Thank you.
Will do - thank you!
I think I found what caused that. I corrected it, but on the 1.7 branch only: raising shield from web UI after aegis being unset caused problems (trying to uprear the shield with no directives)
pp0|wnt:150.143.158.7|tif:tun21|tnt:10.101.0.14pp0|wnt:150.143.158.7|tif:tun21|tnt:10.101.0.14
Ok, good that the download worked.The latest update 1.7.05 did download .......hooray but still seems the same problem with ip tables
AEGIS
by bolemo
version 1.7.0b5
external drive
STATUS COMMAND LOG TOOLS LISTS
Status @ 2021-02-25 17:52:05 (router time)
- Problems found!
- Aegis shield is up for: WAN interface (ppp0) and VPN tunnel (tun21).
- Blocking a total of 619579319 IP addresses (global: 619579319, WAN only: 0, VPN only: 0).
- Bypassing 0 IP addresses (global: 0, WAN only: 0, VPN only: 0).
- Logging is disabled.
Problems
Setting status
- directives: there are no blocking directives!
- iptables: current aegis rules were modified since last uprear!
Directives generation times
- Script firewall-start.sh is set for aegis.
- Script post-mount.sh is set for aegis.
Uprear information
- Sources cache list latest update: 2021-02-25 17:51:36
- Global block list: 2021-02-25 17:51:36
Debug
- Shield was upreared from: aegis script @ 2021-02-25 17:51:41
- ipset: global block list was loaded from file directives.
- iptables: rules were UNSUCCESSFULLY (re)set with: global block, VPN network bypass.
- log daemon: was already off.
- device info: R7800 R7800 V1.0.2.82.2SF
- aegis info: aegis 1.7.0b5-ext
- status codes: ck:2111|dna:66|dir:224689|ablc:619579319|awlc:0|wblc:0|wwlc:0|tblc:0|twlc:0|wif
- info file: tst:1614275501|nfo:12582931|dna:66|wif
- conf:
- aegis.wan=net-iface
- aegis.tun=net-iface
- aegis.log=log
- aegis.up=1
- aegis_web.log=subsection
- aegis_web.log.len='300'
- aegis_web.log.basetime='1614237983'
- aegis_web.log.pos='0'
- iptables engine rules:
- -N aegis_vpn_dst
- -N aegis_vpn_src
- -N aegis_wan_dst
- -N aegis_wan_src
- -A INPUT -i ppp0 -m comment --comment "jump to aegis WAN src chain" -j aegis_wan_src
- -A INPUT -i tun21 -m comment --comment "jump to aegis VPN src chain" -j aegis_vpn_src
- -A FORWARD -i ppp0 -m comment --comment "jump to aegis WAN src chain" -j aegis_wan_src
- -A FORWARD -o ppp0 -m comment --comment "jump to aegis WAN dst chain" -j aegis_wan_dst
- -A FORWARD -i tun21 -m comment --comment "jump to aegis VPN src chain" -j aegis_vpn_src
- -A FORWARD -o tun21 -m comment --comment "jump to aegis VPN dst chain" -j aegis_vpn_dst
- -A OUTPUT -o ppp0 -m comment --comment "jump to aegis WAN dst chain" -j aegis_wan_dst
- -A OUTPUT -o tun21 -m comment --comment "jump to aegis VPN dst chain" -j aegis_vpn_dst
- -A aegis_vpn_dst -d 10.101.0.14/32 -m comment --comment "aegis inet bypass" -j RETURN
- -A aegis_vpn_dst -m set ! --match-set aegis_all_bl dst -m comment --comment "not in aegis blocklists" -j RETURN
- -A aegis_vpn_dst -m comment --comment "aegis reject outgoing" -j REJECT --reject-with icmp-admin-prohibited
- -A aegis_vpn_src -s 10.101.0.14/32 -m comment --comment "aegis inet bypass" -j RETURN
- -A aegis_vpn_src -m set ! --match-set aegis_all_bl src -m comment --comment "not in aegis blocklists" -j RETURN
- -A aegis_vpn_src -m comment --comment "aegis drop incoming" -j DROP
- -A aegis_wan_dst -m set ! --match-set aegis_all_bl dst -m comment --comment "not in aegis blocklists" -j RETURN
- -A aegis_wan_dst -m comment --comment "aegis reject outgoing" -j REJECT --reject-with icmp-admin-prohibited
- -A aegis_wan_src -m set ! --match-set aegis_all_bl src -m comment --comment "not in aegis blocklists" -j RETURN
- -A aegis_wan_src -m comment --comment "aegis drop incoming" -j DROP
- ipset engine sets:
- aegis_all_bl:
- Name: aegis_all_bl
- Type: hash:net
- Revision: 7
- Header: family inet hashsize 32768 maxelem 51083 bucketsize 12 initval 0x3fedae18
- Size in memory: 1334864
- References: 4
- Number of entries: 51083
I sent you a PM with a version you can try to see if I solved it for you.
pp0|wnt:150.143.158.7/32|tif:tun21|tnt:10.105.0.26/32pp0|wnt:150.143.158.7/32|tif:tun21|tnt:10.105.0.26/32
1614550384 aegis: aegis 1.6.12 launched [/usr/bin/aegis up -vvv] [RBR50 RBR50 V9.2.5.2.8SF-HW]
- aegis.wan=net-iface
- aegis.tun=net-iface
- aegis.log=log
- aegis.log.len='5000'
- aegis.log.enabled='1'
- aegis.up=1
- aegis.debug=/mnt/sda1/aegis.debug
1614550384 aegis: main routing with args: up -vvv
1614550384 aegis: sc_init
1614550384 aegis: check_path
1614550384 aegis: check_conf
1614550384 aegis: shield_up
1614550385 aegis: shield_init
1614550385 aegis: check_conf
1614550385 aegis: check_firewall_start
1614550385 aegis: check_postmount
1614550385 aegis: |---> shield_uprear 3
1614550385 aegis: _cipset_init (dir: /tmp/aegis_ESJAjB)
1614550385 aegis: _cipset_copy_set aegis_bl
1614550385 aegis: _cipset_diff_set_file aegis_bl /opt/bolemo/etc/aegis.bl.directives
1614550385 aegis: _cipset_swap_set_file aegis_bl /opt/bolemo/etc/aegis.bl.directives
1614550401 aegis: _cipset_trap
1614550401 aegis: _cipset_endHi,
From kamoj addon release_note 2021-12-31 5.5b13:
awk '/Internet connected/ {print $0" "substr($NF,1,2)*3600+substr($NF,4,2)*60+substr($NF,7,2)}' </var/log/messages | while IFS= read -r S; do
current="$(echo "$S"|awk '{print $NF}')"
[ -n "$prev" ] && delta="$(echo "$prev $current"|awk '{print ($NF-$1)}')"
prev="$current"
echo "$S delta=$delta" | sed -r 's/(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/xxx.xxx.xxx.xxx/g'
done
[Internet connected] IP address: xxx.xxx.xxx.xxx, Thursday, June 08, 2023 02:50:08 10208 delta=
[Internet connected] IP address: xxx.xxx.xxx.xxx, Thursday, June 08, 2023 05:27:38 19658 delta=9450
[Internet connected] IP address: xxx.xxx.xxx.xxx, Thursday, June 08, 2023 08:05:09 29109 delta=9451
[Internet connected] IP address: xxx.xxx.xxx.xxx, Thursday, June 08, 2023 10:42:39 38559 delta=9450
[Internet connected] IP address: xxx.xxx.xxx.xxx, Thursday, June 08, 2023 13:20:10 48010 delta=9451
[Internet connected] IP address: xxx.xxx.xxx.xxx, Thursday, June 08, 2023 15:57:40 57460 delta=9450
[Internet connected] IP address: xxx.xxx.xxx.xxx, Thursday, June 08, 2023 18:35:11 66911 delta=9451
[Internet connected] IP address: xxx.xxx.xxx.xxx, Thursday, June 08, 2023 21:12:41 76361 delta=9450
[Internet connected] IP address: xxx.xxx.xxx.xxx, Thursday, June 08, 2023 23:50:10 85810 delta=9449Interesting…
setup_interface_static_ip()
{
local mtu=$($CONFIG get wan_dhcp_mtu)
ifconfig $WAN_IF mtu ${mtu:-1500}
ifconfig $WAN_IF $($CONFIG get wan_ipaddr) netmask $($CONFIG get wan_netmask)
if ! same_subnet $($CONFIG get wan_ipaddr) $($CONFIG get wan_gateway) $($CONFIG get wan_netmask); then
route add -net $($CONFIG get wan_gateway) netmask 255.255.255.255 dev $WAN_IF
fi
route add default gw $($CONFIG get wan_gateway)
$FIREWALL restart
# static route & ripd
/sbin/cmdroute stop
/usr/bin/killall -SIGINT ripd
/sbin/cmdroute start
/usr/sbin/ripd
/sbin/cmdigmp stop
/sbin/cmdigmp start
/sbin/ledcontrol -n wan -c green -s on
# if IP address re-assigned, we will check qos bandwidth.
local qos_enable=`$CONFIG get qos_endis_on`
local qos_bandwidth_enable=`$CONFIG get qos_threshold`
local qos_bandwidth_type=`$CONFIG get qos_bandwidth_type`
if [ "x$qos_enable" = "x1" -a "x$qos_bandwidth_enable" = "x1" ]; then
if [ "x$qos_bandwidth_type" = "x1" ]; then
/etc/bandcheck/band-check &
fi
fi
# log for static mode when wan gets ip.
local wan_log="[Internet connected] IP address: "$($CONFIG get wan_ipaddr)","
/usr/bin/logger "$wan_log"
}OK, I'll make a stack dump next time net-wan is called, to see what's going on.
Please, keep us updated on your findings. This made me curious.
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
