Hi all,
I have the Asus RT-AC66U with MerlinWRT 380.64_2 running. In it I have the 'famous' country IP block script running.
Now, When running this script all seems fine. It takes about 5 minutes for it to finish.
The log shows me these sorts of info:
Jan 15 18:28:51 kernel: net/ipv4/netfilter/ip_set_nethash.c: nethash_retry: rehashing of set BlockedCountries triggered: hashsize grows from 448398 to 672597
I gues that's ok?
Because when testing if I can access my NAS from one of those countries (using http://www.webpagetest.org/ ) I see that the router is actually allowing access to my NAS! WHUT? That's not what I want!!
2017-01-15 18:02:07 Alert 192.168.0.1 user kernel ACCEPT <4>ACCEPT IN=eth0 OUT=br0 <1>SRC=122.248.198.232 DST=192.168.0.197
Now I've seen a posting here about ARM CPU's not understanding the IPT_Set. Hoewever changing it to XT_SET gives an error back. So IPT_SET seems to work fine.
Now...Why isn't my router blocking those countries? In the \JFFS\IP_lists\ folder I see the files for all those countries.
"...It seems this is not blocking the so-called FORWARD CHAIN..." someone told me. Is this the reason? If So, how do I fix that?
I have the Asus RT-AC66U with MerlinWRT 380.64_2 running. In it I have the 'famous' country IP block script running.
Code:
#!/bin/sh
# Loading ipset modules
lsmod | grep "ipt_set" > /dev/null 2>&1 || \
for module in ip_set ip_set_nethash ip_set_iphash ipt_set
do
insmod $module
done
# Preparing folder to cache downloaded files
IPSET_LISTS_DIR=/jffs/ipset_lists
[ -d "$IPSET_LISTS_DIR" ] || mkdir -p $IPSET_LISTS_DIR
# Different routers got different iptables syntax
case $(uname -m) in
armv7l)
MATCH_SET='--match-set'
;;
mips)
MATCH_SET='--set'
;;
esac
# Block traffic from Tor nodes
if [ "$(ipset --swap TorNodes TorNodes 2>&1 | grep 'Unknown set')" != "" ]
then
ipset -N TorNodes iphash
[ -e $IPSET_LISTS_DIR/tor.lst ] || wget -q -O $IPSET_LISTS_DIR/tor.lst http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv
for IP in $(cat $IPSET_LISTS_DIR/tor.lst)
do
ipset -A TorNodes $IP
done
fi
[ -z "$(iptables-save | grep TorNodes)" ] && iptables -I INPUT -m set $MATCH_SET TorNodes src -j DROP
# Block incoming traffic from some countries. cn pk sa is for China Pakistan Saudi Arabia See other countries code at http://www.ipdeny.com/ipblocks/
if [ "$(ipset --swap BlockedCountries BlockedCountries 2>&1 | grep 'Unknown set')" != "" ]
then
ipset -N BlockedCountries nethash
for country in pk cn ph sa kr af ru ua ro th tr us br it hu mx co pl hk kp kz my ng sg vn ar fr
do
[ -e $IPSET_LISTS_DIR/$country.lst ] || wget -q -O $IPSET_LISTS_DIR/$country.lst http://www.ipdeny.com/ipblocks/data/countries/$country.zone
for IP in $(cat $IPSET_LISTS_DIR/$country.lst)
do
ipset -A BlockedCountries $IP
done
done
fi
[ -z "$(iptables-save | grep BlockedCountries)" ] && iptables -I INPUT -m set $MATCH_SET BlockedCountries src -j DROP
# Block Microsoft telemetry spying servers
if [ "$(ipset --swap MicrosoftSpyServers MicrosoftSpyServers 2>&1 | grep 'Unknown set')" != "" ]
then
ipset -N MicrosoftSpyServers iphash
for IP in 23.99.10.11 63.85.36.35 63.85.36.50 64.4.6.100 64.4.54.22 64.4.54.32 64.4.54.254 \
65.52.100.7 65.52.100.9 65.52.100.11 65.52.100.91 65.52.100.92 65.52.100.93 65.52.100.94 \
65.55.29.238 65.55.39.10 65.55.44.108 65.55.163.222 65.55.252.43 65.55.252.63 65.55.252.71 \
65.55.252.92 65.55.252.93 66.119.144.157 93.184.215.200 104.76.146.123 111.221.29.177 \
131.107.113.238 131.253.40.37 134.170.52.151 134.170.58.190 134.170.115.60 134.170.115.62 \
134.170.188.248 157.55.129.21 157.55.133.204 157.56.91.77 168.62.187.13 191.234.72.183 \
191.234.72.186 191.234.72.188 191.234.72.190 204.79.197.200 207.46.223.94 207.68.166.254
do
ipset -A MicrosoftSpyServers $IP
done
fi
[ -z "$(iptables-save | grep MicrosoftSpyServers)" ] && iptables -I FORWARD -m set $MATCH_SET MicrosoftSpyServers dst -j DROP
# SET CONFIG
path=/jffs/filters
#path for malware filter files
# END CONFIG
# SET VARIBLES
regexp=`echo "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"`
# END VARIBLES
# Loading ipset modules
lsmod | grep "ipt_set" > /dev/null 2>&1 || \
for module in ip_set ip_set_iptreemap ipt_set; do
insmod $module
done
# Different routers got different iptables syntax
case $(uname -m) in
armv7l)
MATCH_SET='--match-set'
;;
mips)
MATCH_SET='--set'
;;
esac
# Get lists
get_list () {
mkdir -p $path
wget -q --show-progress -i $path/malware-filter.list -O $path/malware-list.pre
cat $path/malware-list.pre | grep -oE "$regexp" | sort -u >$path/malware-filter.txt
}
get_update () {
mkdir -p $path
wget -q --show-progress -i $path/malware-filter.list -O $path/malware-list.pre
cat $path/malware-list.pre | grep -oE "$regexp" | sort -u >$path/malware-updates.txt
}
# Create the malware-filter (primary) if does not exists
if [ "$(ipset --swap malware-filter malware-filter 2>&1 | grep 'Unknown set')" != "" ]; then
get_list
ipset -N malware-filter iphash
for IP in $(cat $path/malware-filter.txt)
do
ipset -A malware-filter $IP
done
[ -z "$(iptables-save | grep malware-filter)" ] && iptables -I FORWARD -m set $MATCH_SET malware-filter dst -j DROP
fi
# Destroy this transient set just in case
ipset --destroy malware-update > /dev/null 2>&1
# Load the latest rule(s)
(echo -e "-N malware-update iphash\n" && \
get_update | \
nice sed 's/^/-A malware-update /' && \
echo -e "\nCOMMIT\n" \
) | \
nice ipset --restore && \
nice ipset --swap malware-update malware-filter && \
nice ipset --destroy malware-update
exit $?Now, When running this script all seems fine. It takes about 5 minutes for it to finish.
The log shows me these sorts of info:
Jan 15 18:28:51 kernel: net/ipv4/netfilter/ip_set_nethash.c: nethash_retry: rehashing of set BlockedCountries triggered: hashsize grows from 448398 to 672597
I gues that's ok?
Because when testing if I can access my NAS from one of those countries (using http://www.webpagetest.org/ ) I see that the router is actually allowing access to my NAS! WHUT? That's not what I want!!
2017-01-15 18:02:07 Alert 192.168.0.1 user kernel ACCEPT <4>ACCEPT IN=eth0 OUT=br0 <1>SRC=122.248.198.232 DST=192.168.0.197
Now I've seen a posting here about ARM CPU's not understanding the IPT_Set. Hoewever changing it to XT_SET gives an error back. So IPT_SET seems to work fine.
Now...Why isn't my router blocking those countries? In the \JFFS\IP_lists\ folder I see the files for all those countries.
"...It seems this is not blocking the so-called FORWARD CHAIN..." someone told me. Is this the reason? If So, how do I fix that?
no need for more bumps.
