Hi, I have a TP-Link 1043nd running Barrier Breaker r36139. OpenVPN is installed and running as a client for mullvad. I start OpenVPN using this line in rc.local: [code]/usr/sbin/openvpn --cd /etc/openvpn --daemon --config /etc/openvpn/mullvad_linux.conf &[/code] What currently happens is that all network traffic is routed through tun0. [b]I want my normal network traffic to go through the normal WAN, my ISP's ip address. Only one LAN ip (and preferably only certain ports e.g. 192.168.1.3:1234) should go through tun0.[/b] How do I configure that? This is my client config file: [code]# Notice to Mullvad customers: # # Apart from openvpn, you also need to install the # package "resolvconf", available via apt, e.g. # # For those of you behind very restrictive firewalls, # you can use our tunnels on tcp port 443, as well as # on udp port 53. client dev tun proto udp #proto tcp remote openvpn.mullvad.net 1194 #remote openvpn.mullvad.net 443 #remote openvpn.mullvad.net 53 #remote se.mullvad.net # Servers in Sweden #remote nl.mullvad.net # Servers in the Netherlands # Keep trying indefinitely to resolve the # host name of the OpenVPN server. Very useful # on machines which are not permanently connected # to the internet such as laptops. resolv-retry infinite # Most clients don't need to bind to # a specific local port number. nobind # Try to preserve some state across restarts. persist-key persist-tun # Enable compression on the VPN link. comp-lzo # Set log file verbosity. verb 3 remote-cert-tls server ping-restart 60 # Allow calling of built-in executables and user-defined scripts. script-security 2 # Parses DHCP options from openvpn to update resolv.conf # up /etc/openvpn/update-resolv-conf # down /etc/openvpn/update-resolv-conf ping 10 ca master.mullvad.net.crt cert mullvad.crt key mullvad.key[/code] Note that I had to comment out these lines as OpenWRT hasn't got an update-resolv-conf script and OpenVPN wouldn't start without it being commented out: [code]# Parses DHCP options from openvpn to update resolv.conf # up /etc/openvpn/update-resolv-conf # down /etc/openvpn/update-resolv-conf[/code] So basically these are my default routes: [code]root@OpenWrt-Beneden:~# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.0.1 0.0.0.0 UG 0 0 0 br-wan 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 br-wan 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan[/code] After connection with my vpn provider (mullvad), these routes are pushed and added to the table: [code]Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.0.1 0.0.0.0 UG 0 0 0 br-wan 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 br-wan 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan default 10.8.0.81 128.0.0.0 UG 0 0 0 tun0 #added 128.0.0.0 10.8.0.81 128.0.0.0 UG 0 0 0 tun0 #added 10.8.0.1 10.8.0.81 255.255.255.255 UGH 0 0 0 tun0 #added 10.8.0.81 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 #added 199.115.114.209 192.168.0.1 255.255.255.255 UGH 0 0 0 br-wan #added[/code] I've reordered them to better understand what's going on. The first two newly added routes basically overwrite the default route that already exists, because it's more specific! This means all traffic is routed through tun0, which I don't want. So what I want is that the first two lines aren't pushed. The other three added routes seem necessary ;-) It appears that it's a server configuration called 'redirect-gateway' that is causing this. As I don't own the server, I can't disable it. I could add 'route-nopull' to the client config file, but that would also stop the last three routes being added and I need those. Last possibility is using a script to remove the two routes after a vpn connection has been established. Would this be a good script? [code]route del -net 0.0.0.0/1 gw xxx.xxx.xxx.xxx tun0 #in this case 10.8.0.81 route del -net 128.0.0.0/1 gw xxx.xxx.xxx.xxx tun0 route add -host 192.168.1.3/32 gw xxx.xxx.xxx.xxx tun0 #added to route only my nas box through the vpn tunnel[/code] Should I add a link to this script at the end of the vpn client configuration file? How will I know which ip address to route 192.168.1.3 to (the x's)? Mullvad uses more than one vpn server so that ip address changes...

So I added route-nopull. This is the new routing table: [code]root@OpenWrt-Beneden:~# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 br-wan 10.8.0.41 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 br-wan 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan [/code] Two other routes that are normally pushed are missing: [code]Destination Gateway Genmask Flags Metric Ref Use Iface 10.8.0.1 10.8.0.41 255.255.255.255 UGH 0 0 0 tun0 199.115.114.209 192.168.0.1 255.255.255.255 UGH 0 0 0 br-wan[/code] Do I require those? As you can see, the IP address has changed (10.8.0.81 -> 10.8.0.41). How can I setup a route to direct 192.168.1.3 to that ip if it changes each time?

OpenWRT: let only one LAN ip use the tun0

Nikotine

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

maikcat

your server pushes redirect-gateway to you
you can add

route-nopull

to your config and test it out...

Michael.

Nikotine

Yeah, but that would also stop the server from pushing these routes:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.1        10.8.0.81       255.255.255.255 UGH   0      0        0 tun0
10.8.0.81       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
199.115.114.209 192.168.0.1     255.255.255.255 UGH   0      0        0 br-wan

I could add those manually, but the problem is that the the gateway IP address changes between vpn reconnects. I suppose mullvad switches between servers. Would it still work then?

Nikotine

So I added route-nopull. This is the new routing table:

root@OpenWrt-Beneden:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG    0      0        0 br-wan
10.8.0.41       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 br-wan
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br-lan

Two other routes that are normally pushed are missing:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.1        10.8.0.41       255.255.255.255 UGH   0      0        0 tun0
199.115.114.209 192.168.0.1     255.255.255.255 UGH   0      0        0 br-wan

Do I require those?

As you can see, the IP address has changed (10.8.0.81 -> 10.8.0.41). How can I setup a route to direct 192.168.1.3 to that ip if it changes each time?

maikcat

the correct thing to do is to configure your server to push
only routes needed...

yes the 10.8.0.1 route is needed.

the ip that is assinged to you is also controled by server...

Michael.

Nikotine

As explained in the first post, it's a rented vpn server, I don't control it.

Nikotine

This guy had the same wish as I have:
https://forums.openvpn.net/topic8682.html
Will need to study it because he's using scripts and that's new to me.

Nikotine

Got it working using multiwan.
https://forum.openwrt.org/viewtopic.php?pid=197419