|
7 years ago | |
---|---|---|
.. | ||
README.md | 8 years ago | |
vpnbypass.conf | 8 years ago | |
vpnbypass.hotplug | 8 years ago | |
vpnbypass.init | 7 years ago |
A simple PROCD-based vpnbypass service for OpenWrt/LEDE Project. Useful if your router accesses internet thru VPN client/tunnel, but you want specific traffic (ports, IP ranges, domains or local IP ranges) to be routed outside of this tunnel.
This service requires following packages to be installed on your router: ipset
and iptables
. Additionally, if you want to use Domain Bypass feature, you need to install dnsmasq-full
(dnsmasq-full
requires you uninstall dnsmasq
first).
To fully satisfy the requirements for both IP/Port VPN Bypass and Domain Bypass features connect to your router via ssh and run the following commands:
opkg update; opkg remove dnsmasq; opkg install ipset iptables dnsmasq-full
To satisfy the requirements for just IP/Port VPN Bypass connect to your router via ssh and run the following commands:
opkg update; opkg install ipset iptables
If you are running a development (trunk/snapshot) build of OpenWrt/LEDE Project on your router and your build is outdated (meaning that packages of the same revision/commit hash are no longer available and when you try to satisfy the requirements you get errors), please flash either current LEDE release image or current development/snapshot image.
Please make sure that the requirements are satisfied and install vpnbypass
and luci-app-vpnbypass
from Web UI or connect to your router via ssh and run the following commands:
opkg update
opkg install vpnbypass luci-app-vpnbypass
If these packages are not found in the official feed/repo for your version of OpenWrt/LEDE Project, you will need to add a custom repo to your router first.
If your router is not set up with the access to repository containing these packages you will need to add custom repository to your router by connecting to your router via ssh and running the following commands:
opkg update; opkg install wget libopenssl
echo -e -n 'untrusted comment: public key 7ffc7517c4cc0c56\nRWR//HUXxMwMVnx7fESOKO7x8XoW4/dRidJPjt91hAAU2L59mYvHy0Fa\n' > /tmp/stangri-repo.pub && opkg-key add /tmp/stangri-repo.pub
! grep -q 'stangri_repo' /etc/opkg/customfeeds.conf && echo 'src/gz stangri_repo https://raw.githubusercontent.com/stangri/openwrt-repo/master' >> /etc/opkg/customfeeds.conf
opkg update
opkg update; opkg install uclient-fetch libustream-mbedtls
echo -e -n 'untrusted comment: public key 7ffc7517c4cc0c56\nRWR//HUXxMwMVnx7fESOKO7x8XoW4/dRidJPjt91hAAU2L59mYvHy0Fa\n' > /tmp/stangri-repo.pub && opkg-key add /tmp/stangri-repo.pub
! grep -q 'stangri_repo' /etc/opkg/customfeeds.conf && echo 'src/gz stangri_repo https://raw.githubusercontent.com/stangri/openwrt-repo/master' >> /etc/opkg/customfeeds.conf
opkg update
Default configuration has service disabled (use Web UI to enable/start service or run uci set vpnbypass.config.enabled=1
) and routes Plex Media Server traffic (port 32400) outside of the VPN tunnel, routes LogmeIn Hamachi traffic (25.0.0.0/8) outside of the VPN tunnel and also routes internet traffic from local IPs 192.168.1.81-192.168.1.87 outside of the VPN tunnel. You can safely delete these example rules if they do not apply to you.
Please head to LEDE Project Forum for discussions of this service.
Domain lists should be in following format/syntax: /domain1.com/domain2.com/vpnbypass
. Please don't forget the leading /
and trailing /vpnbypass
. There's no validation if you enter something incorrectly -- it just won't work. Please see Notes/Known Issues if you want to edit this setting manually, without Web UI.
1.3.0
wan
) works with other interface names (like wwan
).1.2.0
1.1.1
1.1.0:
1.0.0:
0.1.0:
0.0.1:
/etc/config/vpnpass
, but rather in /etc/config/dhcp
. To add/delete/edit domains you can use VPN Bypass Web UI or you can edit /etc/config/dhcp
manually or run following commands:uci add_list dhcp.@dnsmasq[-1].ipset='/github.com/plex.tv/google.com/vpnbypass'
uci add_list dhcp.@dnsmasq[-1].ipset='/hulu.com/netflix.com/nhl.com/vpnbypass'
uci commit dhcp
/etc/init.d/dnsmasq restart
This feature requires dnsmasq-full
to work. See Requirements paragraph for more details.