Gargoyle Forum

Posted: **Thu Jan 15, 2015 6:57 am**

Hi!
I have VPN tunnel - pptp. Only one ISP (mobile connection). I need to make port routing - only ftp traffic through the VPN. I have wdr3600, OpenWRT Attitude Adjustment - Gargoyle.
Until now, i did this:
1: Add new number of table ftptab

Code: Select all

root@Gargoyle:~# cat /etc/iproute2/rt_tables
#
# reserved values
#
255     local
254     main
253     default
0       unspec
#
# local
#
#1      inr.ruhep
200 ftptab

2: mark ftp traffic - code paste in /etc/rc.local (My WAN connection is eth1)

Code: Select all

ip rule add fwmark 1000 table ftptab
ip route flush cache
iptables -t mangle -A PREROUTING -i eth1 -p tcp --sport 20 -j MARK --set-mark 1000
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 20 -j MARK --set-mark 1000
iptables -t mangle -A PREROUTING -i eth1 -p tcp --sport 21 -j MARK --set-mark 1000
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 21 -j MARK --set-mark 1000
iptables -t mangle -A PREROUTING -m helper --helper ftp -j MARK --set-mark 1000

3: In PPTP config i add defaultroute '0':

Code: Select all

root@Gargoyle:~# cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option ifname 'eth0.1'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option dns '192.168.1.1'

config interface 'wan'
        option proto 'dhcp'
        option ifname 'eth1'

config switch
        option name 'eth0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'eth0'
        option vlan '1'
        option ports '0t 2 3 4 5'

config switch_vlan
        option device 'eth0'
        option vlan '2'
        option ports '0t 1'

config interface 'vpnpptp'
        option proto 'pptp'
        option server 'xxx'
        option username 'xxx'
        option password 'xxx'
        option defaultroute '0'

4: My ip route show:

Code: Select all

root@Gargoyle:~# ip route show
default via 192.168.8.1 dev eth1  proto static
10.100.201.254 dev pptp-vpnpptp  proto kernel  scope link  src 10.100.200.204
185.25.148.103 via 192.168.8.1 dev eth1  proto static
192.168.1.0/24 dev br-lan  proto kernel  scope link  src 192.168.1.1
192.168.8.0/24 dev eth1  proto kernel  scope link  src 192.168.8.100

So i use this command:

Code: Select all

ip route add default via 10.100.201.254 dev pptp-vpnpptp table ftptab

5: In firewall i add in config zone:

Code: Select all

list network 'wan vpnpptp'

all firewall config:

Code: Select all

root@Gargoyle:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        list network 'wan vpnpptp'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'
        option reload '1'

config include
        option type 'script'
        option path '/usr/lib/gargoyle_firewall_util/gargoyle_additions.firewall'
        option family 'IPv4'
        option reload '1'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'IPv4'
        option reload '1'

config include 'openvpn_include_file'
        option path '/etc/openvpn.firewall'
        option reload '1'

config zone 'vpnpptp_zone'
        option name 'vpnpptp'
        option network 'vpnpptp'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option mtu_fix '1'
        option masq '1'

config forwarding 'vpnpptp_lan_forwarding'
        option src 'lan'
        option dest 'vpnpptp'

config remote_accept 'ra_80_80'
        option local_port '80'
        option remote_port '80'
        option proto 'tcp'
        option zone 'wan'

config remote_accept 'wan_ftp_server_command'
        option proto 'tcp'
        option zone 'wan'
        option local_port '21'
        option remote_port '21'

config remote_accept 'wan_ftp_server_pasv'
        option proto 'tcp'
        option zone 'wan'
        option start_port '50990'
        option end_port '50999'

But the server ftp is not visible, when i try use VPN IP to get ftp access, using other internet connection.
Someone can help me? Sorry for my english...

Posted: **Tue Jan 20, 2015 2:04 pm**

what version of gargoyle?

Gargoyle Forum

PPTP port routing (traffic only through FTP)

PPTP port routing (traffic only through FTP)

Re: PPTP port routing (traffic only through FTP)