FAQ o OpenWrt | Sprzedam różne routery | Oddam

roblad · 2013-10-10 21:53:47

roblad
Użytkownik
Nieaktywny

Zarejestrowany: 2013-03-14
Posty: 1,036

Odp: Problem z OpenVPN

To jak to ugrysc na mwan3 na co zwrocic uwage przy tej konfiguracji mojej z openvpn - masz moze jakis config na 3 wany gdzie 1 jest 3g, wraz z loadbalancerem i failoverem. Czytalem ze tam specjalnie trzeba jakos ruting ustawic zeby to chodzilo prawidlowo typu:

#config route
#    option interface 'wan1'
#    option target '192.168.100.0'
#    option netmask '0.0.0.0'
#    option gateway '10.0.0.1'
                
#config route
#    option interface 'wan2'
#    option target '192.168.100.0'
#    option netmask '0.0.0.0'
#    option gateway '192.168.200.1'
                                
#config route
#    option interface 'wan3'
#    option target '192.168.100.0'
#    option netmask '0.0.0.0'
#    option gateway '10.64.64.64'

oraz metryki odpowiednio musza byc ustawione

Cezary · 2013-10-10 21:56:55

Cezary
...
Aktywny

Skąd: Warszawa
Zarejestrowany: 2006-02-25
Posty: 116,601

Odp: Problem z OpenVPN

Masz obszerny wątek na forum.openwrt.org o mwan3.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

roblad · 2013-10-10 22:02:12

roblad
Użytkownik
Nieaktywny

Zarejestrowany: 2013-03-14
Posty: 1,036

Odp: Problem z OpenVPN

postaram siew cos splodzic, ale zawiodlem sie na multiwanie, bez openvpn jakos to chodzilo, teraz strasznie chrzani kilka razy juz mi system zrestartowal - moze opisac problemy z multiwanem a szerzej opisac mwan3 - tak jak pozostale rozwiazania, nie ma opisu konfiguracji jakiejs prostej ta stronce eko - przydal by sie taki opis prostej konfiguracji.

Pozdr,

roblad · 2013-10-11 15:10:31

roblad
Użytkownik
Nieaktywny

Zarejestrowany: 2013-03-14
Posty: 1,036

Odp: Problem z OpenVPN

Prosze o pomoc - bo niedlugo wywale wszystkie routery z domu i bede bebnami nadawal

zainstalowalem mwan3 - i pojawiaja sie problemy

Same schody

zaczynamy po instalacji i konfigu mwana3

# This is a mwan3 example config. For mwan3 to work you will need at least:
#
# - 2 interfaces
# - 2 members
# - 1 policy
# - 1 rule
#
# First define all your wan interfaces. Interface name must match with the
# name used in your network configuration:

config 'interface' 'wan'
        option 'enabled' '1'
        list 'track_ip' '8.8.4.4'
        list 'track_ip' '8.8.8.8'
        list 'track_ip' '208.67.222.222'
        list 'track_ip' '208.67.220.220'
        option 'reliability' '3'
        option 'count' '1'
        option 'timeout' '2'
        option 'interval' '5'
        option 'down' '3'
        option 'up' '5'
        option 'reroute' '0'

config 'interface' 'wan2'
        option 'enabled' '1'
        list 'track_ip' '8.8.8.8'
        list 'track_ip' '8.8.4.4'
        list 'track_ip' '208.67.222.222'
        list 'track_ip' '208.67.220.220'
        option 'reliability' '1'
        option 'count' '1'
        option 'timeout' '2'
        option 'interval' '5'
        option 'down' '3'
        option 'up' '5'
        option 'reroute' '0'


config 'interface' 'wan3'               
        option 'enabled' '1'            
        list 'track_ip' '8.8.8.8'       
        list 'track_ip' '8.8.4.4'
        list 'track_ip' '208.67.222.222'
        list 'track_ip' '208.67.220.220'
        option 'reliability' '3'        
        option 'count' '1'              
        option 'timeout' '5'            
        option 'interval' '10'           
        option 'down' '3'               
        option 'up' '8'                 
        option 'reroute' '0'  


# Next define a member and configure metric and weight values for this member.
# Each interface can have multiple member definitions. Give each member a correct
# name (A-Z, a-z, 0-9, "_" and no spaces).

config member 'wan_m1_w2'
       option metric '1'
       option weight '2'
       option interface 'wan'
            
config member 'wan_m2_w2'
       option metric '2'
       option weight '2'
       option interface 'wan'
                        
config member 'wan2_m1_w2'
       option interface 'wan2'
       option metric '1'
       option weight '2'
                                    
config member 'wan2_m2_w2'
       option interface 'wan2'
       option metric '2'
       option weight '2'
                                                
config member 'wan3_m1_w1'
       option interface 'wan3'
       option metric '1'
       option weight '2'
                                                            
config member 'wan3_m2_w1'
       option interface 'wan3'
       option metric '2'
       option weight '2'

# After that create a routing policy. A routing policy consist of one or more
# members. Give each policy a correct name (A-Z, a-z, 0-9, "_" and no spaces). You 
# can create multiple policies, so that it is possible for different traffic to
# have different primary and/or backup interfaces.

config policy 'wan_only'
       list use_member 'wan_m1_w2'
    
config policy 'wan2_only'
       list use_member 'wan2_m1_w2'
        
config policy 'wan3_only'
       list use_member 'wan3_m1_w1'
            
config 'policy' 'wan1_wan2_loadbalanced'
    list 'use_member' 'wan1_m1_w2'
    list 'use_member' 'wan2_m1_w2'

                        
config policy 'wan_pri_wan2_sec'
       list use_member 'wan_m1_w2'
       list use_member 'wan2_m2_w2'
                                
config policy 'wan2_pri_wan_sec'
       list use_member 'wan_m2_w2'
       list use_member 'wan2_m1_w2'
                                        



# And to finish the config define your traffic rules. Rules are matched in top to
# bottom order. If you define a rule and it matches, all following rules are ignored.
#
# If the option equalize is set, mwan3 will load-balance each new session to the same
# host. If not set, it will load-balance based on destination.

config 'rule'
    option 'dest_ip' '192.168.0.0/24'
    option 'proto' 'tcp'
    option 'use_policy' 'default'

config 'rule'

    option 'dest_ip' '0.0.0.0/0'
    option 'equalize' '1'
    option 'use_policy' 'wan1_wan2_loadbalanced'

/etc/init.d/mwan3 restart - trwa strasznie dlugo

no i errory

uci: Entry not found
sh: wan: unknown operand
ERROR: No valid dynamic DNS service configurations defined  <<< to jest known error - ale nie wiadomo czy ma wplyw na cos nie mam ddns
(Did you specify correct configuration file path?)
uci: Entry not found
sh: wan2: unknown operand
uci: Entry not found
sh: wan3: unknown operand

/etc/init.d/mwan3 start

uci: Entry not found
sh: wan: unknown operand
ERROR: No valid dynamic DNS service configurations defined
(Did you specify correct configuration file path?)
uci: Entry not found
sh: wan3: unknown operand
uci: Entry not found
sh: wan2: unknown operand
uci: Entry not found
sh: wan3: unknown operand

route

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.0.0.1        0.0.0.0         UG    10     0        0 eth0.2
default         192.168.200.1   0.0.0.0         UG    20     0        0 eth0.3
default         10.64.64.64     0.0.0.0         UG    30     0        0 3g-wan3
10.0.0.0        *               255.255.255.0   U     10     0        0 eth0.2
10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
10.64.64.64     *               255.255.255.255 UH    0      0        0 3g-wan3
192.168.100.0   *               255.255.255.0   U     0      0        0 br-lan
192.168.200.0   *               255.255.255.0   U     20     0        0 eth0.3

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    10     0        0 eth0.2
0.0.0.0         192.168.200.1   0.0.0.0         UG    20     0        0 eth0.3
0.0.0.0         10.64.64.64     0.0.0.0         UG    30     0        0 3g-wan3
10.0.0.0        0.0.0.0         255.255.255.0   U     10     0        0 eth0.2
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
10.64.64.64     0.0.0.0         255.255.255.255 UH    0      0        0 3g-wan3
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 br-lan
192.168.200.0   0.0.0.0         255.255.255.0   U     20     0        0 eth0.3

ifconfig

3g-wan3   Link encap:Point-to-Point Protocol  
          inet addr:151.248.32.209  P-t-P:10.64.64.64  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:1407 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1426 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:117552 (114.7 KiB)  TX bytes:119178 (116.3 KiB)

br-lan    Link encap:Ethernet  HWaddr F8:D1:11:B7:41:56  
          inet addr:192.168.100.100  Bcast:192.168.100.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:14363 errors:0 dropped:5 overruns:0 frame:0
          TX packets:13081 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1744978 (1.6 MiB)  TX bytes:6250600 (5.9 MiB)

eth0      Link encap:Ethernet  HWaddr F8:D1:11:B7:41:56  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:103076 errors:0 dropped:0 overruns:59886 frame:0
          TX packets:45745 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:17012323 (16.2 MiB)  TX bytes:7567712 (7.2 MiB)
          Interrupt:4 

eth0.1    Link encap:Ethernet  HWaddr F8:D1:11:B7:41:56  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7027 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7858 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:988553 (965.3 KiB)  TX bytes:2866322 (2.7 MiB)

eth0.2    Link encap:Ethernet  HWaddr F8:D1:11:B7:41:56  
          inet addr:10.0.0.155  Bcast:10.0.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:9544 errors:0 dropped:2 overruns:0 frame:0
          TX packets:3163 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:772292 (754.1 KiB)  TX bytes:370705 (362.0 KiB)

eth0.3    Link encap:Ethernet  HWaddr C8:3A:35:4E:4F:CD  
          inet addr:192.168.200.100  Bcast:192.168.200.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2444 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2139 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:239013 (233.4 KiB)  TX bytes:216762 (211.6 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:5475 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5475 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:519493 (507.3 KiB)  TX bytes:519493 (507.3 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.1  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan0     Link encap:Ethernet  HWaddr F8:D1:11:B7:41:56  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10276 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12354 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1328027 (1.2 MiB)  TX bytes:6165903 (5.8 MiB)

ip rule

0:      from all lookup local 
1001:   from all fwmark 0x100/0xff00 lookup 1001 
1002:   from all fwmark 0x200/0xff00 lookup 1002 
1003:   from all fwmark 0x300/0xff00 lookup 1003 
1016:   from all fwmark 0x1000/0xff00 lookup 1016 
1017:   from all fwmark 0x1100/0xff00 lookup 1017 
1018:   from all fwmark 0x1200/0xff00 lookup 1018 
1019:   from all fwmark 0x1300/0xff00 lookup 1019 
1020:   from all fwmark 0x1400/0xff00 lookup 1020 
1021:   from all fwmark 0x1500/0xff00 lookup 1021 
32766:  from all lookup main 
32767:  from all lookup default

Po zrobieniu ifdown pokoleii wan > wan2

przelacza sie

ale wywalaja sie bledy nastepne

ifdown wan
root@router_glowny_extroot:~# ifdown wan2
root@router_glowny_extroot:~# Cannot find device "eth0.2"
Cannot find device "eth0.3"

cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option ifname 'eth0.1'
        option type 'bridge'
        option proto 'static'
        option netmask '255.255.255.0'
        option ipaddr '192.168.100.100'
        option dns '208.67.222.222 208.67.220.220'

config interface 'wan'
        option auto '1'
        option ifname 'eth0.2'
        option proto 'static'
        option ipaddr '10.0.0.155'
        option netmask '255.255.255.0'
        option gateway '10.0.0.1'
        option dns '208.67.222.222 208.67.220.220'
        option metric '10'
        option peerdns '0'

config interface 'wan2'
        option auto '1'
        option ifname 'eth0.3'
        option macaddr 'C8:3A:35:4E:4F:CD'
        option proto 'dhcp'
        option peerdns '1'
        option dns '208.67.220.220 208.67.222.222'
        option defaultroute '1'
        option metric '20'

config interface 'wan3'
        option auto '1'
        option proto '3g'
        option device '/dev/ttyUSB0'
        option apn 'darmowy'
        option service 'umts'
        option mobile_isp 'Polska - Aero2'
        option peerdns '0'
        option dns '208.67.220.220 208.67.222.222'
        option defaultroute '1'
        option metric '30'

config switch
        option enable '1'
        option name 'rtl8366rb'
        option reset '1'
        option enable_vlan '1'
        option blinkrate '2'

config switch_vlan
        option device 'rtl8366rb'
        option vlan '1'
        option ports '2 3 4 5t'

config switch_vlan
        option device 'rtl8366rb'
        option vlan '2'
        option ports '0 5t'

config switch_vlan
        option device 'rtl8366rb'
        option vlan '3'
        option ports '1 5t'

config interface 'vpn'
        option ifname 'tun0'
        option proto 'none'
        option defaultroute '0'
        option peerdns '0'

Nie bardzo wiem co autor mial na mysli mowiac o zmianie parametrow i gdzie je zmienic nie napisal

ACTION=ifup DEVICE=eth0.1 INTERFACE=wan1 /sbin/hotplug-call iface

czy mam wydac taka komende tylko czy gdzies dopisac

ACTION=ifup DEVICE=eth0.2 INTERFACE=wan /sbin/hotplug-call iface

O CO TU CHODZI ?
po wydaniu komendy mam nastepny blad

ACTION=ifup DEVICE=eth0.2 INTERFACE=wan /sbin/hotplug-call iface
Cannot find device "eth0.2"

ACTION=ifup DEVICE=eth0.3 INTERFACE=wan2 /sbin/hotplug-call iface
uci: Entry not found
sh: wan2: unknown operand

root@router_glowny_extroot:~# ACTION=ifup DEVICE=3g INTERFACE=wan3 /sbin/hotplug-call iface
Cannot find device "3g"

oprocz tego interfejsy sie same klada pozostaje albo 1 albo 2 a widac je dopiero jak recznie sie podniesie ifup wan wan2 wan3

Co ja robie nie tak zgodnie z moimi zalozeniami chcialbym aby jakos to dzialalo - multiwan nie dziala prawidlowo a mwan3 to jakis kosmos z konfiguracja nie wiadomo o co chodzi

Nie wiem o co chodzi w rolach ip

# ip rule show
0:      from all lookup local 
1001:   from all fwmark 0x100/0xff00 lookup 1001 
1002:   from all fwmark 0x200/0xff00 lookup 1002 
1003:   from all fwmark 0x300/0xff00 lookup 1003 
1016:   from all fwmark 0x1000/0xff00 lookup 1016 
1017:   from all fwmark 0x1100/0xff00 lookup 1017 
1018:   from all fwmark 0x1200/0xff00 lookup 1018 
1019:   from all fwmark 0x1300/0xff00 lookup 1019 
1020:   from all fwmark 0x1400/0xff00 lookup 1020 
1021:   from all fwmark 0x1500/0xff00 lookup 1021 
32766:  from all lookup main 
32767:  from all lookup default 
root@router_glowny_extroot:~# ip route list table 1001
default via 10.0.0.1 dev eth0.2 
root@router_glowny_extroot:~# ip route list table 1002
default via 192.168.200.1 dev eth0.3 
root@router_glowny_extroot:~# ip route list table 1016
default via 10.0.0.1 dev eth0.2  metric 1 
root@router_glowny_extroot:~# ip route list table 1017
default via 192.168.200.1 dev eth0.3  metric 1 
root@router_glowny_extroot:~# ip route list table 1018
default via 10.64.64.64 dev 3g-wan3  metric 1 
root@router_glowny_extroot:~# ip route list table 1019
default via 192.168.200.1 dev eth0.3  metric 1 
root@router_glowny_extroot:~# ip route list table 1020
default via 10.0.0.1 dev eth0.2  metric 1 
default via 192.168.200.1 dev eth0.3  metric 2 
root@router_glowny_extroot:~# ip route list table 1021
default via 192.168.200.1 dev eth0.3  metric 1 
default via 10.0.0.1 dev eth0.2  metric 2 
root@router_glowny_extroot:~# ip route list table 1003
default via 10.64.64.64 dev 3g-wan3 
root@router_glowny_extroot:~#

Nie mam nigdzie weight

Dodatkowo nie wiem czy to dobrze pokazuje

iptables -L mwan3_pre -t mangle -v -n



Chain mwan3_pre (2 references)
 pkts bytes target     prot opt in     out     source               destination         
31734 4117K CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK restore mask 0xff00 
 1547  116K MARK       all  --  eth0.2 *       0.0.0.0/0            0.0.0.0/0           MARK xset 0x8100/0xff00 
 1402  193K MARK       all  --  eth0.3 *       0.0.0.0/0            0.0.0.0/0           MARK xset 0x8200/0xff00 
  281 23604 MARK       all  --  3g-wan3 *       0.0.0.0/0            0.0.0.0/0           MARK xset 0x8300/0xff00 
 5463  429K mwan3_default  all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x0/0xff00 
 3722  302K mwan3_interfaces  all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x0/0xff00 
  284 20490 mwan3_rules  all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x0/0xff00 

ptables -L mwan3_post -t mangle -v -n


Chain mwan3_post (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 1383  109K MARK       all  --  *      eth0.2  0.0.0.0/0            0.0.0.0/0           mark match !0x7f00/0xff00 MARK xset 0x100/0xff00 
 1439  210K MARK       all  --  *      eth0.3  0.0.0.0/0            0.0.0.0/0           mark match !0x7f00/0xff00 MARK xset 0x200/0xff00 
  317 26628 MARK       all  --  *      3g-wan3  0.0.0.0/0            0.0.0.0/0           mark match !0x7f00/0xff00 MARK xset 0x300/0xff00 
10659 1288K MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x8000/0x8000 MARK and 0xffff7fff 
30488 4097K CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK save mask 0xff00 


ptables -L mwan3_default -t mangle -v -n


Chain mwan3_default (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  162 10313 MARK       all  --  *      *       0.0.0.0/0            224.0.0.0/3         mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    0     0 MARK       all  --  *      *       0.0.0.0/0            127.0.0.0/8         mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    0     0 MARK       all  --  *      *       0.0.0.0/0            10.0.0.0/24         mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    0     0 MARK       all  --  *      *       0.0.0.0/0            10.8.0.0/24         mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    0     0 MARK       all  --  *      *       0.0.0.0/0            10.64.64.64         mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    6   361 MARK       all  --  *      *       0.0.0.0/0            192.168.100.0/24    mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    0     0 MARK       all  --  *      *       0.0.0.0/0            192.168.200.0/24    mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 


iptables -L mwan3_rules -t mangle -v -n


Chain mwan3_rules (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MARK       tcp  --  *      *       0.0.0.0/0            192.168.0.0/24      multiport sports 0:65535 multiport dports 0:65535 mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
   29  2052 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x0/0xff00 MARK xset 0x1300/0xff00

wogole nie ma TUNa

czy nie moze to byc prostrze - nie jestem w stanie zrozumiec tego - za glupi jestem, moze ktos pomoze

Na koniec zestaw komen, ktore moze pomoga rozwiklac tajemnice

ip rule
route -n
iptables -L -t mangle -v -n
cat /etc/config/mwan3
cat /etc/config/network
ip route list table 1001
ip route list table 1002
cat /etc/config/firewall

root@router_glowny_extroot:~# ip rule
0:      from all lookup local 
1001:   from all fwmark 0x100/0xff00 lookup 1001 
1002:   from all fwmark 0x200/0xff00 lookup 1002 
1003:   from all fwmark 0x300/0xff00 lookup 1003 
1016:   from all fwmark 0x1000/0xff00 lookup 1016 
1017:   from all fwmark 0x1100/0xff00 lookup 1017 
1018:   from all fwmark 0x1200/0xff00 lookup 1018 
1019:   from all fwmark 0x1300/0xff00 lookup 1019 
1020:   from all fwmark 0x1400/0xff00 lookup 1020 
1021:   from all fwmark 0x1500/0xff00 lookup 1021 
32766:  from all lookup main 
32767:  from all lookup default 
root@router_glowny_extroot:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    10     0        0 eth0.2
0.0.0.0         192.168.200.1   0.0.0.0         UG    20     0        0 eth0.3
0.0.0.0         10.64.64.64     0.0.0.0         UG    30     0        0 3g-wan3
10.0.0.0        0.0.0.0         255.255.255.0   U     10     0        0 eth0.2
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
10.64.64.64     0.0.0.0         255.255.255.255 UH    0      0        0 3g-wan3
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 br-lan
192.168.200.0   0.0.0.0         255.255.255.0   U     20     0        0 eth0.3
root@router_glowny_extroot:~# iptables -L -t mangle -v -n
Chain PREROUTING (policy ACCEPT 8382 packets, 822K bytes)
 pkts bytes target     prot opt in     out     source               destination         
26226 3209K mwan3_pre  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 8382  822K fwmark     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain INPUT (policy ACCEPT 4771 packets, 404K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  252 28983 openvpn_down_bw  udp  --  eth0.2 *       0.0.0.0/0            0.0.0.0/0           udp dpt:8086 
16065 1372K mwan3_post  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 1517 packets, 286K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 openvpn_up_bw  all  --  tun0   eth0.2  0.0.0.0/0            0.0.0.0/0           
    0     0 openvpn_down_bw  all  --  eth0.2 tun0    0.0.0.0/0            0.0.0.0/0           
 1517  286K mssfix     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 4628 packets, 589K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  835 78696 openvpn_up_bw  udp  --  *      eth0.2  0.0.0.0/0            0.0.0.0/0           udp spt:8086 
15602 2014K mwan3_pre  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain POSTROUTING (policy ACCEPT 6147 packets, 876K bytes)
 pkts bytes target     prot opt in     out     source               destination         
21549 3586K mwan3_post  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 3148  261K bw_egress  all  --  *      eth0.2  0.0.0.0/0            0.0.0.0/0           

Chain bw_egress (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id total1-upload-2-449 --type combined --current_bandwidth 0 --reset_interval 2 --reset_time 2 --intervals_to_save 449 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           match-set local_addr_set src bandwidth --id bdist1-upload-minute-15 --type individual_src --reset_interval minute --intervals_to_save 15 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id total2-upload-minute-359 --type combined --current_bandwidth 0 --reset_interval minute --intervals_to_save 359 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           match-set local_addr_set src bandwidth --id bdist2-upload-900-24 --type individual_src --reset_interval 900 --reset_time 900 --intervals_to_save 24 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id total3-upload-180-479 --type combined --current_bandwidth 0 --reset_interval 180 --reset_time 180 --intervals_to_save 479 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           match-set local_addr_set src bandwidth --id bdist3-upload-hour-24 --type individual_src --reset_interval hour --intervals_to_save 24 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id total4-upload-7200-359 --type combined --current_bandwidth 0 --reset_interval 7200 --reset_time 7200 --intervals_to_save 359 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           match-set local_addr_set src bandwidth --id bdist4-upload-day-31 --type individual_src --reset_interval day --intervals_to_save 31 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id total5-upload-day-365 --type combined --current_bandwidth 0 --reset_interval day --intervals_to_save 365 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           match-set local_addr_set src bandwidth --id bdist5-upload-month-12 --type individual_src --reset_interval month --intervals_to_save 12 

Chain fwmark (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain mssfix (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 TCPMSS     tcp  --  *      eth0.2  0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 /* wan (mtu_fix) */ TCPMSS clamp to PMTU 
   22  1320 TCPMSS     tcp  --  *      eth0.3  0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 /* wan (mtu_fix) */ TCPMSS clamp to PMTU 
    0     0 TCPMSS     tcp  --  *      3g-wan3  0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 /* wan (mtu_fix) */ TCPMSS clamp to PMTU 
   22  1320 TCPMSS     tcp  --  *      eth0.3  0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 /* wan2 (mtu_fix) */ TCPMSS clamp to PMTU 
    0     0 TCPMSS     tcp  --  *      3g-wan3  0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 /* wan3 (mtu_fix) */ TCPMSS clamp to PMTU 
    0     0 TCPMSS     tcp  --  *      tun0    0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 /* vpn (mtu_fix) */ TCPMSS clamp to PMTU 

Chain mwan3_default (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  395 23568 MARK       all  --  *      *       0.0.0.0/0            224.0.0.0/3         mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    0     0 MARK       all  --  *      *       0.0.0.0/0            127.0.0.0/8         mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    0     0 MARK       all  --  *      *       0.0.0.0/0            10.0.0.0/24         mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    0     0 MARK       all  --  *      *       0.0.0.0/0            10.8.0.0/24         mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    0     0 MARK       all  --  *      *       0.0.0.0/0            10.64.64.64         mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
   11   864 MARK       all  --  *      *       0.0.0.0/0            192.168.100.0/24    mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
    0     0 MARK       all  --  *      *       0.0.0.0/0            192.168.200.0/24    mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 

Chain mwan3_interfaces (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 3575  294K mwan3_wan3  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 3235  267K mwan3_wan2  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 2197  181K mwan3_wan  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain mwan3_post (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 3428  284K MARK       all  --  *      eth0.2  0.0.0.0/0            0.0.0.0/0           mark match !0x7f00/0xff00 MARK xset 0x100/0xff00 
 2357  346K MARK       all  --  *      eth0.3  0.0.0.0/0            0.0.0.0/0           mark match !0x7f00/0xff00 MARK xset 0x200/0xff00 
  493 41412 MARK       all  --  *      3g-wan3  0.0.0.0/0            0.0.0.0/0           mark match !0x7f00/0xff00 MARK xset 0x300/0xff00 
13997 1618K MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x8000/0x8000 MARK and 0xffff7fff 
37614 4958K CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK save mask 0xff00 

Chain mwan3_pre (2 references)
 pkts bytes target     prot opt in     out     source               destination         
41828 5222K CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK restore mask 0xff00 
 5588  429K MARK       all  --  eth0.2 *       0.0.0.0/0            0.0.0.0/0           MARK xset 0x8100/0xff00 
 2635  346K MARK       all  --  eth0.3 *       0.0.0.0/0            0.0.0.0/0           MARK xset 0x8200/0xff00 
  491 41244 MARK       all  --  3g-wan3 *       0.0.0.0/0            0.0.0.0/0           MARK xset 0x8300/0xff00 
 7240  569K mwan3_default  all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x0/0xff00 
 5193  424K mwan3_interfaces  all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x0/0xff00 
  318 22866 mwan3_rules  all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x0/0xff00 

Chain mwan3_rules (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MARK       tcp  --  *      *       0.0.0.0/0            192.168.0.0/24      multiport sports 0:65535 multiport dports 0:65535 mark match 0x0/0xff00 MARK xset 0x7f00/0xff00 
   56  3936 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x0/0xff00 MARK xset 0x1300/0xff00 

Chain mwan3_wan (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 1011 82378 MARK       all  --  *      *       10.0.0.155           0.0.0.0/0           MARK xset 0x100/0xff00 

Chain mwan3_wan2 (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 1207  101K MARK       all  --  *      *       192.168.200.100      0.0.0.0/0           MARK xset 0x200/0xff00 

Chain mwan3_wan3 (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  493 41412 MARK       all  --  *      *       37.209.128.169       0.0.0.0/0           MARK xset 0x300/0xff00 

Chain openvpn_down_bw (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-hr1-download-2-449 --type combined --current_bandwidth 0 --reset_interval 2 --reset_time 2 --intervals_to_save 449 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-lr1-download-minute-15 --type combined --current_bandwidth 0 --reset_interval minute --intervals_to_save 15 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-hr2-download-minute-359 --type combined --current_bandwidth 0 --reset_interval minute --intervals_to_save 359 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-lr2-download-900-24 --type combined --current_bandwidth 0 --reset_interval 900 --reset_time 900 --intervals_to_save 24 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-hr3-download-180-479 --type combined --current_bandwidth 0 --reset_interval 180 --reset_time 180 --intervals_to_save 479 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-lr3-download-hour-24 --type combined --current_bandwidth 0 --reset_interval hour --intervals_to_save 24 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-hr4-download-7200-359 --type combined --current_bandwidth 0 --reset_interval 7200 --reset_time 7200 --intervals_to_save 359 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-lr4-download-day-31 --type combined --current_bandwidth 0 --reset_interval day --intervals_to_save 31 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-hr5-download-day-365 --type combined --current_bandwidth 0 --reset_interval day --intervals_to_save 365 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-lr5-download-month-12 --type combined --current_bandwidth 0 --reset_interval month --intervals_to_save 12 

Chain openvpn_up_bw (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-hr1-upload-2-449 --type combined --current_bandwidth 0 --reset_interval 2 --reset_time 2 --intervals_to_save 449 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-lr1-upload-minute-15 --type combined --current_bandwidth 0 --reset_interval minute --intervals_to_save 15 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-hr2-upload-minute-359 --type combined --current_bandwidth 0 --reset_interval minute --intervals_to_save 359 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-lr2-upload-900-24 --type combined --current_bandwidth 0 --reset_interval 900 --reset_time 900 --intervals_to_save 24 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-hr3-upload-180-479 --type combined --current_bandwidth 0 --reset_interval 180 --reset_time 180 --intervals_to_save 479 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-lr3-upload-hour-24 --type combined --current_bandwidth 0 --reset_interval hour --intervals_to_save 24 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-hr4-upload-7200-359 --type combined --current_bandwidth 0 --reset_interval 7200 --reset_time 7200 --intervals_to_save 359 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-lr4-upload-day-31 --type combined --current_bandwidth 0 --reset_interval day --intervals_to_save 31 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-hr5-upload-day-365 --type combined --current_bandwidth 0 --reset_interval day --intervals_to_save 365 
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           bandwidth --id openvpn-lr5-upload-month-12 --type combined --current_bandwidth 0 --reset_interval month --intervals_to_save 12 
root@router_glowny_extroot:~# cat /etc/config/mwan3
# This is a mwan3 example config. For mwan3 to work you will need at least:
#
# - 2 interfaces
# - 2 members
# - 1 policy
# - 1 rule
#
# First define all your wan interfaces. Interface name must match with the
# name used in your network configuration:

config 'interface' 'wan'
        option 'enabled' '1'
        list 'track_ip' '8.8.4.4'
        list 'track_ip' '8.8.8.8'
        list 'track_ip' '208.67.222.222'
        list 'track_ip' '208.67.220.220'
        option 'reliability' '3'
        option 'count' '1'
        option 'timeout' '2'
        option 'interval' '5'
        option 'down' '3'
        option 'up' '5'
        option 'reroute' '0'

config 'interface' 'wan2'
        option 'enabled' '1'
        list 'track_ip' '8.8.8.8'
        list 'track_ip' '8.8.4.4'
        list 'track_ip' '208.67.222.222'
        list 'track_ip' '208.67.220.220'
        option 'reliability' '1'
        option 'count' '1'
        option 'timeout' '2'
        option 'interval' '5'
        option 'down' '3'
        option 'up' '5'
        option 'reroute' '0'


config 'interface' 'wan3'               
        option 'enabled' '1'            
        list 'track_ip' '8.8.8.8'       
        list 'track_ip' '8.8.4.4'
        list 'track_ip' '208.67.222.222'
        list 'track_ip' '208.67.220.220'
        option 'reliability' '3'        
        option 'count' '1'              
        option 'timeout' '5'            
        option 'interval' '10'           
        option 'down' '3'               
        option 'up' '8'                 
        option 'reroute' '0'  


# Next define a member and configure metric and weight values for this member.
# Each interface can have multiple member definitions. Give each member a correct
# name (A-Z, a-z, 0-9, "_" and no spaces).

config member 'wan_m1_w2'
       option metric '1'
       option weight '2'
       option interface 'wan'
            
config member 'wan_m2_w2'
       option metric '2'
       option weight '2'
       option interface 'wan'
                        
config member 'wan2_m1_w2'
       option interface 'wan2'
       option metric '1'
       option weight '2'
                                    
config member 'wan2_m2_w2'
       option interface 'wan2'
       option metric '2'
       option weight '2'
                                                
config member 'wan3_m1_w1'
       option interface 'wan3'
       option metric '1'
       option weight '2'
                                                            
config member 'wan3_m2_w1'
       option interface 'wan3'
       option metric '2'
       option weight '2'

# After that create a routing policy. A routing policy consist of one or more
# members. Give each policy a correct name (A-Z, a-z, 0-9, "_" and no spaces). You 
# can create multiple policies, so that it is possible for different traffic to
# have different primary and/or backup interfaces.

config policy 'wan_only'
       list use_member 'wan_m1_w2'
    
config policy 'wan2_only'
       list use_member 'wan2_m1_w2'
        
config policy 'wan3_only'
       list use_member 'wan3_m1_w1'
            
config 'policy' 'wan1_wan2_loadbalanced'
    list 'use_member' 'wan1_m1_w2'
    list 'use_member' 'wan2_m1_w2'

                        
config policy 'wan_pri_wan2_sec'
       list use_member 'wan_m1_w2'
       list use_member 'wan2_m2_w2'
                                
config policy 'wan2_pri_wan_sec'
       list use_member 'wan_m2_w2'
       list use_member 'wan2_m1_w2'
                                        



# And to finish the config define your traffic rules. Rules are matched in top to
# bottom order. If you define a rule and it matches, all following rules are ignored.
#
# If the option equalize is set, mwan3 will load-balance each new session to the same
# host. If not set, it will load-balance based on destination.

config 'rule'
    option 'dest_ip' '192.168.0.0/24'
    option 'proto' 'tcp'
    option 'use_policy' 'default'

config 'rule'

    option 'dest_ip' '0.0.0.0/0'
    option 'equalize' '1'
    option 'use_policy' 'wan1_wan2_loadbalanced'
root@router_glowny_extroot:~# cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option ifname 'eth0.1'
        option type 'bridge'
        option proto 'static'
        option netmask '255.255.255.0'
        option ipaddr '192.168.100.100'
        option dns '208.67.222.222 208.67.220.220'

config interface 'wan'
        option auto '1'
        option ifname 'eth0.2'
        option proto 'static'
        option ipaddr '10.0.0.155'
        option netmask '255.255.255.0'
        option gateway '10.0.0.1'
        option dns '208.67.222.222 208.67.220.220'
        option metric '10'
        option peerdns '0'

config interface 'wan2'
        option auto '1'
        option ifname 'eth0.3'
        option macaddr 'C8:3A:35:4E:4F:CD'
        option proto 'dhcp'
        option peerdns '1'
        option dns '208.67.220.220 208.67.222.222'
        option defaultroute '1'
        option metric '20'

config interface 'wan3'
        option auto '1'
        option proto '3g'
        option device '/dev/ttyUSB0'
        option apn 'darmowy'
        option service 'umts'
        option mobile_isp 'Polska - Aero2'
        option peerdns '0'
        option dns '208.67.220.220 208.67.222.222'
        option defaultroute '1'
        option metric '30'

config switch
        option enable '1'
        option name 'rtl8366rb'
        option reset '1'
        option enable_vlan '1'
        option blinkrate '2'

config switch_vlan
        option device 'rtl8366rb'
        option vlan '1'
        option ports '2 3 4 5t'

config switch_vlan
        option device 'rtl8366rb'
        option vlan '2'
        option ports '0 5t'

config switch_vlan
        option device 'rtl8366rb'
        option vlan '3'
        option ports '1 5t'

config interface 'vpn'
        option ifname 'tun0'
        option proto 'none'
        option defaultroute '0'
        option peerdns '0'

root@router_glowny_extroot:~# ip route list table 1001
default via 10.0.0.1 dev eth0.2 
root@router_glowny_extroot:~# ip route list table 1002
default via 192.168.200.1 dev eth0.3 
root@router_glowny_extroot:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
option 'conntrack' '1'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan2 wan3'
option 'conntrack' '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config zone
        option name 'wan2'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan2'

option 'conntrack' '1'

config forwarding
        option src 'lan'
        option dest 'wan2'

config zone
        option name 'wan3'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan3'
option 'conntrack' '1'

config forwarding
        option src 'lan'
        option dest 'wan3'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-Ping'
        option src 'wan2'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-Ping'
        option src 'wan3'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config include
        option path '/usr/lib/gargoyle_firewall_util/gargoyle_additions.firewall'

config include 'openvpn_include_file'
        option path '/etc/openvpn.firewall'
        option reload '1'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'IPv4'
        option reload '1'

config remote_accept 'ra_443_8085'
        option local_port '443'
        option remote_port '8085'
        option proto 'tcp'
        option zone 'wan'

config zone 'vpn_zone'
        option name 'vpn'
        option network 'vpn'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option mtu_fix '1'
        option masq '1'

config forwarding 'vpn_lan_forwarding'
        option src 'lan'
        option dest 'vpn'

config remote_accept 'ra_openvpn'
        option zone 'wan'
        option local_port '8086'
        option remote_port '8086'
        option proto 'udp'

config forwarding 'vpn_wan_forwarding'
        option src 'vpn'
        option dest 'wan'

roblad · 2013-10-11 16:03:21

roblad
Użytkownik
Nieaktywny

Zarejestrowany: 2013-03-14
Posty: 1,036

Odp: Problem z OpenVPN

Dodatkowo nie widzi zasobow lokalnych openvpn jesli polacze sie na wan2 cos nie przestawia rutingu po zmianie w /etc/openvpn/server/route_data z 192.168.100.0 255.255.255.0 10.8.0.0 na 192.168.0.0 255.255.255.0 10.8.0.0 widzi zasoby lokalne - co z tego jak po restarcie mi to zniknie.

Jak jest podniesiony wan i wan2 to do openvpn moge sie podlaczyc tylko na wan po polozeniu wan moge polkaczyc sie na wan2

Load balancing tez mi nie dziala na multiwanie dzialal - tu idzie wan nie idzie przez wan i wan2

dodatkowo po polozeniu wan czy wan2 interfejsy nie podnosza sie same

moj nowy config - od rana walcze z mwan3 - i jest kicha

cat /etc/config/mwan3 
# This is a mwan3 example config. For mwan3 to work you will need at least:
#
# - 2 interfaces
# - 2 members
# - 1 policy
# - 1 rule
#
# First define all your wan interfaces. Interface name must match with the
# name used in your network configuration:

config 'interface' 'wan'
        option 'enabled' '1'
        list 'track_ip' '8.8.4.4'
        list 'track_ip' '8.8.8.8'
        list 'track_ip' '208.67.222.222'
        list 'track_ip' '208.67.220.220'
        option 'reliability' '3'
        option 'count' '1'
        option 'timeout' '2'
        option 'interval' '5'
        option 'down' '3'
        option 'up' '5'
        option 'reroute' '0'

config 'interface' 'wan2'
        option 'enabled' '1'
        list 'track_ip' '8.8.8.8'
        list 'track_ip' '8.8.4.4'
        list 'track_ip' '208.67.222.222'
        list 'track_ip' '208.67.220.220'
        option 'reliability' '1'
        option 'count' '1'
        option 'timeout' '2'
        option 'interval' '5'
        option 'down' '3'
        option 'up' '5'
        option 'reroute' '0'


config 'interface' 'wan3'               
        option 'enabled' '1'            
        list 'track_ip' '8.8.8.8'       
        list 'track_ip' '8.8.4.4'
        list 'track_ip' '208.67.222.222'
        list 'track_ip' '208.67.220.220'
        option 'reliability' '3'        
        option 'count' '1'              
        option 'timeout' '5'            
        option 'interval' '60'           
        option 'down' '4'               
        option 'up' '8'                 
        option 'reroute' '0'  


# Next define a member and configure metric and weight values for this member.
# Each interface can have multiple member definitions. Give each member a correct
# name (A-Z, a-z, 0-9, "_" and no spaces).

config member 'wan_m1_w1'
       option metric '1'
       option weight '5'
       option interface 'wan'
            
config member 'wan_m2_w2'
       option metric '2'
       option weight '5'
       option interface 'wan'     
              
config member 'wan2_m1_w1'
       option interface 'wan2'
       option metric '1'
       option weight '3'

config member 'wan2_m2_w2'
       option interface 'wan2'
       option metric '2'
       option weight '3'

   
# After that create a routing policy. A routing policy consist of one or more
# members. Give each policy a correct name (A-Z, a-z, 0-9, "_" and no spaces). You 
# can create multiple policies, so that it is possible for different traffic to
# have different primary and/or backup interfaces.

config policy 'wan_only'
        list use_member 'wan_m1_w1'

config policy 'wan2_only'
        list use_member 'wan2_m1_w1'
            
config 'policy' 'wan_wan2_loadbalanced'
    list 'use_member' 'wan1_m1_w1'
    list 'use_member' 'wan2_m2_w2'

config policy 'wan_pri_wan2_sec'
       list 'use_member' 'wan1_m1_w1'
       list 'use_member' 'wan2_m2_w2'

config policy 'wan2_pri_wan_sec'
       list 'use_member' 'wan2_m1_w1'
       list 'use_member' 'wan_m2_w2'
                              
# And to finish the config define your traffic rules. Rules are matched in top to
# bottom order. If you define a rule and it matches, all following rules are ignored.
#
# If the option equalize is set, mwan3 will load-balance each new session to the same
# host. If not set, it will load-balance based on destination.


#config 'rule'
#    option 'dest_ip' '192.168.0.0/24'
#    option 'proto' 'tcp'

#    option 'use_policy' 'default'

config 'rule'

    option 'dest_ip' '0.0.0.0/0'
    option proto 'all'
    option 'use_policy' 'wan_wan2_loadbalanced'
     option equalize '1'

- naprawde jest cos nie tak albo z openvpn i mwan3 - trzeba miec naprawde mocne doswiadczenie w tym zeby to skonfigurowac od podstaw sie nie da

roblad · 2013-10-12 01:49:31

roblad
Użytkownik
Nieaktywny

Zarejestrowany: 2013-03-14
Posty: 1,036

Odp: Problem z OpenVPN

Witam,

root@router_glowny_extroot:~# ip route list table 1018
default metric 1
nexthop via 192.168.200.1 dev eth0.3 weight 2
nexthop via 10.0.0.1 dev eth0.2 weight 8

okazalo sie wman3 w repo Cezarego jest przestarzaly - mam buga dlatego mialem problemy i z mwan3 skontaktowalem sie z autorem i to jego odpowiedz w sprawie niedzialajacego loadbalancu

"Which version of mwan3 are you using? The reason i ask is because there was a bug in earlier versions. The bug was that when an interface is named "wan", it would not work. So please update to version 1.2-20 or rename your "wan" interface to "wan1".
Jeroen."

Cezary mozesz zaktualizowac swoje repo do wersji 1.2-20 - po wgraniu nowej wersji - bez zmiany wan na wan1 wszystko zaczelo dzialac
z balancingiem routing openvpn do zasobow lokalnych po polaczeniu z serwerem openvpn dziala - fakt ze jak chodzi wan to na wan2 na openvpn sie nie podlaczy ale jak wan wraca to przelaczyc sie mozna bez problemu niestety nie trzyma konekcji na wan2 tylko sie zacina.

przelaczenie wan > wan2 >wan3 dziala niemal bez zauwazenia ze sie cos przelaczylo.

Warto jednak by opisac cos wiecej o mwan3 na stronkach eko - totalna czarna magia - i dzien zajmuje aby zrozumiec co autor mwan3 mial na mysli.

FAQ o OpenWrt | Sprzedam różne routery | Oddam

Problem z OpenVPN (Strona 4 z 4)

Posty: 76 do 81 z 81

76 Odpowiedź przez roblad 2013-10-10 21:53:47

Odp: Problem z OpenVPN

77 Odpowiedź przez Cezary 2013-10-10 21:56:55

Odp: Problem z OpenVPN

78 Odpowiedź przez roblad 2013-10-10 22:02:12

Odp: Problem z OpenVPN

79 Odpowiedź przez roblad 2013-10-11 15:10:31

Odp: Problem z OpenVPN

80 Odpowiedź przez roblad 2013-10-11 16:03:21 (edytowany przez roblad 2013-10-11 18:18:36)

Odp: Problem z OpenVPN

81 Odpowiedź przez roblad 2013-10-12 01:49:31

Odp: Problem z OpenVPN

Posty: 76 do 81 z 81