I'm posting this update for anyone who might be attempting to do this like I am.
I've edited route_policy in /usr/bin/. Specifically adding an additional network (in my case, called "iot") to be configured within the set_vlan_firewall() and reload_domain_firewall() methods.
set_vlan_firewall() is the function that determines whether a VLAN can access the WAN if it is not given access to the VPN. Without this edited for additional VLAN(s); while the VPN is running, any custom VLANs will not be able to resolve any DNS queries.
I am not (yet) certain what impact reload_domain_firewall() has, though I presume it has one.
Edit: I did add and change a handful of values, using uci. Anything I have changed/added is referenced within the methods below. (To list some: network.iot, vpnpolicy.vlan.iot)
- I think there was one problem with the ROUTE_POLICY chain. I did end up removing it, and re-adding it for some reason.
As you can see, I didn't change too much in reload_domain_firewall():
reload_domain_firewall()
{
local default_policy=$(uci get vpnpolicy.domain.default_policy)
local domain_list=$(uci get vpnpolicy.domain.domain)
iptables -w -t mangle -F ROUTE_POLICY
lan_ip=$(uci -q get network.lan.ipaddr)
guest_ip=$(uci -q get network.guest.ipaddr)
iot_ip$(uci -q get network.iot.ipaddr)
[ -n "$lan_ip" ] && iptables -w -t mangle -A ROUTE_POLICY -i br-lan -d $lan_ip -j RETURN
[ -n "$guest_ip" ] && iptables -w -t mangle -A ROUTE_POLICY -i br-guest -d $guest_ip -j RETURN
[ -n "$iot_ip" ] && iptables -w -t mangle -A ROUTE_POLICY -i br-iot -d $iot_ip -j RETURN
# l^g z =^= p^m u gVPN
[ "${default_policy}" = "1" ] && [ -n "${domain_list}" ] && {
iptables -w -t mangle -A ROUTE_POLICY -i br-+ -m set --match-set bypass_vpn_domain dst -j MARK --set-mark 0x8000/0xc000
}
# l^g z =^= p^m `^z gVPN
[ "${default_policy}" = "0" ] && {
iptables -w -t mangle -A ROUTE_POLICY -i br-+ -m set ! --match-set via_vpn_domain dst -j MARK --set-mark 0x8000/0xc000
}
}
This is what I have for set_vlan_firewall():
set_vlan_firewall()
{
rm /status.txt
echo -e "$(date +'%d/%m/%Y %H:%M:%S:%3N')\tVPN VLAN Firewall Policy Executing..." > /status.txt
local private=$(uci -q get vpnpolicy.vlan.private)
local guest=$(uci -q get vpnpolicy.vlan.guest)
local iot=$(uci -q get vpnpolicy.vlan.iot)
echo -e "VLAN Policy Values:" >> /status.txt
echo -e "\tvpnpolicy.vlan.private = '${private}'" >> /status.txt
echo -e "\tvpnpolicy.vlan.guest = '${guest}'" >> /status.txt
echo -e "\tvpnpolicy.vlan.iot = '${iot}'" >> /status.txt
iptables -w -t mangle -F ROUTE_POLICY
if [ "${private}" == "0" ];then
iptables -w -t mangle -I ROUTE_POLICY -i br-lan -j MARK --set-mark 0x8000/0xc000
iptables -w -t mangle -A ROUTE_POLICY -i br-lan -j CONNMARK --save-mark --nfmask 0xc000 --ctmask 0xc000
echo -e "$(date +'%d/%m/%Y %H:%M:%S:%3N'):\tAdded exception for LAN => WAN bypassing the VPN domain."
fi
if [ "${guest}" == "0" ];then
iptables -w -t mangle -I ROUTE_POLICY -i br-guest -j MARK --set-mark 0x8000/0xc000
iptables -w -t mangle -A ROUTE_POLICY -i br-guest -j CONNMARK --save-mark --nfmask 0xc000 --ctmask 0xc000
echo -e "$(date +'%d/%m/%Y %H:%M:%S:%3N'):\tAdded exception for Guest => WAN bypassing the VPN domain."
fi
if [ "${iot}" == "0" ];then
iptables -w -t mangle -I ROUTE_POLICY -i br-iot -j MARK --set-mark 0x8000/0xc000
iptables -w -t mangle -A ROUTE_POLICY -i br-iot -j CONNMARK --save-mark --nfmask 0xc000 --ctmask 0xc000
echo -e "$(date +'%d/%m/%Y %H:%M:%S:%3N'):\tAdded exception for IOT => WAN bypassing the VPN domain."
fi
echo conntrack >/tmp/dnsmasq.d/conntrack
echo -e "$(date +'%d/%m/%Y %H:%M:%S:%3N'):\tFinished Executing." >> /status.txt
}
The echo commands I decided to leave there, just because it's handy to tell what exactly was happening during testing. set_vlan_firewall() runs every time the VPN is toggled from OFF to ON. To view the results just run cat /status.txt.
Note: I am using an OpenVPN client. I'm not sure if, with something like this, it makes a difference or not.
For network DNS port forwarding, this can be seen in Luci under the Firewall => Port Forwards tab.
Note: It is worth noting that, with my current setup, the port-forward "dns for vpn iot" does not automatically disable itself when the VPN is toggled to OFF. I'm not sure what handles this, or if I was supposed to programmatically create the port-forward instead of manually, like I did.
If anyone has it, I would appreciate any input on how I can set my IOT port-forward to be automatically disabled when the VPN is turned off. For now, though, I'll take the win.
