Running Shibby Tomato v130 on an Asus RT-N66U.
My goals are the following
- With Transmission running on the router have all torrent traffic route through an OpenVPN client also running on the router. No other traffic will go though the VPN.
- I am running a separate web server on a static internal IP of 192.168.1.3. I want to forward WAN ports 80 and 443 to the server.
I am able get either 1 or 2 working one at a time but can't get them both to work at the same time.
1st, I created a 2nd LAN using the Tomato GUI (br1) and have given it the IP Address 192.168.2.1. I than assigned Transmission to use this IP by modifying the settings.json config file line "bind-address-ipv4": "192.168.2.1",
2nd, using a very slightly modified version of the WAN up script posted in this answer to howto only tunnel specific hosts route through openvpn client on tomato [closed]
# This code goes in the WAN UP section of the Tomato GUI.
#
# This script configures "selective" VPN routing. Normally Tomato will route ALL traffic out
# the OpenVPN tunnel. These changes to iptables allow some outbound traffic to use the VPN, and some
# traffic to bypass the VPN and use the regular Internet instead.
#
# To list the current rules on the router, issue the command:
# iptables -t mangle -L PREROUTING
#
# Flush/reset all the rules to default by issuing the command:
# iptables -t mangle -F PREROUTING
#
#
# First it is necessary to disable Reverse Path Filtering on all
# current and future network interfaces:
#
for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do
echo 0 > $i
done
#
# Delete and table 100 and flush any existing rules if they exist.
#
ip route flush table 100
ip route del default table 100
ip rule del fwmark 1 table 100
ip route flush cache
iptables -t mangle -F PREROUTING
#
# Copy all non-default and non-VPN related routes from the main table into table 100.
# Then configure table 100 to route all traffic out the WAN gateway and assign it mark "1"
#
# NOTE: Here I assume the OpenVPN tunnel is named "tun11".
#
#
ip route show table main | grep -Ev ^default | grep -Ev tun11 \
| while read ROUTE ; do
ip route add table 100 $ROUTE
done
ip route add default table 100 via $(nvram get wan_gateway)
ip rule add fwmark 1 table 100
ip route flush cache
#
# Define the routing policies for the traffic. The rules will be applied in the order that they
# are listed. In the end, packets with MARK set to "0" will pass through the VPN. If MARK is set
# to "1" it will bypass the VPN.
#
# EXAMPLES:
#
# All LAN traffic will bypass the VPN (Useful to put this rule first, so all traffic bypasses the VPN and you can configure exceptions afterwards)
# iptables -t mangle -A PREROUTING -i br0 -j MARK --set-mark 1
# Ports 80 and 443 will bypass the VPN
# iptables -t mangle -A PREROUTING -i br0 -p tcp -m multiport --dport 80,443 -j MARK --set-mark 1
# All traffic from a particular computer on the LAN will use the VPN
# iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.1.2 -j MARK --set-mark 0
# All traffic to a specific Internet IP address will use the VPN
# iptables -t mangle -A PREROUTING -i br0 -m iprange --dst-range 216.146.38.70 -j MARK --set-mark 0
# All UDP and ICMP traffic will bypass the VPN
# iptables -t mangle -A PREROUTING -i br0 -p udp -j MARK --set-mark 1
# iptables -t mangle -A PREROUTING -i br0 -p icmp -j MARK --set-mark 1
# By default all traffic bypasses the VPN
iptables -t mangle -A PREROUTING -i br0 -j MARK --set-mark 1
# Only foward to Transmission
iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.2.1 -j MARK --set-mark 0
I am able to get only the Transmission traffic routing though the VPN with all other computers going though the normal WAN. However, running this script seems to wipe out my port fowarding to the server and I am no longer able get to the server from outside the network.
I have configured TCP ports 80 and 443 to be forwarded to 192.168.1.3 in the tomato GUI. Checking both iptables -L -vn and iptables -L -vn -t nat before running the WAN up script (server can be accessed from outside but VPN not yet running)
iptables -L -vn shows
Chain wanin (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.3 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.3 tcp dpt:443
iptables -L -vn -t nat shows
Chain WANPREROUTING (1 references)
pkts bytes target prot opt in out source destination
0 0 DNAT icmp -- * * 0.0.0.0/0 0.0.0.0/0 to:192.168.1.1
1 40 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:192.168.1.3:80
0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:192.168.1.3:443
Post running the WAN up script
iptables -L -vn shows
Chain wanin (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.3 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.3 tcp dpt:443
iptables -L -vn -t nat shows
Chain WANPREROUTING (1 references)
pkts bytes target prot opt in out source destination
0 0 DNAT icmp -- * * 0.0.0.0/0 0.0.0.0/0 to:192.168.1.1
0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:192.168.1.3:80
0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:192.168.1.3:443
Both the same as before but I am unable to reach the server on port 80 or 443 from outside the network.
So the simple question is, using this WAN up script or something similar how do I forward ports to a specific IP and keep them outside the VPN?
