Question Application Control Router

[Burner27]

I was wondering if someone had any knowledge regarding application control using your router. Here is the scenario:

I have two WAN connections. I’d like to have certain applications go out through one WAN, and other applications go out through the other WAN. Is this even possible?

thank you!

 

[mxnerd]

I guess not. Unless the application itself supports proxy and one of your router supports proxy.

@Tech Junky just posted a split tunnel example for Amazon video streaming, but it's the same router.

VPN + Amazon Prime - add some routes

So, I finally got the urge to dig into how to setup my DIY router / VPN to split tunnel off crap like Prime to make it work through the streamer box and all devices to avoid the infamous.... Anyway... I got it working on the streamer by adding some routes after messing around with trying to...

forums.anandtech.com

He should have a better answer than me.

 

[mxnerd]

Well. I just remembered that you can use free ForcebindIP program that I used before many many years back (XP era I guess)!

ForceBindIP | r1ch.net

Freeware Windows utility to force an application to bind to a specific network interface or IP address

r1ch.net

Like the video said, you will need two network adapters, of course.

 

[mxnerd]

Someone wrote a GUI for ForceBindIP if you are interested. You have to install AutoIt v3 and compile the code yourself though.

GitHub - ixjb94/ForceBindIP-Gui: A GUI For ForceBindIP

A GUI For ForceBindIP. Contribute to ixjb94/ForceBindIP-Gui development by creating an account on GitHub.

github.com

 

[Tech Junky]

I guess not. Unless the application itself supports proxy and one of your router supports proxy.

@Tech Junky just posted a split tunnel example for Amazon video streaming, but it's the same router.

VPN + Amazon Prime - add some routes

So, I finally got the urge to dig into how to setup my DIY router / VPN to split tunnel off crap like Prime to make it work through the streamer box and all devices to avoid the infamous.... Anyway... I got it working on the streamer by adding some routes after messing around with trying to...

forums.anandtech.com

He should have a better answer than me.

Well, my case is being bypassing the VPN routing for specific sites not really app specific as it's at layer three routing I'm trying to influence. For apps you need something higher up the OSI layer to mark the traffic based on app being used. More of a DPI QOS marking.

If you do some pcap sessions you can collect the app data for marking them. But how they route out is more complex than a consumer device would be capable of in most cases

This is something a hw fw would be capable of though. I could probably do it in Linux with some iptables rules and ipset groups but it's easier with a fw that has macros to set the rules.

 

[Burner27]

I dont see why a router couldnt do this. Couldnt you just use 'route rules' to accomplish this?

 

[Tech Junky]

I dont see why a router couldnt do this. Couldnt you just use 'route rules' to accomplish this?

A router doesn't do DPI. Without knowing and tagging the app layer it's pointless. Routers move packets and don't look at what's in them. Firewalls look at everything in the OSI stack and you make rules based on the behavior. Some consumer routers have apps that can do this but, they don't have the CPU power to do it efficiently and will slow down the wan speed inn the process.

 

[mxnerd]

Router is not smart as you think, for consumer grade router it just forward the data packets from LAN side to the WAN side. it has no idea about the applications.

When a Windows application request a DNS name let's say Apple.com,
the application actually requests the built-in MS DNS client (comes with Windows) in the background to make a query about apple.com. App sends data --> network adapter --> router. Apps don't talk to router directly. If the app does not request a FQDN (full qualified domain name, like www.apple.com or www.facebook.com), the traffic stay in your LAN.

When you have more than one network adapters (including wifi), Windows will make a network card priority list and will only use the highest one and ignore all others, unless it has built-in proxy settings (or Winsock) you can set like I mentioned earlier (Chrome/Edge/Firefox for example)

The Automatic Metric feature for IPv4 routes - Windows Server

Introduces the Automatic Metric feature in Windows for IPv4 routes.

docs.microsoft.com

Windows also does not allow you to set default gateway on more than one network. So if the app is requesting a FQDN on the internet, it will only send data through the adapter with a default gateway that has been set.

Multiple default gateways cause connectivity problems - Windows Server

Describes the connectivity issues that occur when multiple default gateways are used in TCP/IP configuration options.

docs.microsoft.com

Exactly what application you are using that needs to use another adapter/router/WAN ?
And have you tried ForceBindIP utility that I also mentioned earlier?

==

Need to leave. Won't be able to add more until later in the day.

 

[Tech Junky]

Well, that's sort of right.

I run dual NICs when I'm working on my server and set the gateway on both on to the server and one to the internet at the same time.

Apps can specify using an IP instead of fqdn sometimes. You can so regex some of the network stuff to bypass using MSFT for connectivity checks. Fqdn works better with destinations that have a large cidr assigned like Amazon which is why I put routes in for /14's to cover all of the scope instead of having to add multiple /24 or /32 IPs.

Typically though the adapter chose is based on the metric which is bandwidth related. More bandwidth means more priority for the path of the packets. You can also set the priority in gpedit to prefer the wired connection if you use a docking station. This would be mostly in a business setting though.

 

[JackMDS]

Or get a Macbook Pro 2011/12 (they go on eBay for $100 -150) Install Win 10 in BootCamp, load to it the App/programs that you want to be Special App/programs to one of the WANs.

The MacBook Pro 2011/2012 are i5 computers that can use up to 8GB DDR3. They are and slick to use with any thing (including Media Streaming) Only No Good is for heavy gaming. Their Wireless cards are 300/300 Mbs.capable.

BTW - Being a Computer Enthusiasts does not mean throughout away big money buying Pro hardware.

 

[Burner27]

A router doesn't do DPI. Without knowing and tagging the app layer it's pointless. Routers move packets and don't look at what's in them. Firewalls look at everything in the OSI stack and you make rules based on the behavior. Some consumer routers have apps that can do this but, they don't have the CPU power to do it efficiently and will slow down the wan speed inn the process.

"router' is a generic term I shouldnt have used. I meant a UTM like Untangle or Sonicwall for example.

 

[Tech Junky]

Now you're talking an in between device with a UTM. Not quite a router or firewall. UTMs though have the capability you're looking for. To get where you was t to go with it though it's better to use it as the gateway and put the router behind it. This will give you the choke point to classify and direct traffic. The issue then becomes if it has a mulitport nic to split the output to both connections.

 

[Tech Junky]

Dual Wan configuration - Management, Networking, Logging and Reporting - UTM Firewall - Sophos Community

Hi all, I'm new user of Utm 9 Home edition and I've a problem with dual Wan configuration. I installed Sophos Utm (9.505-4) on a Qotom Q355G4 with Intel I5 5250U

community.sophos.com

Product Documentation

Welcome to the Seqrite products digital document library. Here, you can explore our product documentation available in English and multiple other languages. Simply select your product and choose your preferred language from the drop-down menu. We utilize translation plugins to convert our...

techsupport.seqrite.com

These aren't specific to your device but, the idea is similar. There's also quite a few search hits for SDWAN. I've only played with a handful of UTM's as my focus is routing and switching. Of course though being on a small team managing the whole network you get your hands dirty with everything in the network when it comes to fixing or doing maintenance on them. Every vendor is slightly different but, the foundations are the same.

 

[mxnerd]

OK, apparently I misunderstood what OP has and his setup.

Regarding FQDN, I should have said public IP range FQDN or just public IP.

Anyway, if OP has only one adapter and has a dual WAN firewall/UTM then OP should be able to set firewall/routing rules in the firewall/UTM according the IP destination.

Use NirSoft cports to find what IP address the app will reach and configure the rules so the traffic will flow through the WAN port OP wants. Once it's setup, it applies to all apps, not just one specific app. But since probably only that app use that remote IP (range), the purpose will be served.

CurrPorts: Monitoring TCP/IP network connections on Windows

CurrPorts displays the list of all currently opened TCP/IP and UDP ports on your local computer.

www.nirsoft.net

 

[Tech Junky]

@mxnerd

You didn't. It's just getting more info as we go.

The apps tend to go with the highest bandwidth so, if they're using 80/443 all web traffic would get directed down the same wan as well. I sense there's some work apps or something else that's priority to be sent down a specific path and isolated from general traffic. One of the links might be metered.

 

[mxnerd]

@Tech Junky were wright, according to ForceIPBind author, at least the DNS query will still go through first WAN.

"All host name lookups (DNS requests) will be resolved through the default gateway as these requests originate from the Microsoft DNS Client, not the program"
==
"if they're using 80/443 all web traffic would get directed down the same wan as well", why? Even if firewall rules applied?

 

[Tech Junky]

Because your binding on the port rather than the app level.

 

[Fallen Kell]

Use NirSoft cports to find what IP address the app will reach and configure the rules so the traffic will flow through the WAN port OP wants. Once it's setup, it applies to all apps, not just one specific app. But since probably only that app use that remote IP (range), the purpose will be served.

Unless the APP in question uses something like Amazon AWS/cloud hosting or MS Azure, or any of a number of other cloud service providers in which case there will be hundreds if not thousands of other things using those same IP ranges.