EdgeOS and PIA - Isolate IOT and hide away the usual suspects

Routing tables

Routing tables are useful to set specific routes via specific targets. So what we need is ensure that we have to different routing tables: 1 for the default GW of my ISP so I can play games etc with least latency and another one pointing to the tunnel interface. Sadly, you cannot use eth0 as the next hop-interface for your default route.

protocols {
 static {
     table 1 {
         route 0.0.0.0/0 {
             next-hop 10.0.0.1 {
             }
         }
     }
     table 2 {
         interface-route 0.0.0.0/0 {
             next-hop-interface vtun0 {
               }
           }
       }
   }
}

Rule for internal traffic

First rule is pretty simple and simply indicates that all internal traffic should be internal.

set firewall modify PBR rule 10 description "Internal routing"
set firewall modify PBR rule 10 modify table main
set firewall modify PBR rule 10 action modify
set firewall modify PBR rule 10 source group network-group INTERNAL
set firewall modify PBR rule 10 destination group network-group INTERNAL

modify PBR {
  description "Main routing"
  enable-default-log
  rule 10 {
    action modify
    destination {
      group {
        network-group INTERNAL
      }
    }
    modify {
      table main
      }
    source {
      group {
        network-group INTERNAL
        }
      }
  }

Rule to route LAN-PC traffic via the ISP GW

set firewall modify PBR rule 20 description LAN-to-ISP
set firewall modify PBR rule 20 action modify
set firewall modify PBR rule 20 modify table 1
set firewall modify PBR rule 20 source group network-group LAN-PC

Rule to route LAN-IOT traffic via the VPN

set firewall modify PBR rule 21 description LAN-to-ISP
set firewall modify PBR rule 21 action modify
set firewall modify PBR rule 21 modify table 1
set firewall modify PBR rule 21 source group network-group LAN-IOT

Rule to route traffic from IoT to VPN

set firewall modify PBR rule 30 description IoT-to-VPN
set firewall modify PBR rule 30 action modify
set firewall modify PBR rule 30 modify table 2
set firewall modify PBR rule 30 source group network-group IOT

Alternatively, you could use the network address range of your VLAN. Here, assuming the VLAN 107 for IOT is on port eth1

set firewall modify PBR rule 30 source group address-group ADDRv4_eth1.107

Great. Our routes are in place but we have not defined any NATing as we still need to masquerade ourselves behind the router when getting out to the internet.

Setting up our NATs

nat {
  rule 5000 {
    description IOT-to-PIA
    log disable
    outbound-interface vtun0
      protocol all
      source {
        group {
          network-group IOT
          }
        }
    type masquerade
  }
  rule 5001 {
    description LAN-IOT-to-PIA
    log disable
    outbound-interface vtun0
      protocol all
      source {
        group {
          network-group LAN-IOT
          }
        }
    type masquerade
  }
  rule 5002 {
    description LAN-PC-to-ISP
    log disable
    outbound-interface eth0
      protocol all
      source {
        group {
          network-group LAN-PC
          }
        }
    type masquerade
  }

curl ifconfig.me

If you are connected to your IOT network, you should get the public IP address of your VPN. If you are connected to the LAN-PC network and within 192.168.0.0/25 then you should get your ISP address (of course, the public IP, not 10.0.0.1) and if you are in the 192.168.0.128/25 range, you should also get the VPN public IP address.

Specifically re-route DNS via tunnel

Well so very similarly as before, we are going to indicate to our router that we want the DNS traffic to be routed via our VPN. We don't need to do it for our IOT subnet, as all traffic goes through there anyway, but, we want to do that for all our hosts in the LAN (192.168.0.0/24) subnet.

set firewall modify PBR rule 11 description DNS-to-VPN
set firewall modify PBR rule 11 action modify
set firewall modify PBR rule 11 modify table 2
set firewall modify PBR rule 11 destination port 53
set firewall modify PBR rule 11 protocol udp
set firewall modify PBR rule 11 source group network-group LAN-ALL

Similarly to before, we need to get a NAT rule to get traffic through.

rule 5003 {
        description DNS-TO-PIA
        destination {
            address 0.0.0.0/0
            port 53
        }
        log disable
        outbound-interface vtun0
        protocol udp
        source {
            group {
                network-group LAN-ALL
            }
        }
        type masquerade
    }

How to check?

So how are we going to check that this works? I created a tiny EC2 instance on Amazon, setup bind with logging to file for all requests, and forward from there to CloudFlare etc.

Then from there you will be able to see what IP address the client used to make the DNS requests. If you see your ISP IP address, you forgot something along the lines to make sure that DNS requests are sent through.

Do the same with Pi-Hole.

Pi-Hole is awesome and most of readers using Ubiquit probably also use Pi-Hole somewhere. If you setup your Pi-Hole in a different LAN etc (as I did), all you'd need to do is either route all traffic of your Pi-Hole server via VPN or apply the same rules as above to route the DNS requests of your server LAN to your VPN.