OpenVPN Site-to-Site VPN between Asus Merlin And Ubnt EdgeRouter

前言 Network Topology RT-AC68U 使用PPPoE拨号上网,但是分配的IP是100.64.204.111, 看着像公网IP实际却是Carrier-grade NAT. 现在需要将RT-AC68U与一台在公网的EdgeRouter使用OpenVPN Site-to-Site连接起来,并在RT-AC68U端实现policy-based routing。 需要让RT-AC68U下的所有设备能访问EdgeRouter LAN的网络,并根据需求透过VPS访问指定互联网。 本实验参考下列文章: Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite EdgeRouter OpenVPN Connectivity Monitor EdgeRouter 策略路由实现分析 EdgeRouter Policy Based Routing Using DNSMASQ IPSET Incoming search terms:asus merlinmerlin openvpn policy basedunderkdfasus ac88 site to site openvpnpiano8gvopenvpn pbr iptables tagsofficesn8nosev67nervous8xdleft1i1golden2w5gettingpohdryu82Create NAT on tunnelcountryljycopyozjcontinued8x6boxz65been1nnasus openvpnLink to this … Continue reading “OpenVPN Site-to-Site VPN between Asus Merlin And Ubnt EdgeRouter”

EdgeRouter 策略路由实现分析

最近家里的路由规则越来越复杂,而且越来越好用。正好昨天跟朋友讨论他的家用路由改造方案,所以研究了一下EdgeRouter的策略路由(Policy-based Routing,PBR)的实现。 我家里的路由是EdgeRouter Lite,固件1.9.1.1,这个实现跟固件关系不大。 首先,我们可以参考一下官方的文档:EdgeRouter – Policy-based routing (source address based) Incoming search terms:bright5smedgerouter iptables forwardedgerouter max-4 cpu架构vyos mipsLink to this post!

EdgeRouter + SoftEther Policy-based Routing Error

I have protocol config like

SoftEther TAP device name is tap_se, local ip is 192.168.10.2, remote ip 192.168.10.1. Internet is connected via pppoe0. Policy-based routing modified to table 4 route traffic to pppoe0 rather than tap_se. Check current route table:

In my previous post, I added a softether start-up script in /config/scripts/post-config.d/. I … Continue reading “EdgeRouter + SoftEther Policy-based Routing Error”

EdgeRouter Policy Based Routing Using DNSMASQ IPSET

之前用SNIProxy按域名区分流量,着实麻烦。尤其是后期发现路由表莫名其妙出问题。 EdgeRouter的Policy Based Routing(PBR)使用的是自带配置语法的firewall modify功能。 官方有两篇教程: EdgeRouter – Policy-based routing for destination port EdgeRouter – Policy-based routing (source address based) 第二篇文章顺带提了network-group。之前在配置VPN时,使用过network-group,还比较过使用firewall modify + network-group 与配置一堆interface-route的区别。 而,这里的network-group的实现,使用了netfilter的ipset。Man pages可以看这里,命令在edgerouter上也附带了。 dnsmasq支持 ‘–ipset‘ 参数,把对配置域名解析的IP存入到指定的ipset。具体细节可以看dnsmasq的文档。 dnsmasq配置的语法比较简单。

domain 部分参考 address 的语法。例如:

配置好所有自己需要的域名,重启dnsmasq即可。 ipset本身支持timeout,但是edge os的network-group不支持,所以在配置dnsmasq之前,最好创建一个新的network-group。 假定新建的ipset名叫 MY_SET,edge router的主要相关配置如下:

其他诸如配置 static table, interface firewall 可以参考最前边的文档。 Incoming search terms:edgeos firewall network-group … Continue reading “EdgeRouter Policy Based Routing Using DNSMASQ IPSET”