option doh_backup_noresolv '-1'
        option noresolv '1'
        list doh_backup_server '/lan/127.0.0.1'
        list doh_server '127.0.0.1#5053'
        list doh_server '127.0.0.1#5054'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'
        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'

config dhcp 'lan_vpn'
        option instance 'lan_vpn_dns'
        option interface 'lan_vpn'
        option start '100'
        option limit '100'
        option leasetime '24h'
        option ra 'server'
        option dhcpv6 'server'
        option ra_flags 'managed-config other-config'
        option ra_default '1'
        list dhcp_option '6,10.64.0.1'
        option ra_preference 'medium'

config dnsmasq 'lan_dns'
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases.lan'
        option localservice '1'
        option dnsforwardmax '500'
        option dhcpleasemax '150'
        list interface 'lan'
        list rebind_domain 'lan'
        list addnmount '/bin/busybox'
        list addnmount '/var/run/adblock-lean/abl-blocklist.gz'
        list addnmount '/var/run/pbr.dnsmasq'
        option doh_backup_noresolv '-1'
        option noresolv '1'
        list doh_backup_server '/vpn.lan/192.168.15.1'
        list doh_server '127.0.0.1#5053'
        list doh_server '127.0.0.1#5054'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'
        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'

config dhcp 'lan'
        option instance 'lan_dns'
        option interface 'lan'
        option start '100'
        option limit '100'
        option leasetime '24h'
        list dhcp_option '6,192.168.1.1'
network config 
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid ''
        option ula_prefix ''
        option packet_steering '1'

config device
        option name 'br-vlan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config interface 'lan'
        option device 'br-vlan.1'
        option proto 'static'
        list ipaddr '192.168.1.1/24'
        option multipath 'off'

config device
        option name 'wan'
        option macaddr ''

config interface 'wan'
        option device 'wan'
        option proto 'pppoe'
        option ipv6 '0'
        option username ''
        option password ''
        option metric '5'

config interface 'wan_6'
        option device '@wan'
        option proto 'dhcpv6'
        option metric '10'
        option disabled '1'
        option auto '0'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'
        option multipath 'off'

config interface 'guest'
        option proto 'static'
        list ipaddr '192.168.8.1/24'
        option device 'br-vlan.8'

config interface 'usb0'
        option proto 'dhcp'
        option device 'usb0'
        option metric '15'

config interface 'lan_vpn'
        option proto 'static'
        list ipaddr '192.168.15.1/24'
        option device 'br-vlan.15'
        option multipath 'off'

config interface 'vpn'
        option proto 'wireguard'
        option private_key ''
        option metric '20'
        option multipath 'off'
        list addresses '10.XX.XX.XX/32'

config interface 'vpn_6'
        option proto 'none'
        option device '@vpn'
        option metric '25'
        option multipath 'off'
        option disabled '1'
        option auto '0'

config rule6
        option in 'loopback'
        option lookup '2'
        option priority '999'

config wireguard_vpn
        option public_key ''
        option endpoint_host ''
        option endpoint_port '51820'
        option persistent_keepalive '25'
        option route_allowed_ips '1'
        option description ''
        list allowed_ips '0.0.0.0/0'

config bridge-vlan 'vlan_1'
        option device 'br-vlan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'

config bridge-vlan 'vlan_8'
        option device 'br-vlan'
        option vlan '8'
        list ports 'lan1:t'
        list ports 'lan2:t'
        list ports 'lan3:t'

config bridge-vlan 'vlan_15'
        option device 'br-vlan'
        option vlan '15'
        list ports 'lan1:t'
        list ports 'lan2:t'
        list ports 'lan3:t'
firewall config 
config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone 'wan'
        option name 'wan'
        list network 'wan'
        list network 'wan_6'
        list network 'usb0'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'
        option enabled '1'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
        option enabled '1'

config redirect
        option name 'lan Intercept-DNS'
        option src 'lan'
        option src_dport '53'
        option family 'any'

config zone 'guest'
        option name 'guest'
        list network 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config rule
        option name 'guest Allow-DNS-DHCP-NTP'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'tcp udp'
        option dest_port '53 67 123'
        option enabled '1'

config rule
        option name 'vpn Allow-DNS-DHCP-NTP'
        option src 'lan_vpn'
        option target 'ACCEPT'
        option proto 'tcp udp'
        option dest_port '53 67 123'
        option enabled '1'

config rule
        option name 'guest Allow-Ping'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv4'
        list icmp_type 'echo-request'
        option enabled '1'

config rule
        option name 'vpn Allow-Ping'
        option src 'lan_vpn'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv4'
        list icmp_type 'echo-request'
        option enabled '1'

config rule
        option name 'guest Allow-DHCPv6'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'udp'
        option family 'ipv6'
        option dest_port '546'
        option enabled '1'

config rule
        option name 'vpn Allow-DHCPv6'
        option src 'lan_vpn'
        option target 'ACCEPT'
        option proto 'udp'
        option family 'ipv6'
        option dest_port '546'
        option enabled '1'

config rule
        option name 'guest Allow-MLD'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv6'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option enabled '1'

config rule
        option name 'vpn Allow-MLD'
        option src 'lan_vpn'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv6'
        list src_ip 'fe80::/10'
        option enabled '1'

config rule
        option name 'guest Allow-ICMPv6-Input'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv6'
        option limit '1000/sec'
        list icmp_type 'bad-header'
        list icmp_type 'destination-unreachable'
        list icmp_type 'echo-reply'
        list icmp_type 'echo-request'
        list icmp_type 'neighbour-advertisement'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'packet-too-big'
        list icmp_type 'router-advertisement'
        list icmp_type 'router-solicitation'
        list icmp_type 'time-exceeded'
        list icmp_type 'unknown-header-type'
        option enabled '1'

config rule
        option name 'vpn Allow-ICMPv6-Input'
        option src 'lan_vpn'
        option target 'ACCEPT'
        option proto 'icmp'
        option family 'ipv6'
        option limit '1000/sec'
        list icmp_type 'bad-header'
        list icmp_type 'destination-unreachable'
        list icmp_type 'echo-reply'
        list icmp_type 'echo-request'
        list icmp_type 'neighbour-advertisement'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'packet-too-big'
        list icmp_type 'router-advertisement'
        list icmp_type 'router-solicitation'
        list icmp_type 'time-exceeded'
        list icmp_type 'unknown-header-type'
        option enabled '1'

config redirect
        option name 'guest Intercept-DNS'
        option src 'guest'
        option src_dport '53'
        option family 'any'

config forwarding 'guest_to_wan'
        option src 'guest'
        option dest 'wan'

config zone
        option name 'lan_vpn'
        list network 'lan_vpn'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config zone 'wan_nat6'
        option name 'wan_nat6'
        list network 'vpn'
        option masq '1'
        option masq6 '1'
        option mtu_fix '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config rule
        option name 'Block-DoT-DoQ'
        option src '*'
        option dest '*'
        option dest_port '853'
        option target 'REJECT'
        option enabled '1'

config forwarding
        option src 'lan'
        option dest 'wan_nat6'

config forwarding
        option src 'lan_vpn'
        option dest 'wan_nat6'
pbr config 
config pbr 'config'
        option enabled '1'
        option fw_mask '00ff0000'
        option ipv6_enabled '0'
        option nft_rule_counter '1'
        option nft_set_auto_merge '1'
        option nft_set_counter '1'
        option nft_set_flags_interval '1'
        option nft_set_flags_timeout '0'
        option nft_set_policy 'performance'
        option nft_user_set_counter '0'
        option procd_boot_trigger_delay '5000'
        option procd_reload_delay '0'
        option resolver_set 'dnsmasq.nftset'
        option strict_enforcement '1'
        option uplink_interface 'wan'
        option uplink_interface6 'wan6'
        option uplink_ip_rules_priority '30000'
        option uplink_mark '00010000'
        option verbosity '2'
        list ignored_interface 'vpnserver'
        list lan_device 'br-lan'
        list resolver_instance '*'
        list webui_supported_protocol 'all'
        list webui_supported_protocol 'tcp'
        list webui_supported_protocol 'udp'
        list webui_supported_protocol 'tcp udp'
        list webui_supported_protocol 'icmp'
        option config_compat '26'
        option config_version '1.2.2-r18'
        option rule_create_option 'add'
        option webui_show_ignore_target '0'

config include
        option path '/usr/share/pbr/pbr.user.dnsprefetch'
        option enabled '0'

config include
        option path '/usr/share/pbr/pbr.user.aws'
        option enabled '0'

config include
        option path '/usr/share/pbr/pbr.user.netflix'
        option enabled '0'

config dns_policy
        option name 'Redirect Local IP DNS'
        option src_addr '192.168.1.5'
        option dest_dns '1.1.1.1'
        option enabled '0'

config policy
        option name 'Ignore Local Requests'
        option interface 'ignore'
        option dest_addr '10.0.0.0/24 10.0.1.0/24 192.168.100.0/24 192.168.1.0/24'
        option enabled '0'

config policy
        option name 'Plex/Emby Local Server'
        option interface 'wan'
        option src_port '8096 8920 32400'
        option enabled '0'

config policy
        option name 'Plex/Emby Remote Servers'
        option interface 'wan'
        option dest_addr 'plex.tv my.plexapp.com emby.media app.emby.media tv.emby.media'
        option enabled '0'

config policy
        option name 'Tenor'
        option dest_addr 'tenor.com media.tenor.com c.tenor.com'
        option interface 'vpn'

config policy
        option name 'Discord'
        option dest_addr 'discord.com gateway.discord.gg cdn.discordapp.com discordapp.net discordapp.com discord.gg media.discordapp.net images-ext-1.discordapp.net discord.app discord.media discordcdn.com discord.dev discord.new discord.gift discordstatus.com dis.gd discord.co discord-attachments-uploads-prd.storage.googleapis.com cloudflare-ech.com'
        option interface 'vpn'
3

It only works if you can resolve those domains from the PC/workstation you are connecting.

So check on your PC/workstation from command line: nslookup tenor.com if you can resolve the domain

You can then check on the router with nft list ruleset if the nftset is populated

Note 4 DNS requests are cached, so for testing always flush the DNS cache. This can be done by rebooting the router and the Client you are testing for Openwrt: service dnsmasq restart or only flushing DNSMasq: for p in $(pidof /usr/sbin/dnsmasq); do kill -HUP "$p"; done
Windows (from command line): ipconfig /flushdns
Android: Switch to other WiFi network and back again
For other systems see: https://runcloud.io/blog/flush-dns-cache

4

It's working now, although I'm not entirely sure what fixed it.

The last changes I made were correcting some interface names in the pbr config files. I changed the "wan6" interface name to the one I actually use, which is "wan_6", and I also changed the LAN interface from "br-lan" to "br-lan.1".

After making those changes, things started working.

One thing I noticed is that if PBR is disabled and I run an "nslookup" for Tenor, it fails to resolve and returns a server failure error. However, when PBR is enabled, the same lookup successfully returns an IP address.

So it seems like PBR is now handling the traffic correctly, but I'm still not completely sure which change actually resolved the issue and will it remain like this or not I will reboot my router multiple times to see if it's persistant or not and let you know

nft list ruleset
table inet fw4 {
set pbr_vpn_4_dst_ip_cfg096ff5 {
type ipv4_addr
flags interval
counter
auto-merge
comment "Tenor"
elements = { 34.120.13.18 counter packets 154 bytes 22269,
216.239.32.223 counter packets 16 bytes 10145,
216.239.34.223 counter packets 0 bytes 0,
216.239.36.223 counter packets 0 bytes 0,
216.239.38.223 counter packets 2845 bytes 620885 }
}

    set pbr_vpn_4_dst_ip_cfg0a6ff5 {
            type ipv4_addr
            flags interval
            counter
            auto-merge
            comment "Discord"
            elements = { 162.159.128.233 counter packets 0 bytes 0,
                         162.159.130.234 counter packets 0 bytes 0,
                         162.159.133.234 counter packets 0 bytes 0,
                         162.159.134.234 counter packets 0 bytes 0,
                         162.159.135.232 counter packets 0 bytes 0,
                         162.159.135.234 counter packets 76 bytes 5991,
                         162.159.136.232 counter packets 11 bytes 3554,
                         162.159.136.234 counter packets 0 bytes 0,
                         162.159.137.232 counter packets 0 bytes 0,
                         162.159.138.232 counter packets 0 bytes 0 }
    }

    chain input {
            type filter hook input priority filter; policy drop;
            iif "lo" accept comment "!fw4: Accept traffic from loopback"
            ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
            tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
            iifname "br-vlan.1" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
            iifname { "usb0", "pppoe-wan" } jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
            iifname "br-vlan.8" jump input_guest comment "!fw4: Handle guest IPv4/IPv6 input traffic"
            iifname "br-vlan.15" jump input_lan_vpn comment "!fw4: Handle lan_vpn IPv4/IPv6 input traffic"
            iifname "vpn" jump input_wan_nat6 comment "!fw4: Handle wan_nat6 IPv4/IPv6 input traffic"
            jump handle_reject
    }

    chain forward {
            type filter hook forward priority filter; policy drop;
            ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
            tcp dport 853 counter packets 2 bytes 128 jump handle_reject comment "!fw4: Block-DoT-DoQ"
            udp dport 853 counter packets 0 bytes 0 jump handle_reject comment "!fw4: Block-DoT-DoQ"
            iifname "br-vlan.1" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
            iifname { "usb0", "pppoe-wan" } jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
            iifname "br-vlan.8" jump forward_guest comment "!fw4: Handle guest IPv4/IPv6 forward traffic"
            iifname "br-vlan.15" jump forward_lan_vpn comment "!fw4: Handle lan_vpn IPv4/IPv6 forward traffic"
            iifname "vpn" jump forward_wan_nat6 comment "!fw4: Handle wan_nat6 IPv4/IPv6 forward traffic"
            jump handle_reject
    }

    chain output {
            type filter hook output priority filter; policy accept;
            oif "lo" accept comment "!fw4: Accept traffic towards loopback"
            ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
            oifname "br-vlan.1" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
            oifname { "usb0", "pppoe-wan" } jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
            oifname "br-vlan.8" jump output_guest comment "!fw4: Handle guest IPv4/IPv6 output traffic"
            oifname "br-vlan.15" jump output_lan_vpn comment "!fw4: Handle lan_vpn IPv4/IPv6 output traffic"
            oifname "vpn" jump output_wan_nat6 comment "!fw4: Handle wan_nat6 IPv4/IPv6 output traffic"
    }

    chain prerouting {
            type filter hook prerouting priority filter; policy accept;
            iifname "br-vlan.1" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
            iifname "br-vlan.8" jump helper_guest comment "!fw4: Handle guest IPv4/IPv6 helper assignment"
    }

    chain handle_reject {
            meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
            reject comment "!fw4: Reject any other traffic"
    }

    chain syn_flood {
            limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
            drop comment "!fw4: Drop excess packets"
    }

    chain input_lan {
            udp dport 5353 counter packets 33 bytes 6137 accept comment "!fw4: ubus:umdns[instance1] rule 0"
            ct status dnat accept comment "!fw4: Accept port redirections"
            jump accept_from_lan
    }

    chain output_lan {
            jump accept_to_lan
    }

    chain forward_lan {
            tcp dport 853 counter packets 0 bytes 0 jump handle_reject comment "!fw4: ubus:https-dns-proxy[instance1] rule 1"
            udp dport 853 counter packets 0 bytes 0 jump handle_reject comment "!fw4: ubus:https-dns-proxy[instance1] rule 1"
            jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
            jump accept_to_wan_nat6 comment "!fw4: Accept lan to wan_nat6 forwarding"
            ct status dnat accept comment "!fw4: Accept port forwards"
            jump accept_to_lan
    }

    chain helper_lan {
    }

    chain accept_from_lan {
            iifname "br-vlan.1" counter packets 506 bytes 568615 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
    }

    chain accept_to_lan {
            oifname "br-vlan.1" counter packets 132 bytes 541628 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
    }

    chain input_wan {
            meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
            icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
            meta nfproto ipv4 meta l4proto igmp counter packets 0 bytes 0 accept comment "!fw4: Allow-IGMP"
            meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
            ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . 0, mld-listener-report . 0, mld-listener-done . 0, mld2-listener-report . 0 } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
            icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
            icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, nd-neighbor-solicit . 0, nd-neighbor-advert . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
            jump reject_from_wan
    }

    chain output_wan {
            jump accept_to_wan
    }

    chain forward_wan {
            icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
            icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
            meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
            udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
            jump drop_to_wan
    }

    chain accept_to_wan {
            meta nfproto ipv4 oifname { "usb0", "pppoe-wan" } ct state invalid counter packets 12 bytes 480 drop comment "!fw4: Prevent NAT leakage"
            oifname { "usb0", "pppoe-wan" } counter packets 469 bytes 258110 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
    }

    chain reject_from_wan {
            iifname { "usb0", "pppoe-wan" } counter packets 47 bytes 6953 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
    }

    chain drop_to_wan {
            oifname { "usb0", "pppoe-wan" } counter packets 0 bytes 0 drop comment "!fw4: drop wan IPv4/IPv6 traffic"
    }

    chain input_guest {
            tcp dport { 53, 67, 123 } counter packets 0 bytes 0 accept comment "!fw4: guest Allow-DNS-DHCP-NTP"
            udp dport { 53, 67, 123 } counter packets 0 bytes 0 accept comment "!fw4: guest Allow-DNS-DHCP-NTP"
            icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: guest Allow-Ping"
            meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: guest Allow-DHCPv6"
            ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . 0, mld-listener-report . 0, mld-listener-done . 0, mld2-listener-report . 0 } counter packets 0 bytes 0 accept comment "!fw4: guest Allow-MLD"
            icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: guest Allow-ICMPv6-Input"
            icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, nd-neighbor-solicit . 0, nd-neighbor-advert . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: guest Allow-ICMPv6-Input"
            ct status dnat accept comment "!fw4: Accept port redirections"
            jump reject_from_guest
    }

    chain output_guest {
            jump accept_to_guest
    }

    chain forward_guest {
            jump accept_to_wan comment "!fw4: Accept guest to wan forwarding"
            ct status dnat accept comment "!fw4: Accept port forwards"
            jump reject_to_guest
    }

    chain helper_guest {
    }

    chain accept_to_guest {
            oifname "br-vlan.8" counter packets 0 bytes 0 accept comment "!fw4: accept guest IPv4/IPv6 traffic"
    }

    chain reject_from_guest {
            iifname "br-vlan.8" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject guest IPv4/IPv6 traffic"
    }

    chain reject_to_guest {
            oifname "br-vlan.8" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject guest IPv4/IPv6 traffic"
    }

    chain input_lan_vpn {
            tcp dport { 53, 67, 123 } counter packets 0 bytes 0 accept comment "!fw4: vpn Allow-DNS-DHCP-NTP"
            udp dport { 53, 67, 123 } counter packets 0 bytes 0 accept comment "!fw4: vpn Allow-DNS-DHCP-NTP"
            icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: vpn Allow-Ping"
            meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: vpn Allow-DHCPv6"
            meta l4proto ipv6-icmp ip6 saddr fe80::/10 counter packets 0 bytes 0 accept comment "!fw4: vpn Allow-MLD"
            icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: vpn Allow-ICMPv6-Input"
            icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, nd-neighbor-solicit . 0, nd-neighbor-advert . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: vpn Allow-ICMPv6-Input"
            jump reject_from_lan_vpn
    }

    chain output_lan_vpn {
            jump accept_to_lan_vpn
    }

    chain forward_lan_vpn {
            jump accept_to_wan_nat6 comment "!fw4: Accept lan_vpn to wan_nat6 forwarding"
            jump reject_to_lan_vpn
    }

    chain accept_to_lan_vpn {
            meta nfproto ipv4 oifname "br-vlan.15" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
            oifname "br-vlan.15" counter packets 0 bytes 0 accept comment "!fw4: accept lan_vpn IPv4/IPv6 traffic"
    }

    chain reject_from_lan_vpn {
            iifname "br-vlan.15" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject lan_vpn IPv4/IPv6 traffic"
    }

    chain reject_to_lan_vpn {
            oifname "br-vlan.15" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject lan_vpn IPv4/IPv6 traffic"
    }

    chain input_wan_nat6 {
            jump reject_from_wan_nat6
    }

    chain output_wan_nat6 {
            jump accept_to_wan_nat6
    }

    chain forward_wan_nat6 {
            jump reject_to_wan_nat6
    }

    chain accept_to_wan_nat6 {
            oifname "vpn" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
            oifname "vpn" counter packets 8 bytes 672 accept comment "!fw4: accept wan_nat6 IPv4/IPv6 traffic"
    }

    chain reject_from_wan_nat6 {
            iifname "vpn" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan_nat6 IPv4/IPv6 traffic"
    }

    chain reject_to_wan_nat6 {
            oifname "vpn" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan_nat6 IPv4/IPv6 traffic"
    }

    chain dstnat {
            type nat hook prerouting priority dstnat; policy accept;
            jump pbr_dstnat
            iifname "br-vlan.1" jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic"
            iifname "br-vlan.8" jump dstnat_guest comment "!fw4: Handle guest IPv4/IPv6 dstnat traffic"
    }

    chain srcnat {
            type nat hook postrouting priority srcnat; policy accept;
            oifname { "usb0", "pppoe-wan" } jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
            oifname "br-vlan.15" jump srcnat_lan_vpn comment "!fw4: Handle lan_vpn IPv4/IPv6 srcnat traffic"
            oifname "vpn" jump srcnat_wan_nat6 comment "!fw4: Handle wan_nat6 IPv4/IPv6 srcnat traffic"
    }

    chain dstnat_lan {
            tcp dport 53 counter packets 0 bytes 0 redirect to :53 comment "!fw4: ubus:https-dns-proxy[instance1] redirect 0"
            udp dport 53 counter packets 319 bytes 23174 redirect to :53 comment "!fw4: ubus:https-dns-proxy[instance1] redirect 0"
            tcp dport 53 counter packets 0 bytes 0 redirect to :53 comment "!fw4: lan Intercept-DNS"
            udp dport 53 counter packets 0 bytes 0 redirect to :53 comment "!fw4: lan Intercept-DNS"
    }

    chain srcnat_wan {
            meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
    }

    chain dstnat_guest {
            tcp dport 53 counter packets 0 bytes 0 redirect to :53 comment "!fw4: guest Intercept-DNS"
            udp dport 53 counter packets 0 bytes 0 redirect to :53 comment "!fw4: guest Intercept-DNS"
    }

    chain srcnat_lan_vpn {
            meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 lan_vpn traffic"
    }

    chain srcnat_wan_nat6 {
            meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan_nat6 traffic"
            meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 wan_nat6 traffic"
    }

    chain raw_prerouting {
            type filter hook prerouting priority raw; policy accept;
    }

    chain raw_output {
            type filter hook output priority raw; policy accept;
    }

    chain mangle_prerouting {
            type filter hook prerouting priority mangle; policy accept;
            jump pbr_prerouting
    }

    chain mangle_postrouting {
            type filter hook postrouting priority mangle; policy accept;
            oifname { "usb0", "pppoe-wan" } tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
            oifname "br-vlan.15" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone lan_vpn IPv4/IPv6 egress MTU fixing"
            oifname "vpn" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan_nat6 IPv4/IPv6 egress MTU fixing"
    }

    chain mangle_input {
            type filter hook input priority mangle; policy accept;
    }

    chain mangle_output {
            type route hook output priority mangle; policy accept;
            jump pbr_output
    }

    chain mangle_forward {
            type filter hook forward priority mangle; policy accept;
            iifname { "usb0", "pppoe-wan" } tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
            iifname "br-vlan.15" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone lan_vpn IPv4/IPv6 ingress MTU fixing"
            iifname "vpn" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan_nat6 IPv4/IPv6 ingress MTU fixing"
            jump pbr_forward
    }

    chain pbr_dstnat {
    }

    chain pbr_forward {
            counter packets 45896 bytes 46230737 meta mark & 0x00ff0000 != 0x00000000 return
    }

    chain pbr_output {
            counter packets 2497 bytes 1397005 meta mark & 0x00ff0000 != 0x00000000 return
    }

    chain pbr_prerouting {
            counter packets 51294 bytes 54303867 meta mark & 0x00ff0000 != 0x00000000 return
            ip daddr @pbr_vpn_4_dst_ip_cfg096ff5 counter packets 3015 bytes 653299 goto pbr_mark_0x020000 comment "Tenor"
            ip daddr @pbr_vpn_4_dst_ip_cfg0a6ff5 counter packets 87 bytes 9545 goto pbr_mark_0x020000 comment "Discord"
    }

    chain pbr_mark_0x010000 {
            counter packets 0 bytes 0 meta mark set meta mark & 0xff01ffff | 0x00010000
            return
    }

    chain pbr_mark_0x020000 {
            counter packets 3102 bytes 662844 meta mark set meta mark & 0xff02ffff | 0x00020000
            return
    }

}

Warning: table ip mangle is managed by iptables-nft, do not touch!

table ip mangle {
chain mwan3_ifaces_in {
meta mark & 0x00003f00 == 0x00000000 counter packets 1903 bytes 563867 jump mwan3_iface_in_vpn
meta mark & 0x00003f00 == 0x00000000 counter packets 1687 bytes 477185 jump mwan3_iface_in_wan
}

    chain mwan3_custom_ipv4 {
            xt match "set" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_connected_ipv4 {
            xt match "set" counter packets 847 bytes 67139 xt target "MARK"
    }

    chain mwan3_dynamic_ipv4 {
            xt match "set" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_rules {
            ip saddr 192.168.15.0/24 meta mark & 0x00003f00 == 0x00000000 counter packets 0 bytes 0 jump mwan3_policy_vpn_only
            ip protocol tcp xt match "multiport" meta mark & 0x00003f00 == 0x00000000 counter packets 778 bytes 40937 jump mwan3_rule_https
            meta mark & 0x00003f00 == 0x00000000 counter packets 1177 bytes 691977 jump mwan3_policy_balanced
    }

    chain mwan3_hook {
            meta mark & 0x00003f00 == 0x00000000 counter packets 114136 bytes 129372436 xt target "CONNMARK"
            meta mark & 0x00003f00 == 0x00000000 counter packets 2727 bytes 800194 jump mwan3_ifaces_in
            meta mark & 0x00003f00 == 0x00000000 counter packets 2662 bytes 789312 jump mwan3_custom_ipv4
            meta mark & 0x00003f00 == 0x00000000 counter packets 2662 bytes 789312 jump mwan3_connected_ipv4
            meta mark & 0x00003f00 == 0x00000000 counter packets 1955 bytes 732914 jump mwan3_dynamic_ipv4
            meta mark & 0x00003f00 == 0x00000000 counter packets 1955 bytes 732914 jump mwan3_rules
            counter packets 115104 bytes 130253587 xt target "CONNMARK"
            meta mark & 0x00003f00 != 0x00003f00 counter packets 111571 bytes 126727254 jump mwan3_custom_ipv4
            meta mark & 0x00003f00 != 0x00003f00 counter packets 111571 bytes 126727254 jump mwan3_connected_ipv4
            meta mark & 0x00003f00 != 0x00003f00 counter packets 111431 bytes 126716513 jump mwan3_dynamic_ipv4
    }

    chain PREROUTING {
            type filter hook prerouting priority mangle; policy accept;
            counter packets 110905 bytes 127470155 jump mwan3_hook
    }

    chain OUTPUT {
            type route hook output priority mangle; policy accept;
            counter packets 4199 bytes 2783432 jump mwan3_hook
    }

    chain mwan3_policy_balanced {
            meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 1200 bytes 401848 xt target "MARK"
    }

    chain mwan3_policy_wan_only {
            meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_policy_usb0_only {
            meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_policy_vpn_only {
            meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_rule_https {
            meta mark & 0x00003f00 == 0x00000000 counter packets 778 bytes 40937 jump mwan3_policy_balanced
            meta mark & 0x0000fc00 != 0x0000fc00 counter packets 778 bytes 40937 xt target "SET"
            meta mark & 0x0000fc00 != 0x0000fc00 counter packets 778 bytes 40937 xt target "SET"
    }

    chain mwan3_iface_in_vpn {
            iifname "vpn" xt match "set" meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
            iifname "vpn" xt match "set" meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
            iifname "vpn" xt match "set" meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
            iifname "vpn" meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_iface_in_wan {
            iifname "pppoe-wan" xt match "set" meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
            iifname "pppoe-wan" xt match "set" meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
            iifname "pppoe-wan" xt match "set" meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
            iifname "pppoe-wan" meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 65 bytes 10882 xt target "MARK"
    }

}

Warning: table ip6 mangle is managed by iptables-nft, do not touch!

table ip6 mangle {
chain mwan3_ifaces_in {
}

    chain mwan3_custom_ipv6 {
            xt match "set" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_connected_ipv6 {
            xt match "set" counter packets 195 bytes 17012 xt target "MARK"
    }

    chain mwan3_dynamic_ipv6 {
            xt match "set" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_rules {
            ip6 saddr fd36:45b7:3080:10::/60 meta mark & 0x00003f00 == 0x00000000 counter packets 0 bytes 0 jump mwan3_policy_vpn_only
            meta l4proto tcp xt match "multiport" meta mark & 0x00003f00 == 0x00000000 counter packets 0 bytes 0 jump mwan3_rule_https
            meta mark & 0x00003f00 == 0x00000000 counter packets 139 bytes 16151 jump mwan3_policy_balanced
    }

    chain mwan3_hook {
            meta l4proto ipv6-icmp xt match "icmp6" counter packets 23 bytes 1288 return
            meta l4proto ipv6-icmp xt match "icmp6" counter packets 26 bytes 2456 return
            meta l4proto ipv6-icmp xt match "icmp6" counter packets 18 bytes 1296 return
            meta l4proto ipv6-icmp xt match "icmp6" counter packets 5 bytes 336 return
            meta l4proto ipv6-icmp xt match "icmp6" counter packets 0 bytes 0 return
            meta mark & 0x00003f00 == 0x00000000 counter packets 670 bytes 78276 xt target "CONNMARK"
            meta mark & 0x00003f00 == 0x00000000 counter packets 334 bytes 33163 jump mwan3_ifaces_in
            meta mark & 0x00003f00 == 0x00000000 counter packets 334 bytes 33163 jump mwan3_custom_ipv6
            meta mark & 0x00003f00 == 0x00000000 counter packets 334 bytes 33163 jump mwan3_connected_ipv6
            meta mark & 0x00003f00 == 0x00000000 counter packets 139 bytes 16151 jump mwan3_dynamic_ipv6
            meta mark & 0x00003f00 == 0x00000000 counter packets 139 bytes 16151 jump mwan3_rules
            counter packets 822 bytes 94339 xt target "CONNMARK"
            meta mark & 0x00003f00 != 0x00003f00 counter packets 373 bytes 43854 jump mwan3_custom_ipv6
            meta mark & 0x00003f00 != 0x00003f00 counter packets 373 bytes 43854 jump mwan3_connected_ipv6
            meta mark & 0x00003f00 != 0x00003f00 counter packets 373 bytes 43854 jump mwan3_dynamic_ipv6
    }

    chain PREROUTING {
            type filter hook prerouting priority mangle; policy accept;
            counter packets 457 bytes 46985 jump mwan3_hook
    }

    chain OUTPUT {
            type route hook output priority mangle; policy accept;
            counter packets 437 bytes 52730 jump mwan3_hook
    }

    chain mwan3_policy_balanced {
            meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 59 bytes 5454 xt target "MARK"
    }

    chain mwan3_policy_wan_only {
            meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_policy_usb0_only {
            meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_policy_vpn_only {
            meta mark & 0x00003f00 == 0x00000000 xt match "comment" counter packets 0 bytes 0 xt target "MARK"
    }

    chain mwan3_rule_https {
            meta mark & 0x00003f00 == 0x00000000 counter packets 0 bytes 0 jump mwan3_policy_balanced
            meta mark & 0x0000fc00 != 0x0000fc00 counter packets 0 bytes 0 xt target "SET"
            meta mark & 0x0000fc00 != 0x0000fc00 counter packets 0 bytes 0 xt target "SET"
    }

}
table inet https_dns_proxy_notrack {
chain raw_output {
type filter hook output priority raw; policy accept;
meta l4proto { tcp, udp } th dport { 5053, 5054 } ip daddr 127.0.0.0/8 notrack
meta l4proto { tcp, udp } th sport { 5053, 5054 } ip saddr 127.0.0.0/8 notrack
}
}

5

Are you using mwan3?

6

Oh yeah I forgot to mention I got this configuration from "WrtNova" so it had mwan3, yes
I did some modifications myself other then that it was all automated first boot uci defaults one
Does it mess with PBR?

7

mwan3 does not always play nice with PBR.

Better ask your questions then at WrtNova , there are a lot of things in your configuration I would do different, but if it works for you then fine :slight_smile:

Perhaps there are more surprises at your config we do not know but good luck with it

8

Oh, okay. I'll ask there next time.

If you're saying that mwan3 can interfere with pbr, I can uninstall it if it's not needed.

If you want to give me hints at what might be wrong with my configuration I can try troubleshooting it myself. That's usually how I've done things in the past. I only tried WrtNova this time to get a reference configuration and see how a more complete setup would be structured.

My setup is fairly simple overall it's mostly just separate VLANs, tethering failover, and a WireGuard VPN.

9

Let me know if you think I should uninstall "mwan3"

It's not working fine that's the issue as I told you it sometimes works sometimes doesn't most of the time doesn't

10

If you use tethering failover you probably need it or another packages for wan failover

11

I don't use it most of the time I added it because it was a nice addition you never know when one might need it if main internet goes down for a while

I want to do all of this setup myself from scratch the only thing I get stuck at is how to get a seperated wireguard vpn that I never understood myself how to do because from the time I'm using wrtnova I keep running into issues with stuff when I try to add things or want to edit something

12

If you want to learn it then the best thing is to set it up yourself :slight_smile:
Setting up a separate WireGuard VPN is simple:
WireGuard Client Setup Guide

For a Guest interface:

VLANs are used to connect downstream AP's, are you using it for that?
If not then you do not need VLANs but can simply use the Guest interfaces

If you do need it then see:

But your VLANs look OK assuming you need tagging on all the ports

13

The way I originally set up the Guest Network was by creating an empty bridge and then creating an interface attached to it. I used the force dhcp option and configured it to use Google and Cloudflare DNS servers.

I then added a firewall traffic rule to allow only DHCP traffic, since DNS was already being handled by the Force DHCP option. After that, I simply attached the wireless SSID to the network and the firewall zone to forward to wan the setup was complete.

I basically followed the same guide for Guest Network you sent :smiley:

14

Yes that looks fine you can make a second "Guest" interface which you can dedicate for e.g VPN using PBR.

If you have only this one router and no AP's there is no need for VLANs

15

Thanks for the help! I appericiate it :slightly_smiling_face:
I'm gonna make my own setup from scratch again.. :sweat_smile: and if I get stuck I'll ask in another forum about that issue and ask here about pbr when I get to that point in setup

16

Hello!

I followed the guides you provided.

I already knew how to set up the Guest Network, so that wasn't a problem. However, I'm having trouble with the WireGuard setup.

As soon as I enable the WireGuard interface, my main network loses internet access, and the VPN network doesn't work either.

What I'm trying to do is a completely separate VPN network. I don't want to use pbr to selectively route devices through the VPN. Instead, I want a dedicated Wi-Fi SSID where all traffic is automatically routed through the WireGuard VPN, while my main network continues to use the normal WAN connection without being affected.

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        list addnmount '/var/run/pbr.dnsmasq'
        option dnsforwardmax '500'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option leasefile '/tmp/odhcpd.leases'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
        option piodir '/tmp/odhcpd-piodir'
        option hostsdir '/tmp/hosts'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '1h'
        option dhcpv4 'server'

config dhcp 'vpn'
        option interface 'vpn'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        list dhcp_option '6,100.64.0.7'

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid '0004df7895168a744ec8b518446ae777a9ec'
        option ula_prefix 'fdc4:fab:4ac8::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        list ipaddr '192.168.1.1/24'
        option multipath 'off'

config device
        option name 'wan'
        option macaddr 'a0:40:a0:5f:1f:c9'

config interface 'wan'
        option device 'wan'
        option proto 'pppoe'
        option username 'xxx'
        option password 'xxx'
        option ipv6 'auto'
        option norelease '1'
        option multipath 'off'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.5.1'
        option netmask '255.255.255.0'
        option multipath 'off'

config interface 'wg_mullvad'
        option proto 'wireguard'
        option private_key 'xxxx'
        list addresses 'xx.xx.xxx.xxx/32'
        option multipath 'off'
        option auto '0'

config wireguard_wg_mullvad
        option description 'de-dus-wg-001'
        option public_key 'xxxxx'
        list allowed_ips '0.0.0.0/0'
        option route_allowed_ips '1'
        option endpoint_host 'xxx.xxx.xx.x'
        option endpoint_port '51820'
        option persistent_keepalive '25'

config device
        option type 'bridge'
        option name 'br-vpn'
        option bridge_empty '1'

config interface 'vpn'
        option proto 'static'
        option device 'br-vpn'
        option ipaddr '192.168.15.1'
        option netmask '255.255.255.0'
        option multipath 'off'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'
        option enabled '1'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
        option enabled '1'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'wan'

config rule
        option src 'guest'
        option name 'guest Allow-DNS-Guest'
        option dest_port '53'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option src 'vpn'
        option name 'vpn Allow-DNS-Guest'
        option dest_port '53'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option src 'guest'
        option name 'guest Allow-DHCP-Guest'
        option dest_port '67'
        option target 'ACCEPT'
        list proto 'udp'
        option enabled '1'

config rule
        option src 'vpn'
        option name 'vpn Allow-DHCP-Guest'
        option dest_port '67'
        option target 'ACCEPT'
        list proto 'udp'
        option enabled '1'

config zone
        option name 'vpn'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'vpn'

config zone
        option name 'wan_nat6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wg_mullvad'

config forwarding
        option src 'vpn'
        option dest 'wan_nat6'
17

Not related but remove option masq and option mtu_fix
This is your guest interface and should be setup just like the LAN interface

Is your WireGuard interface started?

What does wg show show?

It looks like you did not enable the WG interface at startup

If you enable the WG interface you should have internet from your guest (vpn) interface via Mullvad

18

I disabled it for time being to get internet access back

I'll try that and I'll make a seperate post for this

Thanks

19

wg show

It show's me the latest handshake but internet is still not working on main network

20

But does it work on the guest vpn network?