[SOLVED] One interface on vpn without pbr

[notthesun]

good morning everyone, in anticipation of the update to version 22.03 I would like to set a static route to direct the traffic of a single interface via vpn. the default gateway remains wan. currently to do this I use pbr which, however, is not fully compatible with fw4. any help is appreciated. thanks

[Lynx]

The typical VPN pbr option with outdated iptables reliance is not needed for such things anymore with netifd VPN pbr support in OpenWrt/LuCi:

Set different Upstream for specific source IP

In addition to the above perhaps this example might help provide inspiration: The idea is to set a routing table for each interface and then set rules for routing packets through each interface. I think the reason your rule above doesn't work is because it lacks a routing table for VPN. So I think you should label tables as described here: Here are mine: root@OpenWrt:~# cat /etc/iproute2/rt_tables # # reserved values # 128 prelocal 255 local 254 main 253 default 0 …

It's not that well documented but when setup as I have written above you can easily create custom rules in LuCi to direct traffic as desired.

[notthesun]

Thank you for your help, this solution works really well and is super easy to set up.
Anyway I would like to ask you a couple of questions regarding the configuration of the other interfaces and security.
okay if I set the routing only for the vpn interface leaving the rest by default?

Testing everything seems to work as it should.
The second question is about the firewall, using netifd instead of pbr does something at the level of killswitch vpn? my firewall is set up like this.

Thank you.

[Lynx]

If I understand you correctly you want to ensure the only way for traffic to get out is via VPN.

I think you have that but I'd feel more comfortable with @trendy or @patrakov taking over to help you verify this.

[patrakov]

My approach to this would be via mwan3.

[notthesun]

no, I think I explained myself badly, the traffic generated by the LAN interface must go out the vpn while iot and home from the wan (so from my isp). verifying the ip actually the interfaces get the correct public ip. my question refers to the Killswitch in case the vpn goes down, usually with pbr and the firewall set as in the picture if this happened the clients connected to the vpn lost the connection. I would like the same thing to happen now.

[patrakov]

Still, one of the possible answers is mwan3. It can function as a kill switch. You create two policies, wan_only and vpn_only, and some rules that decide what to use based on the source IP.

[notthesun]

thank you. i have never used mwan3, i will take a look at it. I insist on using the firewall only because I want to keep the system as simple as possible. anyway thank you