[SOLVED} Force sabnzbd traffic over WAN interface (and not VPN)

[Hopper]

Hi Guys,

I got a specific issue.

I have in the Netherlands a ISP that is based on the KPN network. If you are on that network you can use their own newsgroup server.

Since two weeks i have a subscription on hide.me VPN. In my OpenWRT VM on Proxmox i have configured hide.me VPN so all my traffic goes automatically over their Wireguard tunnel. The issue with the KPN network and their newsgroup server is, if the traffic does not go over an ipaddress that belongs to a range of KPN network, that i get an 500 denied message and the nzb will not be downloaded.

I have created a policy based routing specific for the port (563) that the traffic goes over, however Sabnzbd still sees the hide.me VPN ipaddress.

My question is, what other ports or ways do i still need to change so that Sabnzbd looks for its public ipaddress through my WAN interface instead of my hide.me VPN tunnel and thus my download starts?

[sander]

> I have created a policy based routing specific for the port (563) that the traffic goes over

How about creating a rule based on destination IP?

Waht is the output of

Code: Select all

host news.kpn.nl | grep has | awk '{ print "ip route get "  $NF }' | sh | grep via

Then:

In your PBR settings (likely vpn-policy-routing or pbr package):

Delete the port-based rule.

Create a new rule:

Interface: WAN

Destination Address: Enter the IP addresses you found in step 1.

Local Address: (Optional) Set this to the internal IP of your SABnzbd VM to be safe.


Reload / activate, and then again

Code: Select all

host news.kpn.nl | grep has | awk '{ print "ip route get "  $NF }' | sh | grep via

[safihre]

We have a setting for it:
Config > Specials > outgoing_nntp_ip

It's new in 4.5.5.

[Hopper]

@sander,

I am fairly new to pbr and just today i was tinkering with it..i have no words to say.... Like this is just awesome . I am slowly using more features through out the years that OpenWRT has to offer, but the insanity is real .

But this indeed solved the problem. Thanks!!

We have a setting for it:
Config > Specials > outgoing_nntp_ip

It's new in 4.5.5.

I looked at the version that i have its still 4.5.4. I use the jcfp/nobetas/ PPA, but that is still outdated. No deb packages of the recent version exists i guess on the repo.

Code: Select all

root@k-aqua:~# apt-cache madison sabnzbdplus 
sabnzbdplus | 4.5.4-0ubuntu1~jcfp1~24.04 | htt ps://ppa.launchpadcontent. net/jcfp/nobetas/ubuntu noble/main arm64 Packages
sabnzbdplus | 4.2.2+dfsg-3 | ht tp://ports.ubuntu. com/ubuntu-ports noble/multiverse arm64 Packages
root@k-aqua:~# cat /etc/os-release | head -1
PRETTY_NAME="Ubuntu 24.04.3 LTS"

[safihre]

It's also in 4.5.4. I just meant it's in the recent release.

[Hopper]

It's also in 4.5.4. I just meant it's in the recent release.

Sorry, i misunderstood you. I indeed can see the option. I looked at the documentation and i see that this does not really apply to my situation. In my case i only have 1 ipaddress and 1 interface on that device that runs sabnzbd. All traffic goes by default to my OpenWRT router VM and there i have configured the hide.me VPN tunnel instead on the device that runs sabnzbd.

This way not only does all my local traffic go over the hide.me VPN tunnel (including for example the tv) without me having to configure each device separately, but also when i am outside i can connect to my home network through my own Wireguard VPN tunnel that not only makes sure the internet traffic goes through Pihole for blocking ads, but also like other devices goes through the hide.me VPN tunnel to the internet. But thanks for mentioning it. Its good to know about this feature also.

Description NNTP in the documentation:

The specific local IP address (IPv4/IPv6) SABnzbd will use for its outgoing NNTP (Network News Transfer Protocol) connections. This is useful on systems with multiple network interfaces (like a VPN) to force traffic through a specific IP.

[safihre]

Ah yes. Indeed.

[Hopper]

Its very weird. I thought it worked, but now it doesn't.

PBR does not seem to send the traffic over the wan interface(which is pbr + openwrt issue that i have to figure out). If i do a traceroute you can see that it still send it over the hide.me VPN tunnel.

I did see self-test.sabnzbd.org. I am not sure what the self-test does. I assume this is to get the public ipaddress. @safihre, does sabnzbd do something else besides getting the public ipaddress?

[safihre]

Only public ip.

[Hopper]

Oke. Thanks.

Today i was also busy with it, but i just "gave" up trying to fix it.

The issue is that hide.me VPN forces just all my traffic over its VPN. I was trying to even fix the WAN port forwarding as i also host some things at home, but the traffic back was also being led over the hide.me VPN tunnel and thus the client (phone over 4G) was never getting any response when trying to visit a internal website.

So now i made a hotplug script to remove the routes that it is forcing it on OpenWRT for all my traffic. Now i use PBR to only sent specific traffic (torrents for now) over it. And thus Sabnzbd traffic just goes normally over the WAN interface.

So the PBR solution from Sander indeed did its job. Thanks both of you!!