Traffic separation via ipset

Installing and Using OpenWrt
1

Hello everyone. I tried PBR earlier, but for some unknown reason it does not work in the corresponding topic for a week there was no answer to my problem and I tried to divide traffic by ip set.

In theory, I did everything I needed to do: I marked the traffic from the Ip set, sent it to the table, I send the table to the interface, but it doesn't work. Any idea where I went wrong?

board

{
        "kernel": "5.15.162",
        "hostname": "6CROUTER",
        "system": "Qualcomm Atheros QCA9533 ver 2 rev 0",
        "model": "TP-Link TL-WR842N v3",
        "board_name": "tplink,tl-wr842n-v3",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.4",
                "revision": "r24012-d8dd03c46f",
                "target": "ath79/generic",
                "description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
        }
}

network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd4a:983f:b1a7::/48'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'
        option defaultroute '0'
        option delegate '0'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 3 4 0t'

config interface 'MKPN'
        option proto 'pppoe'
        option device 'eth1'
        option username '**********'
        option password '***********'
        option ipv6 '0'
        option keepalive '2 1'
        option mtu '1480'
        option peerdns '0'
        list dns '10.10.10.10'
        option sourcefilter '0'
        option delegate '0'

config interface 'ovpn'
        option proto 'none'
        option device 'tun0'

config rule
        option priority '100'
        option out 'ovpn'
        option lookup 'ovpn'

firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        option mtu_fix '1'
        list network 'MKPN'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config ipset
        option name 'test'
        option family 'ipv4'
        list match 'dest_net'
        option loadfile '/etc/luci-uploads/test.lst'
        option enabled '1'

config rule
        option name 'Mark test ips'
        option src 'lan'
        option ipset 'test'
        option target 'MARK'
        option set_mark '0x1'
        option family 'ipv4'
        option dest '*'
        list proto 'all'

config zone
        option name 'ovpn'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'ovpn'

config forwarding
        option src 'lan'
        option dest 'ovpn'

test.lst

195.201.201.32
172.217.7.196
184.150.153.143
2

If I understand correctly, you want to route the IP addresses from the set via the ovpn interface.

Replace this with

config rule
        option lookup '101'
        option mark '0x1'

config route
        option interface 'ovpn'
        option table '101'
        option target '0.0.0.0/0'

and restart the network service.

If it still doesn't work, post the output of

nft list set inet fw4 test; nft list chain inet fw4 mangle_prerouting; ip ru; ip ro li ta 101
2 Likes
3

What is it option lookup 101? May be option lookup 'ovpn'?

ovpn also is table with number 99. Sorry about that.

4

If it is declared in /etc/iproute2/rt_tables, you can replace 101 with ovpn in both sections.

1 Like
5

Thank you. It's working. I kind of understand the second rule, but what does the first one do?
It is possible that it associates all packages with the label 0x1 with the specified table

6

Exactly. It creates an ip rule that uses as selector fwmark 0x1 (set by fw4) and forwards all marked packets to custom routing table 99 (ovpn).

The second section populates a default route through the vpn interface in routing table 99.

7

Thank you :grinning:

1 Like
8

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.