V2rayA Killswitch

Router
1

Hello,

I just got V2RayA running on my MT-3000 using nft. I have it set to tproxy.

I'd like to implement a killswitch to block all traffic that doesn't go through the proxy, regardless of whether xray is not running, not connected, etc.

I know this should be possible using firewall rules, but some guidance would be greatly appreciated

2

Best is to do this:

Go to advanced settings, and then go to luci.

Click on network <-> firewall <-> traffic rules.

Scroll down and click on add rule.

The rule should be something like:

name: allow-v2ray
src: any zone, (this means lan, iot, you can also only specify lan)
dest: wan
dst port: 443
dst ip: your end point
action: accept

then you create another rule under this one:

name: deny-non-v2ray
src: any zone, (this means lan, iot, you can also only specify lan)
dest: wan
action: reject

^ this will block all except for the traffic rules above this will give higher priority.

it is also possible to modify the first traffic rule to be more client specific, you can also use source macs or only limit the source zone.

I expect 443 to be your xrays listening port, please change to your needs.

In theory I could even go very advanced with firewall marks and ipsets with src_mac but I don't think this is necessary.

Edit:

I realize I think I have made a mistake about the src, you likely have to select this device because v2ray is on the router.

1 Like
3

Thank you!

Is it possible to do this without having to specify my server's IP? I'm using DDNS

4

This is possible but harder :slight_smile:

First you need to ssh in the router and edit /etc/config/firewall and add this:

config ipset
        option name 'v2ray_ddns_ip'
        list match 'dest_ip'

this becomes a ipset managed by the firewall, although now nothing gets populated in this ipset, further later on that.

Based on your current firewall rule which is not ddns ready, please remove the dst ip, and add in ssh in the same firewall config:

option ipset 'v2ray_ddns_ip'

Because we added list match 'dest_ip' inside the ipset node this actually functions similar as the destination ip, since ipsets have also other 'matches'.

now the trick:

now in ssh edit /etc/config/dhcp and add:

config ipset
        list name 'v2ray_ddns_ip'
        list domain 'https://your-ddns-site'

Make sure the router uses the main dnsmasq server, then /etc/init.d/firewall restart and then /etc/init.d/dnsmasq restart.

On newer luci this can be done by the gui, both in the firewall tab as in the dnsmasq tab :slight_smile:

but the raw configuration should still be valid.:+1:

Edit:

One thing to consider but this depends between nftables vs iptables:

It is possible it does not automatic add the ip in the ipset, because it requires a active client doing the resolvement first, i think this is the case with nftables, so here is a idea to solve it in case you get this problem:

Make sure v2ray uses the routers dns, as example you can use nextdns that is fine because it first routes it to your main dns server and then forwards to for example nextdns, but don't let v2ray do that configure this in the gl ui.

To debug ipset:

Iptables:
ipset list v2ray_ddns_ip

for nftables:

nft list set inet fw4 v2ray_ddns_ip

1 Like