OpenWRT双WAN网分网段NAT

环境：
设备WRT1200AC
使用WAN口连接PPPoE走电信出口
然后使用VLAN划出LAN1口做WAN2口连接PPPoE走移动出口
LAN网段为172.20.20.192/26 GW254
为了能正常的使用miniupnp进行端口映射
所以采用打标+策略路由方式进行策略路由

规划内容如下
1.默认走电信出口 DHCP下发网段172.20.20.220-172.20.20.250
2.手动DHCP分配172.20.20.195-172.20.20.219 走移动出口
3.劫持移动出口UDP解析转发至移动服务器

操作如下
1.添加两个PPPoE接口去掉WAN2的默认路由以及默认DNS开关

>vi /etc/config/network
config interface 'wan'
        option ifname 'eth1.2'
        option proto 'pppoe'
        option username 'ct_user'
        option password 'ct_pass'
        option ipv6 'auto'
        option keepalive '0'
config interface 'wan2'
        option proto 'pppoe'
        option ifname 'eth0.3'
        option username 'cm_user'
        option password 'cm_pass'
        option defaultroute '0'
        option keepalive '0'
        option peerdns '0'
        option delegate '0'
        option ipv6 '0'

设置DNS的下发范围

>vi /etc/config/dhcp
config dhcp 'lan'
        option interface 'lan'
        option leasetime '12h'
        option force '1'
        option ra 'server'
        option dhcpv6 'server'
        option ra_management '1'
        option start '220'
        option limit '30'

重启network服务之后默认电信出口即可使用
2.使用opkg安装ipset套件
然后建立脚本如下

>vi /root/cmcc.sh
#!/bin/sh
#預留網段
ipset -! -R <<-EOF || return 1
	create LOCAL_RULES hash:net hashsize 64 maxelem 25
	add LOCAL_RULES 0.0.0.0/8
	add LOCAL_RULES 10.0.0.0/8
	add LOCAL_RULES 100.64.0.0/10
	add LOCAL_RULES 127.0.0.0/8
	add LOCAL_RULES 169.254.0.0/16
	add LOCAL_RULES 172.16.0.0/12
	add LOCAL_RULES 192.0.0.0/24
	add LOCAL_RULES 192.0.2.0/24
	add LOCAL_RULES 192.31.196.0/24
	add LOCAL_RULES 192.52.193.0/24
	add LOCAL_RULES 192.88.99.0/24
	add LOCAL_RULES 192.168.0.0/16
	add LOCAL_RULES 192.175.48.0/24
	add LOCAL_RULES 198.18.0.0/15
	add LOCAL_RULES 198.51.100.0/24
	add LOCAL_RULES 203.0.113.0/24
	add LOCAL_RULES 224.0.0.0/4
	add LOCAL_RULES 240.0.0.0/4
	add LOCAL_RULES 255.255.255.255
EOF
#CMCC出口本地網段
ipset -! -R <<-EOF || return 1
	create CMCC_RULES hash:net hashsize 64 maxelem 30
	add CMCC_RULES 172.20.20.195
	add CMCC_RULES 172.20.20.196
	add CMCC_RULES 172.20.20.197
	add CMCC_RULES 172.20.20.198
	add CMCC_RULES 172.20.20.199
	add CMCC_RULES 172.20.20.200
	add CMCC_RULES 172.20.20.201
	add CMCC_RULES 172.20.20.202
	add CMCC_RULES 172.20.20.203
	add CMCC_RULES 172.20.20.204
	add CMCC_RULES 172.20.20.205
	add CMCC_RULES 172.20.20.206
	add CMCC_RULES 172.20.20.207
	add CMCC_RULES 172.20.20.208
	add CMCC_RULES 172.20.20.209
	add CMCC_RULES 172.20.20.210
	add CMCC_RULES 172.20.20.211
	add CMCC_RULES 172.20.20.212
	add CMCC_RULES 172.20.20.213
	add CMCC_RULES 172.20.20.214
	add CMCC_RULES 172.20.20.215
	add CMCC_RULES 172.20.20.216
	add CMCC_RULES 172.20.20.217
	add CMCC_RULES 172.20.20.218
	add CMCC_RULES 172.20.20.219
EOF
#DNS劫持
iptables -t nat -N CMCC
iptables -t nat -A CMCC -p udp --dport 53 -j DNAT --to-destination 211.140.13.188
iptables -t nat -I PREROUTING -m set --match-set CMCC_RULES src -j CMCC
#數據包打標
iptables -t mangle -N CMCC
iptables -t mangle -A CMCC -m set --match-set LOCAL_RULES dst -j RETURN
iptables -t mangle -A CMCC -j MARK --set-mark 210
iptables -t mangle -I PREROUTING -m set --match-set CMCC_RULES src -j CMCC
exit 0

给予脚本可以执行权限

>chmod +x /root/cmcc.sh

然后添加到开机自动启动项

>vi /etc/rc.local
#!/bin/sh -e
# Put your custom commands here that should be executed once
# the system init finished. By default this file does nothing.
/root/cmcc.sh
exit 0

3.给移动的DNS添加静态路由

>vi /etc/config/network 
config route
        option interface 'wan2'
        option target '211.140.13.188'
        option netmask '255.255.255.255'

4.给PPPoE接口添加自动策略路由

>vi /etc/ppp/ip-up.d/cmcc
#!/bin/sh
ip route flush table 210
ip route add default dev pppoe-wan2 table 210
ip rule add fwmark 210 table 210
exit 0

添加可执行权限完成

>chmod +x /etc/ppp/ip-up.d/cmcc

5.手动设置设备IP为 172.20.20.210/172.20.20.220
测试出口IP分别为移动/电信
DNS解析正常结束