multi-WAN setup using interfaces and firewall zone

y2kbug · January 23, 2023, 5:41am

I am trying to setup multi-WAN.
It seems the manufacturer had made use of PBR and VLAN so I cannot touch them.
I don’t need load-balance or fail-over so I am not using mwan3.

I want to route some LAN IP through ISP-A and otheres through ISP-B.

My router comes with 5 ports:
eth0: ISP-A
eth1: ISP-B
eth2: switch
eth3: PC
eth4: PC

I am trying to route eth3 and eth4 through ISP-A, and eth2 through ISP-B.

In the configuration below, ISP-A is “wan” and “wan6”, ISP-B is “HKT4” and “HKT6”.

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'dd16:8314:83b0::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	option multicast_to_unicast '0'
	list ports 'eth3'
	list ports 'eth4'

config device
	option name 'eth1'
	option macaddr '94:83:c4:18:9d:18'

config device
	option name 'eth2'
	option macaddr '94:83:c4:18:9d:18'

config device
	option name 'eth3'
	option macaddr '94:83:c4:18:9d:18'

config device
	option name 'eth4'
	option macaddr '94:83:c4:18:9d:18'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option isolate '0'
	option ipaddr '192.168.50.1'
	option ip6assign '64'
	option ip6hint '0000'
	option ip6ifaceid '::1'
	list ip6class 'local'

config device
	option name 'eth0'
	option macaddr '94:83:c4:18:9d:17'

config interface 'wan'
	option device 'eth0'
	option proto 'dhcp'
	option ipv6 '1'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'

config interface 'wan6'
	option proto 'dhcpv6'
	option disabled '0'
	option device '@wan'
	option reqprefix 'auto'
	option reqaddress 'try'
	option peerdns '0'
	list dns '2606:4700:4700::64'
	list dns '2606:4700:4700::6400'

config switch
	option name 'switch0'
	option reset '0'
	option enable_vlan '0'

config interface 'tethering6'
	option proto 'dhcpv6'
	option disabled '0'
	option device '@tethering'

config interface 'wwan6'
	option proto 'dhcpv6'
	option disabled '0'
	option device '@wwan'

config interface 'guest'
	option force_link '1'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.9.1'
	option netmask '255.255.255.0'
	option multicast_querier '1'
	option igmp_snooping '0'
	option isolate '0'
	option bridge_empty '1'
	option ip6prefix 'dd16:8314:83b0::/48'
	option ip6assign '64'
	option ip6hint '0001'
	option ip6ifaceid '::1'
	option ip6class 'guest'

config interface 'wwan'
	option proto 'dhcp'

config rule 'policy_bypass_vpn'
	option mark '0x60000/0x60000'
	option lookup '53'
	option priority '53'

config rule 'policy_via_vpn'
	option mark '0x80000/0x80000'
	option lookup '52'
	option priority '52'

config rule 'policy_dns'
	option mark '0x100000/0x100000'
	option lookup '51'
	option priority '51'

config interface 'wgserver'
	option proto 'wgserver'
	option config 'main_server'
	option disabled '0'

config device
	option name 'br-hkt'
	option type 'bridge'
	list ports 'eth2'

config interface 'HKT4'
	option proto 'dhcp'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'
	option device 'eth1'

config interface 'HKT'
	option type 'bridge'
	option device 'br-hkt'
	option proto 'static'
	option ipaddr '192.168.55.1'
	option netmask '255.255.255.0'
	option multicast_querier '1'
	option igmp_snooping '0'
	option isolate '0'
	option bridge_empty '1'
	option ip6assign '64'
	option ip6hint '0002'
	option ip6ifaceid '::1'
	list ip6class 'HKT6'

config interface 'HKT6'
	option device '@HKT4'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option ednspacket_max '1232'
	option rebind_protection '0'
	option noresolv '1'
	list server '127.0.0.1'
	list server '::ffff:7f00:1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ra_management '1'
	list ra_flags 'none'
	option ra 'relay'
	option dhcpv6 'relay'
	option ndp 'relay'

config dhcp 'HKT'
	option interface 'HKT'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'
	option ra_default '1'
	list dns 'dd16:8314:83b0:0002:0000:0000:0000:0001'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'
	list ra_flags 'none'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'
	option ra_default '1'
	list dns 'dd16:8314:83b0:0001:0000:0000:0000:0001'
	list ra_flags 'other-config'
	list ra_flags 'managed-config'

config host
	option mac '00:E0:4C:02:27:36'
	option name 'PC-through-Switch'
	option dns '1'
	option ip '192.168.55.2'

config host
	option mac '44:E4:EE:63:39:9E'
	option name 'PC'
	option dns '1'
	option ip '192.168.50.4'

config dhcp 'HKT4'
	option ignore '1'
	option interface 'HKT4'
	list ra_flags 'none'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option input 'ACCEPT'
	option name 'hktlan'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq6 '1'
	list network 'HKT'

config zone
	option name 'wan'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'
	option input 'DROP'
	option masq '1'
	option masq6 '1'
	list network 'wwan'
	list network 'wan'
	list network 'wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Support-UDP-Traceroute'
	option src 'wan'
	option dest_port '33434:33689'
	option proto 'udp'
	option family 'ipv4'
	option target 'REJECT'
	option enabled 'false'

config include
	option path '/etc/firewall.user'

config include 'nat6'
	option path '/etc/firewall.nat6'
	option reload '1'

config rule 'process_mark'
	option name 'process_mark'
	option dest '*'
	option proto 'all'
	option extra '-m owner --gid-owner 65533'
	option target 'MARK'
	option set_xmark '0x80000/0x80000'

config include 'gls2s'
	option type 'script'
	option path '/var/etc/gls2s.include'
	option reload '1'

config include 'glblock'
	option type 'script'
	option path '/usr/bin/gl_block.sh'
	option reload '1'

config zone
	option forward 'REJECT'
	option output 'ACCEPT'
	option input 'DROP'
	option masq '1'
	option mtu_fix '1'
	option name 'hktwan'
	list network 'HKT4'
	list network 'HKT6'

config zone
	option name 'guest'
	option forward 'REJECT'
	option output 'ACCEPT'
	option input 'REJECT'
	list network 'guest'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option name 'Allow-DHCP'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '67-68'

config rule
	option name 'Allow-DNS'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'tcp udp'
	option dest_port '53'

config include 'vpn_server_policy'
	option type 'script'
	option path '/etc/firewall.vpn_server_policy.sh'
	option reload '1'
	option enabled '1'

config rule 'glipv6_guest_dhcp'
	option name 'Allow-DHCP-IPV6'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '546:547'
	option family 'ipv6'

config rule 'glipv6_guest_icmp'
	option name 'Allow-ICMP-IPV6'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'icmp'
	option dest_port '58'
	option family 'ipv6'

config rule 'sambasharewan'
	option src 'wan'
	option dest_port '137 138 139 445'
	option dest_proto 'tcpudp'
	option target 'DROP'

config rule 'sambasharelan'
	option src 'lan'
	option dest_port '137 138 139 445'
	option dest_proto 'tcpudp'
	option target 'ACCEPT'

config rule 'glnas_ser'
	option src 'wan'
	option dest_port '6000-6002'
	option dest_proto 'tcp'
	option target 'DROP'

config rule 'webdav_wan'
	option src 'wan'
	option dest_port '6008'
	option dest_proto 'tcp'
	option target 'DROP'

config rule 'wgserver_allow'
	option name 'wgserver_allow'
	option target 'ACCEPT'
	option src 'wan'
	option proto 'udp tcp'
	option family 'ipv4'
	option dest_port '51820'
	option enabled '1'

config zone 'wgserver'
	option name 'wgserver'
	option output 'ACCEPT'
	option mtu_fix '1'
	option input 'DROP'
	option masq '1'
	option masq6 '1'
	option enabled '1'
	option forward 'REJECT'
	list network 'wgserver'

config forwarding 'wgserver2wan'
	option src 'wgserver'
	option dest 'wan'
	option enabled '1'

config forwarding 'lan2wgserver'
	option src 'lan'
	option dest 'wgserver'
	option enabled '1'

config redirect 'adguard_home'
	option src 'lan'
	option src_dport '53'
	option dest 'lan'
	option dest_port '3053'
	option name 'AdGuard'
	option proto 'tcpudp'

config forwarding
	option dest 'wgserver'
	option src 'hktlan'

config forwarding
	option dest 'hktwan'
	option src 'wgserver'

config forwarding
	option dest 'hktlan'
	option src 'lan'

config forwarding
	option dest 'lan'
	option src 'hktlan'

config redirect
	option src 'hktlan'
	option name 'AdGuard'
	option target 'DNAT'
	option src_dport '53'
	option dest_port '3053'
	option dest 'lan'

config forwarding
	option dest 'hktwan'
	option src 'hktlan'

config forwarding
	option dest 'hktwan'
	option src 'lan'

It appears only one network (ISP) has Internet access only.
May I know what should be fixed?

Thank you very much.

alzhao · January 23, 2023, 12:09pm

Just to confirm, you are using AX1800 Flint, right?

hansome · January 23, 2023, 1:29pm

Two default route of ISP-A and ISP-B in table main will not work.
You need to add IP rule and static route in luci, example configs:

IPV4 rules:

Static IPv4 Routes:

y2kbug · January 23, 2023, 1:42pm

Yes. It is Flint AX1800.

y2kbug · January 24, 2023, 4:27am

What should the “Gateway” be in the second picture?
Should it be the router IP, or HKT4 gateway IP?

Where to specify the source IP?
For example, I want:
Router IP: 192.158.8.1
192.168.8.11 through “HKT”
Any other IP through “WAN”

Thanks.

y2kbug · January 24, 2023, 5:18am

By the way I have consulted the author of PBR.
He said the OS and the package is too old.

hansome · January 24, 2023, 5:51am

Gateway is HKT4 gateway IP set by dhcp.
Source IP is set in ip rules like the first picture.

I get that picture by flint firmware 4.2 snapshot. Its PBR is updated to 21.02 verison.

y2kbug · January 24, 2023, 5:58am

The ISP does not provide a static IP. It is allowcated by ISP DHCP.
Is it possible to skip the “gateway” IP?
(To get the default IP from the interface)

PBR should be a package to be installed manually.
Anyway if this routing could be done I don’t need PBR.
PBR is just a package to configure these routing easier.

Thanks.

hansome · January 24, 2023, 6:46am

Yes, gateway is optional on the static route setup page.

y2kbug · January 24, 2023, 6:57am

My PC IP is 192.168.50.10.

Checked the public IP is “wan” but not “hkt”.

Thanks.

hansome · January 24, 2023, 7:06am

Sorry that I don’t have a device to setup two wan for test. The previous picture is just a clue, you need to change things accordingly. Command:

ip rule
ip route show table 100

can be used to check if luci setup takes effect.
I’ll try this when my device is available at hand.

y2kbug · January 24, 2023, 8:00am

# ip rule 
0:	from all lookup local
51:	from all fwmark 0x100000/0x100000 lookup 51
52:	from all fwmark 0x80000/0x80000 lookup 52
53:	from all fwmark 0x60000/0x60000 lookup 53
100:	from 192.168.50.10 lookup 100
1001:	from all iif eth0 lookup 1
2001:	from all fwmark 0x100/0x3f00 lookup 1
2061:	from all fwmark 0x3d00/0x3f00 blackhole
2062:	from all fwmark 0x3e00/0x3f00 unreachable
32766:	from all lookup main
32767:	from all lookup default

# ip route show table 100

(Nothing is shown)

y2kbug · January 24, 2023, 8:41am

According to this page:

I have run these:
xxx.xxx.xxx.xxx is HKT gateway IP. Skipping gateway IP does not work.

ip route add default via xxx.xxx.xxx.xxx dev eth1 table 100
ip rule add fwmark 100 table 100
iptables -A PREROUTING -t mangle -s 192.168.50.10 -j MARK --set-mark 100

May I know how to set the last command on OpenWRT?

Thanks.