VPN Policy-Based Routing + Web UI -- Discussion

[fefu]

Hi, @eb3f73

@eb3f73

when I bring ovpnc0 down, all traffic is routed through wan.

¿Have you tried "Strict enforcement" on VPN --> VPN Policy Routing --> Basic configuration?

@eb3f73

• When I drop ovpnc0, all traffic gets routed through wan. I need to make sure that only policy exceptions get routed to wan, even if ovpnc0 is down. I thought this would happen with strict_enforcement=1, but that doesn't seem to be working as advertised.

¿Have you tried to set the LAN DNSs to the ones offered by the ovpnc0 on Network --> Interfaces --> LAN --> Use custom DNS servers? It seems you already enabled it, but just to be sure from Luci in case there are any typos in the configuration file.

@eb3f73

• I am using my OpenWRT instance to resolve names for my local network participants, but I can't figure out how to route DNSMASQ's own requests through vpnclient. As far as I can tell, those are all going through wan (whether or not ovpnc0 is up), which feels like a leak to me.

I don't see any custom routing rules in your /etc/config/vpn-policy-routing file ¿Have you tried to route requests to port 53 thru ovpnc0?

¿Have you tried disabling the "Use DNS servers advertised by peer" option in the WAN adapter and adding your preferred on the "Use custom DNS servers" field (on Network --> Interfaces --> WAN --> Advanced Settings)?

¿Have you configured the firewall to enable request to the ovpnc0's DNS servers and block any request port 53 to any other server?

¿Have you configured the firewall to forward DNS request to your favorite servers?

You can always configure your own nameserver (using bind, for example) to resolve names locally and without asking your Internet provider's servers.

There are also previous posts if you might want to explore further.

Hope some of this ideas will make you a nicer day.