#

# First it is necessary to disable Reverse Path Filtering on all

# current and future network interfaces:

#

for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do

  echo 0 > $i

done

#

# Delete and table 100 and flush any existing rules if they exist.

#

ip route flush table 100

ip route del default table 100

ip rule del fwmark 1 table 100

ip route flush cache

iptables -t mangle -F PREROUTING

#

# Copy all non-default and non-VPN related routes from the main table into table 100.

# Then configure table 100 to route all traffic out the WAN gateway and assign it mark "1"

#

# NOTE: Here I assume the OpenVPN tunnel is named "tap11".

#

#

ip route show table main | grep -Ev ^default | grep -Ev tap11 \

  | while read ROUTE ; do

      ip route add table 100 $ROUTE

done

ip route add default table 100 via $(nvram get wan_gateway)

ip rule add fwmark 1 table 100

ip route flush cache

# By default all traffic GOES THRU the VPN

iptables -t mangle -A PREROUTING -i br0 -j MARK --set-mark 0

iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.1.20 -j MARK --set-mark 1

iptables -t nat -I POSTROUTING -o tap11 --src 192.168.1.254/24 -j MASQUERADE