ddwrt-pptp-policy-based-routing.sh

#!/bin/sh
#DEBUG=; set -x # comment/uncomment to disable/enable debug mode

#         name: ddwrt-pptp-policy-based-routing.sh
#      version: 1.1.1, 28-jun-2019, by eibgrad
#      purpose: add policy based routing to pptp client
#  script type: startup (autostart)
#    1. enable jffs2 (administration->jffs2)
#    2. enable syslogd (services->services->system log)
#    3. use shell (telnet/ssh) to execute one of the following commands:
#         curl -kLs bit.ly/ddwrt-installer|tr -d '\r'|sh -s 9DUMFJgN ipup
#       or
#         wget -qO - bit.ly/ddwrt-installer|tr -d '\r'|sh -s 9DUMFJgN ipup
#    4. modify options and rules using vi editor:
#         vi /jffs/etc/config/ddwrt-pptp-policy-based-routing.ipup
#    5. reboot
(
# ------------------------------ BEGIN OPTIONS ------------------------------- #

# alternate table-id (valid values: 1-252)
TID=200

# ------------------------------- END OPTIONS -------------------------------- #
add_rules() {
# ------------------------------- BEGIN RULES -------------------------------- #

# - the order of rules does NOT matter (there is no order of precedence);
# since the pptp client changes the default gateway to the VPN, if *any*
# rule herein matches, those packets are routed back over the WAN/ISP

# - when dealing w/ an ip range, consider using an "ip range to cidr"
# converter to significantly reduce the number of required rules and
# increase performance:
#   https://www.ipaddressguide.com/cidr
#   https://ip2cidr.com

# - domain names (e.g., netflix.com) are NOT allowed

# source ip/network/interface
ip rule add from 192.168.1.100 table $TID
ip rule add from 192.168.1.200/29 table $TID # 192.168.1.200 ...
ip rule add from 192.168.1.208/31 table $TID # ... thru 192.168.1.209
ip rule add iif br1 table $TID

# destination ip/network
ip rule add to 61.201.238.191 table $TID
ip rule add to 118.195.77.0/24 table $TID

# source ip/network/interface + destination ip/network
ip rule add from 192.168.1.110 to 157.144.245.188 table $TID
ip rule add iif br2 to 92.48.0.0/16 table $TID

# -------------------------------- END RULES --------------------------------- #
:;}
# ---------------------- DO NOT CHANGE BELOW THIS LINE ----------------------- #

# reset policy based routing
while ip rule del from 0/0 table $TID 2>/dev/null; do :; done
ip route flush table $TID
ip route flush cache

# disconnect script (same as this script)
IPDOWN_SCRIPT="${0%.*}.ipdown"

# add symbolic link (for disconnect script)
[ -L "$IPDOWN_SCRIPT" ] || ln -sf $0 "$IPDOWN_SCRIPT"

# upon disconnect, remove symbolic link
[ "$0" == "$IPDOWN_SCRIPT" ] && { rm -f $IPDOWN_SCRIPT; exit 0; }

WAN_GW="$(nvram get wan_gateway_buf)"

[ "$WAN_GW" ] || { echo "error: WAN/ISP gateway not found"; exit 1; }

# copy non-default routes from main routing table to alternate
ip route | grep -v '^default ' \
  | while read route; do
        ip route add $route table $TID
    done

# add WAN/ISP default gateway to alternate routing table
ip route add default via $WAN_GW table $TID

# add rules
add_rules

# force routing system to recognize changes
ip route flush cache

exit 0

) 2>&1 | logger $([ ${DEBUG+x} ] && echo "-p user.debug") \
    -t $(echo $(basename $0) | grep -Eo '^.{0,23}')[$$]