ForestVPN
Sign inGet ForestVPN
Recipe

ForestVPN beside passwall2, podkop, pbr, mwan3

How ForestVPN shares an OpenWrt router with passwall2, podkop, pbr, mwan3, AdGuard Home and Tailscale, which numbers it uses, and how to move them.

Updated October 15, 2026

Not yet verified on hardware as a whole. We tried ForestVPN with mwan3, pbr and passwall2 installed, in a lab, for what a good neighbour must do. The combinations below that say so have not been tested end to end.

What you get

ForestVPN living on a router that already runs other network software, without editing your wan or lan, and a way to move its numbers if they collide with yours.

Before you start

  • Device: an OpenWrt router with ForestVPN installed and set up.
  • Know: ForestVPN adds one network interface, forestvpn, on the device fvpn0, and one firewall zone, forestvpn. It never edits your wan or lan. The zone exists while protection is on or another app routes. It rejects input, so nothing on the router answers from the tunnel side.
  • Time: ten minutes, if you need to move a number.
  • What can break: two programs using the same routing table or rule priority. Both then send packets by the other's rules.

Steps

  1. See which numbers ForestVPN uses. It has its own routing table and rule priorities, chosen away from mwan3, pbr and Tailscale.

    Prints the routing table and the first rule priority

    uci -q get forestvpn.main.table; uci -q get forestvpn.main.rule_prio

    An empty line means the default: routing table 241, rule priorities 1900 and 1901. Packet marks 0x10000000 and 0x20000000 are fixed. They sit outside the marks mwan3 (0x3f00) and pbr (0x00ff0000) use.

  2. If another program already uses one of these numbers, move ForestVPN. The table can be any number from 1 to 252. The first rule priority can be any number from 2 to 32000, and the next one follows it.

    Moves ForestVPN to table 242 and restarts it

    uci set forestvpn.main.table='242'
uci commit forestvpn
/etc/init.d/forestvpn restart

  3. Read the row for your other software.

    • mwan3: tried in the lab with ForestVPN installed: the rules sit in the order they were designed for. ForestVPN does not balance or fail over your internet connections; mwan3 still does that.
    • AdGuard Home: protected devices send their lookups through ForestVPN, so AdGuard Home does not filter them. The setup tells you so and offers the other choice (the setting forestvpn.main.dns set to router): lookups then go to the router, and your internet provider can see them. Devices that are not protected keep using AdGuard Home.
    • Tailscale: ForestVPN is not tested beside Tailscale. Tailscale drops traffic from 100.64.0.0/10 that does not arrive on its own interface, and ForestVPN uses addresses in that range inside its tunnel.
    • passwall2, podkop, pbr: see Let another app route below.

Let another app route (passwall2, podkop, pbr)

Let another app route is a button on the ForestVPN status page of the router. It turns ForestVPN's protection and its kill switch off, keeps the tunnel up on the device fvpn0, and hands the choice of sites to passwall2, podkop or pbr. ForestVPN chooses by device, not by site. To send chosen websites or addresses through ForestVPN, let passwall2, podkop or pbr decide.

  • ForestVPN stays connected on the interface fvpn0. It sets no routing rule, no kill switch and no lookup rule. The zone forestvpn stays, so pbr can send traffic to it. passwall2 or podkop own your lookups and decide what goes where.

  • While ForestVPN is stopped or restarting, passwall2 sends what it assigns to fvpn0 over your normal connection. ForestVPN cannot stop that in this mode.

  • While protection is on, ForestVPN's rule (priority 1901) sends what these tools leave direct into the tunnel, and its lookups go to the tunnel's resolver first, so their direct rules do not apply. Pause protection is not a substitute: a router reboot or a ForestVPN restart ends it, and the session is not renewed while paused.

  • Update ForestVPN first on its Updates page if it offers an update: an older version has no such button and ignores the routing setting. On the ForestVPN status page press Let another app route. Or over SSH:

    Lets another app route, without restarting ForestVPN

    uci set forestvpn.main.protect='0'
uci set forestvpn.main.routing='other'
uci commit forestvpn
reload_config

    Do not run /etc/init.d/forestvpn restart for this, and do not run Set up again afterwards: Set up turns protection back on.

passwall2: the fvpn0 node and the shunt rules

passwall2 was tested on OpenWrt 24.10.8 with passwall2 26.10.1 and Xray 26.10.10, and on a 23.01-based router. Press Let another app route first (see above), then:

  1. Install passwall2 and Xray from the passwall feed. OpenWrt's own Xray is too old for passwall2 26.10 (it needs 26.7.11 or newer).
  2. Node List > Add: Type Xray, Protocol Custom Interface, Interface: type fvpn0 exactly (an entry named forestvpn is the settings name, not the device).
  3. Rule Manage: for Russian sites use a rule with geoip:ru and geosite:category-ru. Give every rule the same group as the shunt node (for example RU). A rule with another group is skipped without a message, and everything then goes to the default node.
  4. Add a Shunt node in that group. For "local sites direct, the rest through ForestVPN": the Russia rule goes to Direct, Default goes to the fvpn0 node. For "only chosen sites through ForestVPN": that list goes to the fvpn0 node, Default goes to Direct.
  5. Basic Settings: Node is the shunt node; Direct DNS is a resolver of your country instead of 223.5.5.5 (for Russia 77.88.8.8); leave DNS redirect on; enable.

passwall2: turn Localhost Proxy off when everything hangs after updating ForestVPN

ForestVPN stays on Connecting after every restart, and devices lose everything except the sites passwall2 sends Direct (with the usual Russia rule, only Russian sites open), when passwall2's Localhost Proxy is on. With ForestVPN 0.3.13, a passwall2 installed before 14 October 2026 (or from its GitHub release) needs Localhost Proxy turned off in Basic Settings. With ForestVPN 0.3.12 or older (its status page offers Turn off protection instead of Let another app route), every passwall2 needs it. Then update ForestVPN on its Updates page when it offers an update.

podkop and pbr

  • podkop: connection type VPN, interface fvpn0. podkop cannot be installed beside passwall2 and needs OpenWrt 24.10 or newer. This combination has not been tested end to end.
  • pbr: install pbr and luci-app-pbr, open Services > Policy Based Routing, add a policy with the interface forestvpn, and fill in the domains or addresses. With Let another app route ForestVPN has no routing rules of its own, so pbr's policies apply to every device. This combination has not been tested end to end. Whether a pbr policy into ForestVPN carries traffic on your router is yours to check.

Check it worked

Protection on. The rule list shows ForestVPN's two priorities, and pbr's own stay where they were.

Lists the routing rules

ip rule show

Expect ForestVPN's rules at 1900 and 1901 (or the numbers you chose; 1901 is the one that sends a protected device into the tunnel), pbr's at 29999 and 30000, mwan3's at its own marks.

Another app routes. Print ForestVPN's state.

Prints ForestVPN's protection state

/usr/libexec/forestvpn/arm status

Expect protect=0, routing=other and protection=off. ip rule show has no 1900 or 1901 line. The status page says Ready for your routing app. On an older version there is no routing= line and the page says ForestVPN is installed: update ForestVPN on its Updates page, and do not press Set up, which turns protection back on. From a device on your network, a Russian site shows your own address and another site shows a ForestVPN address.

Undo it

Put the numbers back by removing the two settings, then restart.

Returns ForestVPN to its default numbers

uci -q delete forestvpn.main.table; uci -q delete forestvpn.main.rule_prio
uci commit forestvpn
/etc/init.d/forestvpn restart

If something is wrong

SymptomCauseFix
A pbr policy has no effect on one deviceForestVPN's rules come first (priority 1901) for every device it protectsLeave that device out of what ForestVPN protects.
A site in a pbr domain list does not go through ForestVPNA browser that uses its own secure DNS means pbr never sees the nameTurn that setting off in the browser. pbr uses dnsmasq-full for domain lists.
pbr is not in the package listOpenWrt 21.02 has no pbr package in its feedUse a newer OpenWrt, or choose devices instead of sites.
A passwall2 or podkop direct rule has no effect on a protected deviceForestVPN's rule (priority 1901) sends a protected device's direct traffic into the tunnelPress Let another app route (described under Steps) and point the tool at fvpn0.
Everything hangs after updating ForestVPN or pressing Let another app route; only Russian sites openpasswall2 sends ForestVPN's own connection into fvpn0 (ForestVPN 0.3.12 or older with any passwall2; 0.3.13 with a passwall2 installed before 14 October 2026)Turn off Localhost Proxy in passwall2, restart ForestVPN, then update ForestVPN on its Updates page.
Everything still goes through ForestVPN while passwall2 is onProtection is on, or the router runs an old ForestVPN packageCheck that /usr/libexec/forestvpn/arm status prints routing=other. Update ForestVPN on its Updates page, then press Let another app route. The status page also warns you when protection is on and passwall2 is running.
The update said it worked, then the old version is backThe new version did not connect within a minute, often because passwall2 holds back ForestVPN's own connection while it restarts, so the update was undoneSee updates and uninstall, step 8. On ForestVPN 0.3.13 and older, first run rm -f /etc/forestvpn/update_bad, because that version remembers the undone update and otherwise will not offer it again.
Every site still goes through ForestVPNProtection is on (Set up was run again), or the passwall2 rules are in another groupPress Let another app route. Give the rules the shunt node's group.
Stopping ForestVPN seems to fix itWith ForestVPN stopped, passwall2 sends fvpn0's traffic over your normal connectionKeep ForestVPN running and use the steps above.
Devices lose AdGuard Home filteringProtected devices use ForestVPN's lookupsChoose router for the dns setting, and accept that your provider sees lookups.

Limits

  • ForestVPN's kill switch does not cover traffic that pbr sends. pbr's own strict setting does that.
  • While ForestVPN is stopped or restarting, passwall2 sends what it assigns to fvpn0 over your normal connection. ForestVPN cannot stop that in this mode.
  • passwall2 does not handle IPv6 on your network by default, and neither does ForestVPN in this mode. Turn IPv6 on your network off, or turn on passwall2's IPv6 transparent proxy.
  • While protection is on, a ForestVPN reconnect resets the open connections of protected devices. With Let another app route it does not; a passwall2 restart still does.
  • passwall2 resolves the names it sends to fvpn0 through fvpn0. While the tunnel reconnects, those lookups wait.
  • pbr, Tailscale and other VPNs on the same router are not tested together with ForestVPN.
  • A browser that does its own secure DNS cannot be caught by the router.

Back to Help

English
Ask us anything