Custom rule for vpn connection

[hhai93]

How to exclude some websites from vpn connection? (Ex: netflix)

[shvchk]

Sorry, I somehow missed this question.

You need to know IP address(es) or range(s) to exclude. You can find it using nslookup or on website help / support section. Then you edit /etc/storage/post_iptables_script.sh either via SSH or in your router UI: Customization → Scripts → Run After Firewall Rules Restarted. You add a tiny utility function:

direct() {
  ip rule del to $1
  ip rule add to $1 lookup main pref 30
}

and can then add exclusions for IP: direct 123.45.67.89; or range (in CIDR notation): direct 98.76.54.32/24

Save changes with mtd_storage.sh save in case you used SSH.

For large services like Netflix finding IP ranges might be non trivial, since they can use lots of addresses from lots of different networks. In case if finding out IP ranges is too hard, you might just assign static IP address(es) to domain(s) you need via /etc/storage/dnsmasq/dnsmasq.conf and only exclude these address(es).