net/vpnbypass/files/README.md

   1 # VPN Bypass
   2
   3 A simple [procd](https://openwrt.org/docs/techref/procd)-based ```vpnbypass``` service for OpenWrt/LEDE Project. This is useful if your router accesses Internet through a VPN client/tunnel, but you want specific traffic (ports, IP ranges, domains or local IP ranges) to be routed outside of this tunnel.
   4
   5 ## Features
   6
   7 - Define local ports so traffic to them is routed outside of the VPN tunnel (by default it routes Plex Media Server traffic (port 32400) outside of the VPN tunnel).
   8 - Define IPs/subnets in local networks so their traffic is routed outside the VPN tunnel (by default it routes traffic from 192.168.1.81-192.168.1.87 outside the VPN tunnel).
   9 - Define remote IP ranges that are accessed outside the VPN tunnel (by default, LogmeIn Hamachi traffic (25.0.0.0/8) is routed outside the VPN tunnel).
  10 - Creates list of domain names which should be accessed outside the VPN tunnel (useful for Netflix, Hulu, etc).
  11 - Does not reside in RAM -- creates `iptables` rules which are automatically updated on WAN up/down events.
  12 - A companion package (`luci-app-vpnbypass`) is provided so all features may be configured from the Web UI.
  13 - Proudly made in Canada, using locally-sourced electrons.
  14
  15 ## Screenshot (luci-app-vpnbypass)
  16
  17 ![screenshot](https://raw.githubusercontent.com/stangri/openwrt_packages/master/screenshots/vpnbypass/screenshot02.png "screenshot")
  18
  19 ## Requirements
  20
  21 This service requires the following packages to be installed on your router: ```ipset``` and ```iptables```. Additionally, if you want to use the Domain Bypass feature, you need to install ```dnsmasq-full``` (```dnsmasq-full``` requires you uninstall ```dnsmasq``` first).
  22
  23 To fully satisfy the requirements for both IP/Port VPN Bypass and Domain Bypass features connect via ssh to your router and run the following commands:
  24
  25 ```sh
  26 opkg update; opkg remove dnsmasq; opkg install ipset iptables dnsmasq-full
  27 ```
  28
  29 To satisfy the requirements for just IP/Port VPN Bypass connect to your router via ssh and run the following commands:
  30
  31 ```sh
  32 opkg update; opkg install ipset iptables
  33 ```
  34
  35 ### Unmet dependencies
  36
  37 If you are running a development (trunk/snapshot) build of OpenWrt/LEDE Project on your router and your build is outdated (meaning that packages of the same revision/commit hash are no longer available and when you try to satisfy the [requirements](#requirements) you get errors), please flash either current LEDE release image or current development/snapshot image.
  38
  39 ## How to install
  40
  41 <!---
  42 #### From Web UI/Luci
  43 Navigate to System->Software page on your router and then perform the following actions:
  44 1. Click "Update Lists"
  45 2. Wait for the update process to finish.
  46 3. In the "Download and install package:" field type ```vpnbypass luci-app-vpnbypass```
  47 4. Click "OK" to install ```vpnbypass``` and ```luci-app-vpnbypass```
  48
  49 If you get an ```Unknown package 'vpnbypass'``` error, your router is not set up with the access to a repository containing these packages and you need to add the custom repository to your router first.
  50
  51 #### From console/ssh
  52 --->
  53 Please ensure that the [requirements](#requirements) are satisfied and install ```vpnbypass``` and ```luci-app-vpnbypass``` from the Web UI or connect to your router via ssh and run the following commands:
  54
  55 ```sh
  56 opkg update
  57 opkg install vpnbypass luci-app-vpnbypass
  58 ```
  59
  60 If these packages are not found in the official feed/repo for your version of OpenWrt/LEDE Project, you will need to [add a custom repo to your router](https://github.com/stangri/openwrt_packages/blob/master/README.md#on-your-router) first.
  61
  62 ## Default Settings
  63
  64 The default configuration ships with the service disabled, use the Web UI to enable/start the service or run ```uci set vpnbypass.config.enabled=1; uci commit vpnbypass;```. It routes Plex Media Server traffic (port 32400) and LogmeIn Hamachi traffic (25.0.0.0/8) outside of the VPN tunnel. Internet traffic from local IPs `192.168.1.81-192.168.1.87` is also routed outside the VPN tunnel. You can safely delete these example rules if they do not apply to you.
  65
  66 ## Documentation / Discussion
  67
  68 Please head to [OpenWrt Forum](https://forum.openwrt.org/t/vpn-bypass-split-tunneling-service-luci-ui/1106) for discussions of this service.
  69
  70 ### Bypass Domains Format/Syntax
  71
  72 Domain lists should be in the following format/syntax: ```/domain1.com/domain2.com/vpnbypass```. Please do not forget the leading ```/``` and trailing ```/vpnbypass```. There is no validation if you enter something incorrectly -- it simply will not work. Please see [Notes/Known Issues](#notesknown-issues) if you wish to edit this setting manually, without using the Web UI.
  73
  74 ## What's New
  75
  76 1.3.0:
  77
  78 - No longer depends on hardcoded WAN interface name (```wan```) works with other interface names (like ```wwan```).
  79 - Table ID, IPSET name and FW_MARK as well as FW_MASK can be defined in config file.
  80 - Uses iptables, not ip rules for handling local IPs/ranges.
  81 - More reliable creation/destruction of VPNBYPASS iptables chain.
  82 - Updated Web UI enables, starts and stops the service.
  83
  84 ## Notes/Known Issues
  85
  86 1. Domains to be accessed outside of VPN tunnel are handled by dnsmasq and thus are not defined in ```/etc/config/vpnpass```, but rather in ```/etc/config/dhcp```. To add/delete/edit domains you can use VPN Bypass Web UI or you can edit ```/etc/config/dhcp``` manually or run the following commands:
  87
  88 ```sh
  89 uci add_list dhcp.@dnsmasq[-1].ipset='/github.com/plex.tv/google.com/vpnbypass'
  90 uci add_list dhcp.@dnsmasq[-1].ipset='/hulu.com/netflix.com/nhl.com/vpnbypass'
  91 uci commit dhcp
  92 /etc/init.d/dnsmasq restart
  93 ```
  94
  95 This feature requires ```dnsmasq-full``` to work. See the [Requirements](#requirements) section for more details.