config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	option ra_slaac '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'wlan2'
	option interface 'wlan2'
	option start '100'
	option limit '150'
	option leasetime '12h'

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'
	option flow_offloading_hw '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option name 'vpnfirewall'
	option input 'REJECT'
	list network 'purevpntun'

config forwarding
	option src 'lan'
	option dest 'iptv'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/pbr.firewall.include'

config forwarding
	option src 'lan'
	option dest 'vpnfirewall'

config zone
	option name 'wlan2'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'wlan2'
	option input 'REJECT'

config forwarding
	option src 'wlan2'
	option dest 'vpnfirewall'

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd75:edc5:a87f::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	option igmp_snooping '1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device
	option name 'wan'
	option macaddr 'XX'

config interface 'wan'
	option device 'wan'
	option proto 'pppoe'
	option username 'XXX@fiber'
	option password 'XXX'
	option ipv6 'auto'
	option peerdns '0'
	list dns '8.8.8.8'
	list dns '8.8.4.4'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config device
	option type '8021q'
	option ifname 'wan'
	option vid '103'
	option name 'wan.103'
	option macaddr 'XX'
	option ipv6 '0'

config interface 'iptv'
	option proto 'dhcp'
	option device 'wan.103'
	option defaultroute '0'
	option peerdns '0'

config route
	option interface 'iptv'
	option target '172.31.128.0/19'
	option gateway '100.111.104.1'

config route
	option interface 'iptv'
	option target '10.31.0.0/16'
	option gateway '100.111.104.1'

config route
	option interface 'iptv'
	option target '10.63.0.0/20'
	option gateway '100.111.104.1'

config route
	option interface 'iptv'
	option target '85.153.240.0/20'
	option gateway '100.111.104.1'

config route
	option interface 'iptv'
	option target '176.43.0.0/24'
	option gateway '100.111.104.1'

config route
	option interface 'iptv'
	option target '176.235.0.0/20'
	option gateway '100.111.104.1'

config interface 'purevpntun'
	option proto 'none'
	option device 'tun0'

config interface 'wlan2'
	option proto 'static'
	option ipaddr '192.168.31.1'
	option netmask '255.255.255.0'
	list dns '192.168.31.1'

config pbr 'config'
	option verbosity '2'
	option strict_enforcement '1'
	option resolver_set 'none'
	option ipv6_enabled '0'
	list supported_interface 'purevpntun'
	list ignored_interface 'vpnserver'
	list ignored_interface 'wgserver'
	option boot_timeout '30'
	option rule_create_option 'add'
	option procd_reload_delay '1'
	option webui_show_ignore_target '0'
	list webui_supported_protocol 'all'
	list webui_supported_protocol 'tcp'
	list webui_supported_protocol 'udp'
	list webui_supported_protocol 'tcp udp'
	list webui_supported_protocol 'icmp'
	option enabled '1'

config include
	option path '/usr/share/pbr/pbr.user.aws'
	option enabled '0'

config include
	option path '/usr/share/pbr/pbr.user.netflix'
	option enabled '0'

config policy
	option name 'Plex/Emby Local Server'
	option interface 'wan'
	option src_port '8096 8920 32400'
	option enabled '0'

config policy
	option name 'Plex/Emby Remote Servers'
	option interface 'wan'
	option dest_addr 'plex.tv my.plexapp.com emby.media app.emby.media tv.emby.media'
	option enabled '0'

config policy
	option name 'WireGuard Server'
	option interface 'wan'
	option src_port '51820'
	option chain 'output'
	option proto 'udp'
	option enabled '0'

config openvpn 'purevpntun'
	option enabled '1'
	option client '1'
	option dev_type 'tun'
	option dev 'tun0'

config policy 'lan_vpn'
	option src_addr '192.168.31.0/24'
	option dest_addr '!192.168.31.0/24'
	option interface 'VPN'

============================================================
pbr - environment
pbr 1.0.0-2 running on OpenWrt 22.03.2. WAN (IPv4): wan/pppoe-wan/176.233.215.1.
============================================================
Dnsmasq version 2.86  Copyright (c) 2000-2021 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile
============================================================
pbr chains - policies
        chain pbr_forward {
        }
        chain pbr_input {
        }
        chain pbr_output {
        }
        chain pbr_prerouting {
        }
        chain pbr_postrouting {
        }
============================================================
pbr chains - marking
        chain pbr_mark_0x010000 {
                counter packets 0 bytes 0 meta mark set meta mark & 0xff01ffff | 0x00010000
                return
        }
        chain pbr_mark_0x020000 {
                counter packets 0 bytes 0 meta mark set meta mark & 0xff02ffff | 0x00020000
                return
        }
============================================================
pbr nft sets
============================================================
IPv4 table 256 route: default via 176.233.215.1 dev pppoe-wan
IPv4 table 256 rule(s):
30000:  from all fwmark 0x10000/0xff0000 lookup pbr_wan
IPv4 table 257 route: unreachable default
IPv4 table 257 rule(s):
30001:  from all fwmark 0x20000/0xff0000 lookup pbr_purevpntun

Activating traffic killswitch [✓]
Setting up routing for 'wan/pppoe-wan/176.233.215.1' [✓]
Setting up routing for 'purevpntun/0.0.0.0' [✓]
pbr.lan_vpn.name is unset and defaults to string Untitled
pbr.lan_vpn.enabled is unset and defaults to bool 1
pbr.lan_vpn.interface=VPN validates as or(uci("network", "@interface"),"ignore") with false
pbr.lan_vpn.proto is unset and defaults to or(string) (null)
pbr.lan_vpn.chain is unset and defaults to or("", "forward", "input", "output", "prerouting", "postrouting", "FORWARD", "INPUT", "OUTPUT", "PREROUTING", "POSTROUTING") prerouting
pbr.lan_vpn.src_addr=192.168.31.0/24 validates as list(neg(or(host,network,macaddr,string))) with true
pbr.lan_vpn.src_port is unset and defaults to list(neg(or(portrange,string))) (null)
pbr.lan_vpn.dest_addr=!192.168.31.0/24 validates as list(neg(or(host,network,string))) with true
pbr.lan_vpn.dest_port is unset and defaults to list(neg(or(portrange,string))) (null)
Routing 'Untitled' via  [✗]
Deactivating traffic killswitch [✓]
pbr 1.0.0-2 monitoring interfaces: wan purevpntun
pbr 1.0.0-2 (nft) started with gateways:
wan/pppoe-wan/176.233.215.1 [✓]
purevpntun/0.0.0.0
ERROR: Policy 'Untitled' has no assigned interface!

opkg update
opkg install vpn-policy-routing
uci set vpn-policy-routing.config.enabled="1"
uci -q delete vpn-policy-routing.config.dest_ipset
uci -q delete vpn-policy-routing.lan_vpn
uci set vpn-policy-routing.lan_vpn="policy"
uci set vpn-policy-routing.lan_vpn.src_addr="192.168.1.0/24"
uci set vpn-policy-routing.lan_vpn.dest_addr="!192.168.1.0/24"
uci set vpn-policy-routing.lan_vpn.interface="VPN"
uci commit vpn-policy-routing
/etc/init.d/vpn-policy-routing restart