I am trying to setup multi-WAN.
It seems the manufacturer had made use of PBR and VLAN so I cannot touch them.
I don’t need load-balance or fail-over so I am not using mwan3.
I want to route some LAN IP through ISP-A and otheres through ISP-B.
My router comes with 5 ports:
eth0: ISP-A
eth1: ISP-B
eth2: switch
eth3: PC
eth4: PC
I am trying to route eth3 and eth4 through ISP-A, and eth2 through ISP-B.
In the configuration below, ISP-A is “wan” and “wan6”, ISP-B is “HKT4” and “HKT6”.
/etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'dd16:8314:83b0::/48'
config device
option name 'br-lan'
option type 'bridge'
option multicast_to_unicast '0'
list ports 'eth3'
list ports 'eth4'
config device
option name 'eth1'
option macaddr '94:83:c4:18:9d:18'
config device
option name 'eth2'
option macaddr '94:83:c4:18:9d:18'
config device
option name 'eth3'
option macaddr '94:83:c4:18:9d:18'
config device
option name 'eth4'
option macaddr '94:83:c4:18:9d:18'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option isolate '0'
option ipaddr '192.168.50.1'
option ip6assign '64'
option ip6hint '0000'
option ip6ifaceid '::1'
list ip6class 'local'
config device
option name 'eth0'
option macaddr '94:83:c4:18:9d:17'
config interface 'wan'
option device 'eth0'
option proto 'dhcp'
option ipv6 '1'
list dns '1.1.1.1'
list dns '1.0.0.1'
option peerdns '0'
config interface 'wan6'
option proto 'dhcpv6'
option disabled '0'
option device '@wan'
option reqprefix 'auto'
option reqaddress 'try'
option peerdns '0'
list dns '2606:4700:4700::64'
list dns '2606:4700:4700::6400'
config switch
option name 'switch0'
option reset '0'
option enable_vlan '0'
config interface 'tethering6'
option proto 'dhcpv6'
option disabled '0'
option device '@tethering'
config interface 'wwan6'
option proto 'dhcpv6'
option disabled '0'
option device '@wwan'
config interface 'guest'
option force_link '1'
option type 'bridge'
option proto 'static'
option ipaddr '192.168.9.1'
option netmask '255.255.255.0'
option multicast_querier '1'
option igmp_snooping '0'
option isolate '0'
option bridge_empty '1'
option ip6prefix 'dd16:8314:83b0::/48'
option ip6assign '64'
option ip6hint '0001'
option ip6ifaceid '::1'
option ip6class 'guest'
config interface 'wwan'
option proto 'dhcp'
config rule 'policy_bypass_vpn'
option mark '0x60000/0x60000'
option lookup '53'
option priority '53'
config rule 'policy_via_vpn'
option mark '0x80000/0x80000'
option lookup '52'
option priority '52'
config rule 'policy_dns'
option mark '0x100000/0x100000'
option lookup '51'
option priority '51'
config interface 'wgserver'
option proto 'wgserver'
option config 'main_server'
option disabled '0'
config device
option name 'br-hkt'
option type 'bridge'
list ports 'eth2'
config interface 'HKT4'
option proto 'dhcp'
list dns '1.1.1.1'
list dns '1.0.0.1'
option peerdns '0'
option device 'eth1'
config interface 'HKT'
option type 'bridge'
option device 'br-hkt'
option proto 'static'
option ipaddr '192.168.55.1'
option netmask '255.255.255.0'
option multicast_querier '1'
option igmp_snooping '0'
option isolate '0'
option bridge_empty '1'
option ip6assign '64'
option ip6hint '0002'
option ip6ifaceid '::1'
list ip6class 'HKT6'
config interface 'HKT6'
option device '@HKT4'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
/etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option localservice '1'
option ednspacket_max '1232'
option rebind_protection '0'
option noresolv '1'
list server '127.0.0.1'
list server '::ffff:7f00:1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option ra_management '1'
list ra_flags 'none'
option ra 'relay'
option dhcpv6 'relay'
option ndp 'relay'
config dhcp 'HKT'
option interface 'HKT'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'server'
option ra 'server'
option ra_management '1'
option ra_default '1'
list dns 'dd16:8314:83b0:0002:0000:0000:0000:0001'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
list ra_flags 'none'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config dhcp 'guest'
option interface 'guest'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'server'
option ra 'server'
option ra_management '1'
option ra_default '1'
list dns 'dd16:8314:83b0:0001:0000:0000:0000:0001'
list ra_flags 'other-config'
list ra_flags 'managed-config'
config host
option mac '00:E0:4C:02:27:36'
option name 'PC-through-Switch'
option dns '1'
option ip '192.168.55.2'
config host
option mac '44:E4:EE:63:39:9E'
option name 'PC'
option dns '1'
option ip '192.168.50.4'
config dhcp 'HKT4'
option ignore '1'
option interface 'HKT4'
list ra_flags 'none'
/etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option input 'ACCEPT'
option name 'hktlan'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq6 '1'
list network 'HKT'
config zone
option name 'wan'
option output 'ACCEPT'
option forward 'REJECT'
option mtu_fix '1'
option input 'DROP'
option masq '1'
option masq6 '1'
list network 'wwan'
list network 'wan'
list network 'wan6'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Support-UDP-Traceroute'
option src 'wan'
option dest_port '33434:33689'
option proto 'udp'
option family 'ipv4'
option target 'REJECT'
option enabled 'false'
config include
option path '/etc/firewall.user'
config include 'nat6'
option path '/etc/firewall.nat6'
option reload '1'
config rule 'process_mark'
option name 'process_mark'
option dest '*'
option proto 'all'
option extra '-m owner --gid-owner 65533'
option target 'MARK'
option set_xmark '0x80000/0x80000'
config include 'gls2s'
option type 'script'
option path '/var/etc/gls2s.include'
option reload '1'
config include 'glblock'
option type 'script'
option path '/usr/bin/gl_block.sh'
option reload '1'
config zone
option forward 'REJECT'
option output 'ACCEPT'
option input 'DROP'
option masq '1'
option mtu_fix '1'
option name 'hktwan'
list network 'HKT4'
list network 'HKT6'
config zone
option name 'guest'
option forward 'REJECT'
option output 'ACCEPT'
option input 'REJECT'
list network 'guest'
config forwarding
option src 'guest'
option dest 'wan'
config rule
option name 'Allow-DHCP'
option src 'guest'
option target 'ACCEPT'
option proto 'udp'
option dest_port '67-68'
config rule
option name 'Allow-DNS'
option src 'guest'
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53'
config include 'vpn_server_policy'
option type 'script'
option path '/etc/firewall.vpn_server_policy.sh'
option reload '1'
option enabled '1'
config rule 'glipv6_guest_dhcp'
option name 'Allow-DHCP-IPV6'
option src 'guest'
option target 'ACCEPT'
option proto 'udp'
option dest_port '546:547'
option family 'ipv6'
config rule 'glipv6_guest_icmp'
option name 'Allow-ICMP-IPV6'
option src 'guest'
option target 'ACCEPT'
option proto 'icmp'
option dest_port '58'
option family 'ipv6'
config rule 'sambasharewan'
option src 'wan'
option dest_port '137 138 139 445'
option dest_proto 'tcpudp'
option target 'DROP'
config rule 'sambasharelan'
option src 'lan'
option dest_port '137 138 139 445'
option dest_proto 'tcpudp'
option target 'ACCEPT'
config rule 'glnas_ser'
option src 'wan'
option dest_port '6000-6002'
option dest_proto 'tcp'
option target 'DROP'
config rule 'webdav_wan'
option src 'wan'
option dest_port '6008'
option dest_proto 'tcp'
option target 'DROP'
config rule 'wgserver_allow'
option name 'wgserver_allow'
option target 'ACCEPT'
option src 'wan'
option proto 'udp tcp'
option family 'ipv4'
option dest_port '51820'
option enabled '1'
config zone 'wgserver'
option name 'wgserver'
option output 'ACCEPT'
option mtu_fix '1'
option input 'DROP'
option masq '1'
option masq6 '1'
option enabled '1'
option forward 'REJECT'
list network 'wgserver'
config forwarding 'wgserver2wan'
option src 'wgserver'
option dest 'wan'
option enabled '1'
config forwarding 'lan2wgserver'
option src 'lan'
option dest 'wgserver'
option enabled '1'
config redirect 'adguard_home'
option src 'lan'
option src_dport '53'
option dest 'lan'
option dest_port '3053'
option name 'AdGuard'
option proto 'tcpudp'
config forwarding
option dest 'wgserver'
option src 'hktlan'
config forwarding
option dest 'hktwan'
option src 'wgserver'
config forwarding
option dest 'hktlan'
option src 'lan'
config forwarding
option dest 'lan'
option src 'hktlan'
config redirect
option src 'hktlan'
option name 'AdGuard'
option target 'DNAT'
option src_dport '53'
option dest_port '3053'
option dest 'lan'
config forwarding
option dest 'hktwan'
option src 'hktlan'
config forwarding
option dest 'hktwan'
option src 'lan'
It appears only one network (ISP) has Internet access only.
May I know what should be fixed?
The ISP does not provide a static IP. It is allowcated by ISP DHCP.
Is it possible to skip the “gateway” IP?
(To get the default IP from the interface)
PBR should be a package to be installed manually.
Anyway if this routing could be done I don’t need PBR.
PBR is just a package to configure these routing easier.
# ip rule
0: from all lookup local
51: from all fwmark 0x100000/0x100000 lookup 51
52: from all fwmark 0x80000/0x80000 lookup 52
53: from all fwmark 0x60000/0x60000 lookup 53
100: from 192.168.50.10 lookup 100
1001: from all iif eth0 lookup 1
2001: from all fwmark 0x100/0x3f00 lookup 1
2061: from all fwmark 0x3d00/0x3f00 blackhole
2062: from all fwmark 0x3e00/0x3f00 unreachable
32766: from all lookup main
32767: from all lookup default
I have run these:
xxx.xxx.xxx.xxx is HKT gateway IP. Skipping gateway IP does not work.
ip route add default via xxx.xxx.xxx.xxx dev eth1 table 100
ip rule add fwmark 100 table 100
iptables -A PREROUTING -t mangle -s 192.168.50.10 -j MARK --set-mark 100
May I know how to set the last command on OpenWRT?
I have followed to configure my GL-AX1800.
After configuration, pluging my computer into eth2 does not provide any LAN or WAN traffic. eth3 and eth4 provide LAN and WAN (not HKT) traffic.
May you help to have a look what I have missed please?
/etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'dd16:8314:83b0::/48'
config device
option name 'br-lan'
option type 'bridge'
option multicast_to_unicast '0'
list ports 'eth3'
list ports 'eth4'
config device
option name 'eth1'
option macaddr '94:83:c4:18:9d:18'
config device
option name 'eth2'
option macaddr '94:83:c4:18:9d:18'
config device
option name 'eth3'
option macaddr '94:83:c4:18:9d:18'
config device
option name 'eth4'
option macaddr '94:83:c4:18:9d:18'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option isolate '0'
option ipaddr '192.168.50.1'
option ip6assign '64'
option ip6hint '0000'
option ip6ifaceid '::1'
list ip6class 'local'
config device
option name 'eth0'
option macaddr '94:83:c4:18:9d:17'
config interface 'wan'
option device 'eth0'
option proto 'dhcp'
option ipv6 '1'
list dns '1.1.1.1'
list dns '1.0.0.1'
option peerdns '0'
config interface 'wan6'
option proto 'dhcpv6'
option device '@wan'
option disabled '0'
config switch
option name 'switch0'
option reset '0'
option enable_vlan '0'
config interface 'tethering6'
option proto 'dhcpv6'
option device '@tethering'
option disabled '0'
config interface 'wwan6'
option proto 'dhcpv6'
option device '@wwan'
option disabled '0'
config interface 'guest'
option force_link '1'
option type 'bridge'
option proto 'static'
option ipaddr '192.168.9.1'
option netmask '255.255.255.0'
option multicast_querier '1'
option igmp_snooping '0'
option isolate '0'
option bridge_empty '1'
option ip6prefix 'ddfa:43aa:ca04::/48'
option ip6assign '64'
option ip6hint '0001'
option ip6ifaceid '::1'
option ip6class 'guest'
config interface 'wwan'
option proto 'dhcp'
config rule 'policy_bypass_vpn'
option mark '0x60000/0x60000'
option lookup '53'
option priority '53'
config rule 'policy_via_vpn'
option mark '0x80000/0x80000'
option lookup '52'
option priority '52'
config rule 'policy_dns'
option mark '0x100000/0x100000'
option lookup '51'
option priority '51'
config device
option type 'bridge'
option name 'br-hkt'
list ports 'eth2'
config interface 'HKT4'
option device 'eth1'
option proto 'dhcp'
option ip4table '100'
list dns '1.1.1.1'
list dns '1.0.0.1'
option peerdns '0'
config interface 'HKT6'
option device '@HKT4'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
config interface 'HKT'
option type 'bridge'
option device 'br-hkt'
option proto 'static'
option ipaddr '192.168.55.1'
option netmask '255.255.255.0'
option multicast_querier '1'
option igmp_snooping '0'
option isolate '0'
option bridge_empty '1'
option ip6assign '64'
option ip6hint '0002'
option ip6ifaceid '::1'
list ip6class 'HKT6'
config rule
option in 'HKT'
option priority '100'
option lookup '100'
config interface 'wgserver'
option proto 'wgserver'
option config 'main_server'
option disabled '0'
/etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'hktlan'
option input 'ACCEPT'
list network 'HKT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq6 '1'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
list network 'wwan'
option output 'ACCEPT'
option forward 'REJECT'
option mtu_fix '1'
option input 'DROP'
option masq '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Support-UDP-Traceroute'
option src 'wan'
option dest_port '33434:33689'
option proto 'udp'
option family 'ipv4'
option target 'REJECT'
option enabled 'false'
config include
option path '/etc/firewall.user'
config include 'nat6'
option path '/etc/firewall.nat6'
option reload '1'
config rule 'process_mark'
option name 'process_mark'
option dest '*'
option proto 'all'
option extra '-m owner --gid-owner 65533'
option target 'MARK'
option set_xmark '0x80000/0x80000'
config rule 'wan_in_conn_mark'
option name 'wan_in_conn_mark'
option src 'wan'
option dest '*'
option set_xmark '0x80000/0x80000'
option target 'MARK'
option extra '-j CONNMARK --set-xmark 0x80000/0x80000'
option enabled '1'
config rule 'lan_in_conn_mark_restore'
option name 'lan_in_conn_mark_restore'
option src 'lan'
option dest '*'
option set_xmark '0x80000/0x80000'
option target 'MARK'
option extra '-m connmark --mark 0x80000/0x80000 -j CONNMARK --restore-mark'
option enabled '1'
config rule 'out_conn_mark_restore'
option name 'out_conn_mark_restore'
option dest '*'
option set_xmark '0x80000/0x80000'
option target 'MARK'
option extra '-m connmark --mark 0x80000/0x80000 -j CONNMARK --restore-mark'
option enabled '1'
config include 'gls2s'
option type 'script'
option path '/var/etc/gls2s.include'
option reload '1'
config include 'glblock'
option type 'script'
option path '/usr/bin/gl_block.sh'
option reload '1'
config zone
list network 'HKT4'
list network 'HKT6'
option name 'hktwan'
option mtu_fix '1'
option input 'DROP'
option forward 'REJECT'
option masq '1'
option output 'ACCEPT'
config zone
option name 'guest'
option network 'guest'
option forward 'REJECT'
option output 'ACCEPT'
option input 'REJECT'
config forwarding
option src 'guest'
option dest 'wan'
config rule
option name 'Allow-DHCP'
option src 'guest'
option target 'ACCEPT'
option proto 'udp'
option dest_port '67-68'
config rule
option name 'Allow-DNS'
option src 'guest'
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53'
config include 'vpn_server_policy'
option type 'script'
option path '/etc/firewall.vpn_server_policy.sh'
option reload '1'
option enabled '1'
config forwarding
option dest 'hktwan'
option src 'hktlan'
config forwarding
option dest 'hktwan'
option src 'guest'
config rule 'wgserver_allow'
option name 'wgserver_allow'
option target 'ACCEPT'
option src 'wan'
option proto 'udp tcp'
option family 'ipv4'
option dest_port '51820'
option enabled '1'
config zone 'wgserver'
option name 'wgserver'
option output 'ACCEPT'
option mtu_fix '1'
option network 'wgserver'
option input 'DROP'
option masq '1'
option masq6 '1'
option enabled '1'
option forward 'REJECT'
config forwarding 'wgserver2wan'
option src 'wgserver'
option dest 'wan'
option enabled '1'
config forwarding 'lan2wgserver'
option src 'lan'
option dest 'wgserver'
option enabled '1'
config forwarding
option dest 'wgserver'
option src 'hktlan'
config forwarding
option dest 'hktwan'
option src 'wgserver'
config rule 'glipv6_guest_dhcp'
option name 'Allow-DHCP-IPV6'
option src 'guest'
option target 'ACCEPT'
option proto 'udp'
option dest_port '546:547'
option family 'ipv6'
config rule 'glipv6_guest_icmp'
option name 'Allow-ICMP-IPV6'
option src 'guest'
option target 'ACCEPT'
option proto 'icmp'
option dest_port '58'
option family 'ipv6'
config redirect 'adguard_home'
option name 'Adguard Home'
option src 'lan'
option src_dport '53'
option dest 'lan'
option dest_port '3053'
option proto 'tcpudp'
config redirect 'adguard_home_guest'
option name 'Adguard Home guest'
option src 'guest'
option src_dport '53'
option dest 'guest'
option dest_port '3053'
option proto 'tcpudp'
config redirect
option src 'hktlan'
option name 'AdGuard'
option target 'DNAT'
option src_dport '53'
option dest_port '3053'
option dest 'lan'