ddwrt-ovpn-pbr-block-wan-288852.sh

#!/bin/sh
################################################################################
# IMPORTANT: This script is officially deprecated as of April 4, 2021,
#            and has been replaced by: https://pastebin.com/TKdKUmY1
#            Please discontinue further use.
################################################################################

#         name: ddwrt-ovpn-pbr-block-wan.sh
#      version: 2.0.2, 12-Feb-2016, by eibgrad
#      purpose: block access LAN->WAN for IPs in OpenVPN client policy based routing
#  script type: firewall
#   dd-wrt ref: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=288852
# installation:
#   1. set VPN_ENABLED_ONLY to your preference
#   2. set FW_STATE to your preference
#   3. install this script in the router's firewall script
#   4. reboot

VPN_ENABLED_ONLY="1" # (0 = apply rules 24/7, 1 = apply rules only if VPN enabled)

# state checking: "state NEW" vs. no state
#   state NEW (default):
#     * any pre-existing LAN->WAN connections persist until/unless they timeout/close
#     * remote access (WAN->LAN) is allowed (provided port forwarding is enabled)
#     * more efficient (only LAN->WAN packets used to establish NEW connections are inspected)
#   no state:
#     * any pre-existing LAN->WAN connections are stopped/blocked
#     * remote access (WAN->LAN) is denied (even if port forwarding is enabled)
#     * less efficient (every LAN->WAN packet is inspected)

FW_STATE="-m state --state NEW"
#FW_STATE="" # uncomment/comment to disable/enable state checking

WAN_IF="$(ip route | awk '/^default/{print $NF}')"
FW_CHAIN="blocked-ips"

# cleanup from possible prior execution
(
iptables -D FORWARD -o $WAN_IF $FW_STATE -j $FW_CHAIN
iptables -F $FW_CHAIN
iptables -X $FW_CHAIN
) >/dev/null 2>&1

# quit if no IPs in policy based routing
[ -z "$(nvram get openvpncl_route)" ] && exit

# quit if vpn disabled (unless firewall rules still need to be enforced)
[[ "$(nvram get openvpncl_enable)" == "0" && "$VPN_ENABLED_ONLY" != "0" ]] && exit

# create firewall chain for blocked IPs
iptables -N $FW_CHAIN

# read IP addresses from OpenVPN client policy based routing
echo -e "$(nvram get openvpncl_route)" | \
    while read ip; do
        ip=${ip//$'\r'} # remove carriage returns

        [ -z "$ip" ] && continue # skip blank lines

        # block access LAN->WAN for this IP address
        iptables -A $FW_CHAIN -p tcp -s $ip -j REJECT --reject-with tcp-reset
        iptables -A $FW_CHAIN -s $ip -j REJECT --reject-with icmp-host-prohibited
    done

# begin blocking: force LAN->WAN traffic thru firewall chain for inspection
iptables -I FORWARD -o $WAN_IF $FW_STATE -j $FW_CHAIN