Temat: mwan3 z VPN pptp
zainstalowałem pakiet mwan3 na wdr4300
wan - e3276
wan2 - połączenie kablowe
chcę aby też na ruterze działał VPN przez pptp.
W pierwszej konfiguracji pptp działa, a mwan3 nie
W drugiej konfiguracji w network przy wan i wan2 dodaję option metric '10' i option metric '20'
Tu już mwan3 działa, i przełącza bardzo sprawnie w przypadku zaniku wan, ale przestał działać pptp, w gui niby widać że jest połączony ale ruch nie idzie przez VPN.
1.
root@Gargoyle:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.1xx.xxx.254 0.0.0.0 UG 0 0 0 pptp-vpn pptp
10.1xx.xxx.254 * 255.255.255.255 UH 0 0 0 pptp-vpn pptp
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0.2
192.168.3.0 * 255.255.255.0 U 0 0 0 br-lan
192.168.178.0 * 255.255.255.0 U 0 0 0 eth1
2xx.xx.xx.186 192.168.178.1 255.255.255.255 UGH 0 0 0 eth1
root@Gargoyle:~# mwan3 status
Interface status:
Interface wan is offline (tracking down)
Interface wan2 is offline (tracking down)
root@Gargoyle:~#
/etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config interface 'lan'
option ifname 'eth0.1'
option type 'bridge'
option proto 'static'
option netmask '255.255.255.0'
option ipaddr '192.168.3.1'
option dns '192.168.3.1'
config interface 'wan'
option proto 'dhcp'
option ifname 'eth1'
config interface 'wan2'
option proto 'dhcp'
option ifname 'eth0.2'
config switch
option name 'eth0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'eth0'
option vlan '1'
option ports '0t 2 3 4 5'
config switch_vlan
option device 'eth0'
option vlan '2'
option ports '0t 1'
config interface 'vpnpptp'
option proto 'pptp'
option server 'xsrv.eux'
option username 'xloginx'
option password 'xpassx'
/etc/config/firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'wan'
list network 'wan'
list network 'wan2'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
option reload '1'
config include
option type 'script'
option path '/usr/lib/gargoyle_firewall_util/gargoyle_additions.firewall'
option family 'IPv4'
option reload '1'
config include 'miniupnpd'
option type 'script'
option path '/usr/share/miniupnpd/firewall.include'
option family 'IPv4'
option reload '1'
config include 'openvpn_include_file'
option path '/etc/openvpn.firewall'
option reload '1'
config zone 'vpnpptp_zone'
option name 'vpnpptp'
option network 'vpnpptp'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option mtu_fix '1'
option masq '1'
config forwarding 'vpnpptp_lan_forwarding'
option src 'lan'
option dest 'vpnpptp'2.
root@Gargoyle:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.1xx.xxx.254 0.0.0.0 UG 0 0 0 pptp-vpn pptp
default 192.168.178.1 0.0.0.0 UG 10 0 0 eth1
default 192.168.1.1 0.0.0.0 UG 20 0 0 eth0.2
10.1xx.xxx.254 * 255.255.255.255 UH 0 0 0 pptp-vpn pptp
192.168.1.0 * 255.255.255.0 U 20 0 0 eth0.2
192.168.3.0 * 255.255.255.0 U 0 0 0 br-lan
192.168.178.0 * 255.255.255.0 U 10 0 0 eth1
2xx.xx.xx.186 192.168.178.1 255.255.255.255 UGH 10 0 0 eth1
root@Gargoyle:~# mwan3 status
Interface status:
Interface wan is online (tracking active)
Interface wan2 is online (tracking active)
Policy balanced:
wan2 (40%)
wan (60%)
Policy wan2_only:
wan2 (100%)
Policy wan2_wan:
wan2 (100%)
Policy wan_only:
wan (100%)
Policy wan_wan2:
wan (100%)
Known networks:
destination policy hits
------------------------------------------------
127.0.0.0/8 default 24
224.0.0.0/3 default 44
10.100.201.254 default 0
192.168.1.0/24 default 48
192.168.3.0/24 default 108
192.168.178.0/24 default 387
2xx.xx.xx.186 default 6
10.100.200.184 default 1
127.0.0.0 default 0
127.0.0.0/8 default 24
127.0.0.1 default 24
127.255.255.255 default 0
192.168.1.0 default 0
192.168.1.122 default 45
192.168.1.255 default 0
192.168.3.0 default 0
192.168.3.1 default 57
192.168.3.255 default 0
192.168.178.0 default 0
192.168.178.100 default 381
192.168.178.255 default 0
Active rules:
source destination proto src-port dest-port policy hits
---------------------------------------------------------------------------------------------------
0.0.0.0/0 0.0.0.0/0 all wan_wan2 159
root@Gargoyle:~#