Hope someone can help me, I have a LinkSys WRT1900 ACS v2 router on which i have installed LEDE. I have 2 vlans (,, I have also OpenVPN setup and my goal was to have traffic from 1 vlan (.10.1) routed through VPN and traffic from the other vlan (.5.1) not go though VPN.

I have this working in so many words, but for the non vpn vlan to connect to the internet, i have had to add the following as a start up script

ip route add default via table 10
ip rule add from table 10
ip rule add from table 10

The above works fine, one vlan goes via VPN and the other not through VPN, the only issue with this is that the moment i put the above code for each ip address and reboot my router for the changes to take affect, i can no longer ping between vlans, and i really would like to connect to devices locally on either vlan.

If i take out the table above, I dont get internet on non VPN VLAN, but can ping devices on both vlans locally.

if it helps, i have added some further info for you below.

OpenVPN Config File

dev tun
proto udp
remote *****OMITTED*****
resolv-retry infinite
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ping 15
ping-restart 0
reneg-sec 0

explicit-exit-notify 3

remote-cert-tls server

#mute 10000
auth-user-pass secret

verb 3
cipher AES-256-CBC
auth SHA512

key-direction 1
# 2048 bit OpenVPN static key
-----BEGIN OpenVPN Static key V1-----

Router IP Routing Table

root@LEDE:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default       UG    0      0        0 tun0
default         UG    0      0        0 eth1.2        *          U     0      0        0 tun0 UGH   0      0        0 eth1.2       UG    0      0        0 tun0     *        U     0      0        0 eth1.2     *      UH    0      0        0 eth1.2     *        U     0      0        0 br-VLAN5    *        U     0      0        0 br-VLAN10

Any help would really be appreciated, and please take it easy on me as i am rather new to all this.

Many thanks


The problem is about routing, not about using a VPN or VLANs (but the integration with the VPN can certainly add difficulty).

  • About the main issue: communication between LANs

The table 10 is in use for IPs from, so when such an IP gets the default route, this route will be used for any destination, including other LANs' IPs even if that's not intended. So it has to be populated manually with the routes to the other LANs, which, contrary to the main table, aren't added automatically.


# ip route get from iif br-VLAN5 from via dev eth1.2 table 10 
    cache  iif br-VLAN5


# ip route add dev br-VLAN10 table 10


# ip route get from iif br-VLAN5 from dev br-VLAN10 table 10 
    cache  iif br-VLAN5
  • For the first minor issue: having to add an ip rule for every single IP used from VLAN5

Normally there's no reason to use one rule per single IP from VLAN5 and this should be enough:

ip rule add from table 10

But because OP made a comment telling it doesn't work when is included, I can only say perhaps something else is interfering (other network configurations not shown, including iptables). There's still simplification possible (command netmask gives "only":

  • will do, i wanted to reply fully but as i hit enter it posted the comment. – Ess Tukay Dec 4 '17 at 12:40
  • The reason why I don’t have because as I use this, again I get no internet on this VLAN, I assumed this was because it included the, so I then simply added entire DHCP ranger one ip at time and it worked. – Ess Tukay Dec 4 '17 at 15:18
  • As for your suggestion of, (ip route add dev br-VLAN10 table 10) Thank you incredibly for this, adding this entry allows me to access/ping devices on VLAN 10 ( from VLAN 5 ( I cannot ping back from VLAN 10 to VLAN 5 but I am really not bothered about that as I don’t have much need for pinging/access from VLAN10 to VLAN5. – Ess Tukay Dec 4 '17 at 15:19
  • All the and have been added automatically by the VPN, I have not added these manually myself. – Ess Tukay Dec 4 '17 at 15:19
  • I did try once to have the rules for the VPN as you suggested but in my testing all that did was switch the problems over to VPN accessing the internet and that combined with the VPN settings made things further more complicated, hence I settled for this way. – Ess Tukay Dec 4 '17 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.