Wireguard, Trying route specific device via ISP

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,

Im running Openwrt and Luci on my router with Wireguard. Everything has working perfectly and I got help here last time to exclude my TV/Xbox from the VPN tunnel and go via ISP instead.

Now I got VPN on my Xbox again and I dont know why.

Installed it thru this guide Mullvad Wireguard
Here is my previous thread when I got helped. OpenWRT Forum

Thanks!

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth1 eth2'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        list dns '46.227.67.134'
        list dns '192.165.9.158'

config interface 'wan'
        option ifname 'eth0'
        option proto 'dhcp'

config interface 'wan6'
        option ifname 'eth0'
        option proto 'dhcpv6'

config interface 'WGINTERFACE'
        option proto 'wireguard'
        option force_link '1'
        list addresses '10.65.190.34/32'
        option private_key '*******'
        option listen_port '51820'

config wireguard_WGINTERFACE
        option description 'Mullvad VPN'
        option route_allowed_ips '1'
        option persistent_keepalive '0'
        option public_key '****'
        option endpoint_port '51820'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::0/0'
        option endpoint_host '185.195.233.71'

config rule
        option in 'lan'
        option src '192.168.1.170' (XBOX)
        option lookup '100'

config route
        option interface 'wan'
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option table '100'
        option gateway '81.224.36.1' (ISP)

package firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        option masq '1'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config zone
        list network 'WGINTERFACE'
        option name 'WGZONE'
        option mtu_fix '1'
        option input 'REJECT'
        option forward 'REJECT'
        option masq '1'
        option output 'ACCEPT'

config forwarding
        option dest 'WGZONE'
        option src 'lan'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'any'
        option reload '1'

config rule
        option target 'ACCEPT'
        option src 'lan'
        option family 'ipv4'
        option proto 'all'
        option dest 'wan'
        option name 'forward tv'
        option src_ip '192.168.1.170' (XBOX)
1 Like
2

The ip rules require the use of CIDR notation, so change

to option src '192.168.1.170/32' and restart the network service.

1 Like
3

I have now changed it.

config rule
        option in 'lan'
        option src '192.168.1.170/32'
        option lookup '100'

Do I also need to change it here?

config rule
        option target 'ACCEPT'
        option src 'lan'
        option family 'ipv4'
        option proto 'all'
        option dest 'wan'
        option name 'forward tv'
        option src_ip '192.168.1.170'
4

No, in firewall rules it works both ways.
If it still doesn't work, post the output of ip rule; ip route list table 100

1 Like
5

This is what I get?

0:      from all lookup local
1:      from all iif br-lan lookup 100
32766:  from all lookup main
32767:  from all lookup default
6

The ip rule is fine, but there is no info about routing table 100.

Try to populate it manualy:

ip route add default via 81.224.36.1 table 100

and then run ip ro li ta 100 again.

1 Like
7 
default via 81.224.36.1 dev WGINTERFACE
8

Run

uci set network.wan.metric='10'
uci commit network
/etc/init.d/network restart
ip ro li ta 100
1 Like
9

Yes, did it. And then?

10

Did routing table 100 change?

11

This is out of my knowledge. But if I run the same command that you wrote here before I got the same output.

12

I'd say your approach is wrong as the WAN gateway is prone to change.
Instead, you just need to properly arrange routing tables and rules:

uci -q delete network.@route[0]
uci -q delete network.@rule[0]
uci set network.lan.ip4table="1"
uci set network.lan.ip6table="1"
uci set network.wan.ip4table="2"
uci set network.wan.ip6table="2"
uci -q delete network.lan_wan
uci set network.lan_wan="rule"
uci set network.lan_wan.in="lan"
uci set network.lan_wan.lookup="2"
uci set network.lan_wan.priority="30000"
uci set network.lan_wan.src="192.168.1.170/32"
uci commit network
/etc/init.d/network restart
2 Likes
13

Absolute perfect! Now I got my ISP IP-adress on my XBOX. Thanks!

Edit: For somehow my gateway adress on wan changed. So it wasn´t the one that I typed in before. Weird.

1 Like
14

This is normal, you should never treat WAN gateway as permanent, unless you own that upstream device and manage it yourself, or it is explicitly stated as permanent in your ISP contract.

2 Likes
15

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.