VPN Policys not working with Wireguard and Flint 1800

alzhao · 2022-05-26T09:35:10.524Z

Chuckster:

I have them set up for Netflix, Amazon Prime Video, etc… All still report I am on a VPN and shut me down until I turn off the VPN

How do you add? Post the vpn policy config please.

Chuckster:

when using other VPN providers to test my current VPN they all report unprotected

Post details. Let’s try one by one.

Chuckster · 2022-05-26T16:20:51.850Z

Ok so here is the screen shot of my VPN Policy.

VPN Policy1875×1360 161 KB

And here is the NordVPN site saying I am UNPROTECTED while using Wireguard with ProtonVPN. All the VPN sites show unprotected if you are not using their VPN…

Unprotected2278×531 75.9 KB

him · 2022-05-26T16:34:19.132Z

You aren’t using NordVPN so it will say unprotected as the IP address you are connecting from does not belong to one of their servers.

Chuckster · 2022-05-26T17:21:09.184Z

Thats my point…I am protected using a VPN… Just not the Nord one at the moment. I am using Proton VPN.
What site out there gives you an actual status of your security without saying you can only be protected using their service.

Here is the Mullvad report. They make me think my connection is wide open to the world. Im no expert, but just because they can identify any address does not mean they know who you are or what you are doing. This report shows Atlanta… I am in another state completely. Sure tells me that they dont know where I am.
Ironically, the Proton VPN site does not even offer a test of your security. I wonder if its because they offer a free one?

mullvad1810×817 104 KB

Anyway, I am just trying to free my streaming services using the Policy settings and it is not working.

wcs2228 · 2022-05-26T19:11:12.704Z

Streaming devices may not be only using their common domain names (i.e., netflix.com, amazon.com, etc.).

For Netflix and Amazon Prime, I also see nflxso.net, nflximg.com, nflxvideo.net, amazonvideo.com, pv-cdn.net, akamaihd.net, aiv-delivery.net and their subdomains in my AdGuardHome query log.

Maybe you can put your streaming devices on the Guest wifi and configure it not to go through VPN.

I mainly use whatismyipaddress.com or whatismyip.com to check if VPN is working, not any of VPN provider websites.

I do not work for and I am not directly associated with GL.iNet

K3rn3l_Ku5h · 2022-05-26T20:06:30.671Z

I think someone may have answered this but NordVPN will always say unprotected unless you are using NordVPN Servers. Same with PIA and Mallvad. Your protection is that the IP Address that it shows should not be the actual one that is assigned by you ISP.

Chuckster · 2022-05-26T21:00:02.612Z

Thanks, that makes sense. They have to show “some” address or you’d never have made it to that site to begin with… LOL

Chuckster · 2022-05-26T21:02:42.210Z

Hmm I always wondered if there were other domains but had no idea how to identify them… Where did you get those other domains from?

wcs2228 · 2022-05-26T21:54:30.235Z

I started streaming Netflix, then Prime Video and my AdGuardHome server recorded those domains for name resolution.

Here are some more: primevideo.com, a2z.com, cloudfront.net, llnwd.net

alzhao · 2022-05-27T01:44:22.027Z

Two basic check:

IP check
First, you need to check if your IP is the same as VPN server using various online tools, e.g. whatismyip, google etc.
DNS leak check
Then, you need to use dnsleaktest.com to check if you have DNS leaks. All the DNS servers should be servers of the vpn service or in the region of the vpn server. It should not contain your own vpn services and display your own region.

There are some other tools e.g. port detecting or webrtc checks. But basically the two above.

Chuckster · 2022-05-27T17:45:54.430Z

Thanks for the clarification… So any ideas why the Policy does not work with the Wireguard… It does seem to work with OpenVPN.

alzhao · 2022-05-30T09:57:47.252Z

It should work with wireguard as well.

As Flint has a 4.x firmware, we’d like to put all the effort to 4.x. So if vpn or vpn policy does not work on 4.0, it may worth to fix.

Wireguard was not designed for routing in 3.x so very difficult to fix bugs.

Chuckster · 2022-05-30T17:37:39.806Z

Interesting. When does 4.x release. I’d love for the policies to work. At this time I just shut the vpn when I stream.

him · 2022-05-31T02:47:52.887Z

The gl-inet GitHub link is here, you need the ax1800.tar.gz for the flint, extract the openwrt-ipq807x-glinet_ax1800-squashfs-sysupgrade.tar file.

Bilou · 2022-08-24T13:04:10.216Z

I’ running 4.0.1 beta2 on Flint: Wireguard VPN client works however VPN traffic stops working properly when I try to use the proxy mode VPN policy based on target domain or IP.

I don’t have this VPN policy routing problem with Slate AX with latest 4.0.2 release 1, neither with Brume on V3.215 2022-08-11. Any pre-release I could test for Flint ?

Bilou · 2022-08-24T13:19:01.898Z

Other topic as it was mentioned above: regarding Netflix / Primevideo / Disney+ these are the domains I “steer” via VPN policy and/or client proxy file on router in www dir.

/* disneyplus.com */
bamgrid.com
bam.nr-data.net
cdn.registerdisney.go.com
cws.conviva.com
d9.flashtalking.com
disney-portal.my.onetrust.com
disneyplus.bn5x.net
js-agent.newrelic.com
disney-plus.net
dssott.com
adobedtm.com

/* Amazon Prime Video */

amazon.com

Amazon.com. Spend less. Smile more.

Free shipping on millions of items. Get the best of Shopping and Entertainment with Prime. Enjoy low prices and great deals on the largest selection of everyday essentials and other products, including fashion, home, beauty, electronics, Alexa...

aiv-delivery.net
us-east-1.aiv-delivery.net
ters.us-east-1.aiv-delivery.net
fls-na.amazon.com
fls-eu.amazon.com
api.us-east-1.aiv-delivery.net

amazon.com

Amazon.com. Spend less. Smile more.

Free shipping on millions of items. Get the best of Shopping and Entertainment with Prime. Enjoy low prices and great deals on the largest selection of everyday essentials and other products, including fashion, home, beauty, electronics, Alexa...

completion.amazon.com
m.media-amazon.com
aiv-cdn.net
aiv-delivery.net

primevideo.com

Amazon.com Sign up for Prime Video

Enjoy exclusive Amazon Originals as well as popular movies and TV shows. Watch anytime, anywhere. Start your free trial.

atv-ext.amazon.com
atv-ext-eu.amazon.com
atv-ext-fe.amazon.com
atv-ps.amazon.com
atv-ps-eu.amazon.com
atv-ps-eu.amazon.co.uk
atv-ps-fe.amazon.co.jp
atv-ps-fe.amazon.com
primevideo.com
pv-cdn.net

/* Netflix */
flxvpn.net
netflix.ca
netflix.com
netflix.com.au
netflixdnstest10.com
netflixdnstest1.com
netflixdnstest2.com
netflixdnstest3.com
netflixdnstest4.com
netflixdnstest5.com
netflixdnstest6.com
netflixdnstest7.com
netflixdnstest8.com
netflixdnstest9.com
netflixinvestor.com
netflix.net

netflix.com

Netflix - Watch TV Shows Online, Watch Movies Online

Watch Netflix movies & TV shows online or stream right to your smart TV, game console, PC, Mac, mobile, tablet and more.

netflixtechblog.com
nflxext.com
nflximg.com
nflximg.net
nflxso.net

netflix.com

Netflix - Watch TV Shows Online, Watch Movies Online

Watch Netflix movies & TV shows online or stream right to your smart TV, game console, PC, Mac, mobile, tablet and more.

alzhao · 2022-08-25T09:41:36.088Z

Wait a while for us to update 4.0.2 firmware for AX1800.

PolyVinyl · 2023-03-15T22:53:46.022Z

This was the trick for. I had found aiv-cdn . net, amazon . com ssl-images-amazon . com and media-amazon . com using the “Sources” tab in the Inspector in my browser but needed some more to whitelist when using a Samsung TV, once I added the ones you found it worked.

PolyVinyl · 2023-03-17T03:44:21.079Z

FYI, to get the ESPN Roku app to work I added these domains to bypass the VPN (Proton Free in my case):

espn . com
espnplayer . com
espnplus . com
espncdn . com
espn . net
adobe . com
disneyplus . com
bamgrid . com
nr-data . net
go . com
conviva . com
flashtalking . com
bn5x . net
disney-plus . net
dssott . com
adobedtm . com

I added spaces before and after the . in this post so the forum doesn’t think I’m trying to spam the post, you will of course need to remove those extra spaces

sethf · 2023-10-02T15:16:56.407Z

I was never able to get VPN Policies to work properly with Wireguard client connections on the x3.x releases. OpenVPN worked well, but not Wireguard.

Environment:
Brume MV-1000 v3.216 firmware.
Adguard Home v0.107.38

The Wireguard+Adguard Home+VPN policy issue has been resolved in the v4.3.8 beta release in my experience. The v4.x UI will also warn you of various configuration settings that will break VPN policy, unlike the v3.x series.