root@ASUS-Tomato:/tmp/home/root# route -n

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun11

10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun11

89.72.112.1     0.0.0.0         255.255.255.255 UH    0      0        0 vlan2

10.0.100.0      0.0.0.0         255.255.255.128 U     0      0        0 br0

89.72.112.0     0.0.0.0         255.255.252.0   U     0      0        0 vlan2

127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo

0.0.0.0         89.72.112.1     0.0.0.0         UG    0      0        0 vlan2

for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do

  echo 0 > $i

done

ip route flush table 100

ip route del default table 100

ip rule del fwmark 1 table 100

ip route flush cache

iptables -t mangle -F PREROUTING

iface_lst=`route | awk ' {print $8}'`

for tun_if in $iface_lst; do

    if [ $tun_if == "tun11" ] || [ $tun_if == "tun12" ] || [ $tun_if == "ppp0" ] then

    break

  fi

done

ppoe_gateway=`ifconfig ppp0 | awk '/P-t-P/ {split ($3,A,":"); print A[2]}'`

ip route show table main | grep -Ev ^default | grep -Ev $tun_if \

  | while read ROUTE ; do

      ip route add table 100 $ROUTE

done



ip route add default table 100 via $ppoe_gateway

ip rule add fwmark 1 table 100

ip route flush cache



iptables -t mangle -A PREROUTING -i br0 -j MARK --set-mark 1

iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.1.14 -j MARK --set-mark 0

# EXAMPLES:

#

#  All LAN traffic will bypass the VPN (Useful to put this rule first, so all traffic bypasses the VPN and you can configure exceptions afterwards)

#    iptables -t mangle -A PREROUTING -i br0 -j MARK --set-mark 1

#  Ports 80 and 443 will bypass the VPN

#    iptables -t mangle -A PREROUTING -i br0 -p tcp -m multiport --dport 80,443 -j MARK --set-mark 1

#  All traffic from a particular computer on the LAN will use the VPN

#    iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.1.2 -j MARK --set-mark 0

#  All traffic to a specific Internet IP address will use the VPN

#    iptables -t mangle -A PREROUTING -i br0 -m iprange --dst-range 216.146.38.70 -j MARK --set-mark 0

#  All UDP and ICMP traffic will bypass the VPN

#    iptables -t mangle -A PREROUTING -i br0 -p udp -j MARK --set-mark 1

#    iptables -t mangle -A PREROUTING -i br0 -p icmp -j MARK --set-mark 1

#  All traffic to a specific Internet IP address will use the VPN

#    iptables -t mangle -A PREROUTING -i br0 -m iprange --dst-range 216.146.38.70 -j MARK --set-mark 0

port 1194

proto udp

dev tun

ca ca.crt

cert server.crt

key server.key

dh dh2048.pem

server 10.8.0.0 255.255.255.0

client-config-dir ccd

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 208.67.222.222"

push "dhcp-option DNS 208.67.220.220"

keepalive 10 120

tls-auth ta.key 0

cipher AES-256-CBC

comp-lzo

user nobody

group nogroup

persist-key

persist-tun

status openvpn-status.log

log openvpn.log

verb 4

mute 20

chroot /etc/openvpn/jail

client

dev tun

proto udp

remote my.ip 1194

resolv-retry infinite

nobind

persist-key

persist-tun

mute-replay-warnings

ca ca.crt

cert koper.crt

key koper.key

tls-auth ta.key 1

cipher AES-256-CBC

comp-lzo

verb 4

mute 20