Suddenly appearing fix host routes to specific interface

Installing and Using OpenWrt
1

First, I love OpenWRT and use it quite a bit.
I'm using wman3, 2 wireguard vpns to 2 different servers, ETHs are splitted/VLAN, WAN, WAN via UMTS/USB-Dongle as backup. Most things are connected through routing.

I have the problem that after a while (maybe if UMTS goes down/up multiple times?), that static routes appearing to my 2 servers (144.76.61.xxx,144.76.187.xxx). Sometimes fix to UMTS device, but most times to eth0.2 (WAN).
If then WAN failes, the servers are not reachable via UMTS cause of fix routing entries. If I delete the rules manually, its working via UMTS/WAN again.
Please help me which module/function add such entries...
Today I added to /etc/wman3.user, not sure if it will help....:
if [ ip route show 144.76.61.xxx proto static | wc -l -ne 0 ]; then
logger "Removed ip table 0 s2.v4u.at entry"
ip route del 144.76.61.xxx proto static
fi

Thanks!

Info: ip route output
default via 192.168.0.254 dev eth0.2 proto static src 192.168.0.118 metric 10
default via 10.64.64.64 dev 3g-umts proto static metric 20
10.9.1.1 dev wgv4u proto static scope link
10.34.1.0/24 dev eth0.1 proto kernel scope link src 10.34.1.1
10.34.2.0/24 dev eth0.3 proto kernel scope link src 10.34.2.1
10.64.64.64 dev 3g-umts proto kernel scope link src 10.32.107.59
144.76.61.xxx via 192.168.0.254 dev eth0.2 proto static metric 10
144.76.187.xxx via 192.168.0.254 dev eth0.2 proto static metric 10
192.168.0.0/24 dev eth0.2 proto static scope link metric 10

OpenWrt 18.06.1 r7258-5eb055306f ar71xx/nand

2

When using wireguard (and other tunnels such as GRE) in openwrt host routes are automatically added for the remote endpoint(s). It will use the route which openwrt knows about when bringing the wireguard interface up.

I have been forced to add host routes myself since openwrt unfortunately doesn't care about dynamic routing protocols, such as babeld, which I use in my network.

BTW the route is added by the call to proto_add_host_dependency in /lib/netifd/proto/wireguard.sh

Edit: The host routes are useful if you for example use 0.0.0.0/0 or ::/0 in AllowedIPs and have enabled Route Allowed IPs. But it is possible to instead use policy routing using firewall marks.

1 Like
3

Thank you very much!
With your help i found the wg config option "nohostroute". But its very new:

Will try to update/patch...