Apologies for me not understanding.
I debugged myself for a good 1-2 hours so as not to waste your time or infuriate you with things not working.
I feel I am so close, I just dont get what I'm not getting?
Is there anything else that is incorrect or am I just not getting it?
You do not need to apologise
I too am frustrated (with myself more than anything
) but abject apologies for your wasted 2 hour silly-o-clock debugging session
My intention is to explain/demonstrate the three (simple) steps necessary to meet your firewall requirements:
i.e.
1.
services-start: Create
empty IPSET (If a backup exists on
/jffs then it can be restored at this point)
2.
firewall-start: Create
BLOCKING/ALLOWED firewall rules (Can't do this if
IPSET doesn't exist)
3.
wan-start: Populate
IPSET (can't do this with
nslookup script or automatically
using dnsmasq if the WAN isn't UP)
i.e. the timing/order in which the steps are implemented is critical, and to further complicate things, scripts
firewall-start/
wan-start may execute multiple times concurrently.
Q: If the Ipset list is populated [manually using a script], I dont need to put the following lines on the bottom of the wan-start file(nor run them in any way) as the ipset rules apply independently of the masq correct and would just be double the info in 2 places correct?
When you manually populate the IPSET, the
nslookup command will retrieve the
'static' IP(s) returned from whichever
DNS server replies at that
precise moment in time.
i.e. Suppose the
IP changes (perhaps the domain owner changes or adds another server/IP) then without the
dnsmasq '
ipset=/' directive you would be
BLOCKED as
dnsmasq would be unable to automatically add the new
IP to the
authorised IPSET.
219am(EST) edit:After re-reading this whole thread I think I am wrong and should be running this on bottom of wan-start file?
Code:
echo "ipset=/snbforums.com/www.speedtest.net/www.whatismyipaddress.com/Valid_VPN_IP" >>/jffs/configs/dnsmasq.conf.add
service restart_dnsmasq
NO, '
/jffs/configs/dnsmasq.conf.add' is persistent over a reboot so once it exists, simply add/remove entries using the
'nano' editor or
WinSCP.
If
IPSET Valid_VPN_IP can't be restored from a backup, a delay in
wan-start is seemingly required before attempting to manually populate the
IPSETs
e.g. I explicitly added a 2 second delay (see new verbose wan-start in
post #10)
e.g.
Code:
May 5 06:05:24 custom_script: Running /jffs/scripts/services-start
May 5 06:05:24 (services-start): 1246 Loading iptables 'comment' module xt_comment.ko rc=0
May 5 06:05:24 (services-start): 1246 Creating VPN IPSETs ('/jffs/configs/IPSET_VPNrules.config') rc=0
May 5 06:05:24 (services-start): 1246 Creating IPSET 'Valid_VPN_IP' rc=0
May 5 06:05:24 (services-start): 1246 Restoring IPSET ('/jffs/configs/Valid_VPN_IP.ipset') rc=1
May 5 06:05:24 custom_script: Running /jffs/scripts/wan-start (args: 0)
May 5 06:05:24 (wan-start): 1393 Paused for 2 secs.....
May 5 06:05:24 custom_script: Running /jffs/scripts/nat-start
May 5 06:05:24 custom_script: Running /jffs/scripts/firewall-start (args: eth0)
May 5 06:05:26 (wan-start): 1393 Adding domains to IPSET 'Valid_VPN_IP'
May 5 06:05:27 (wan-start): 1393 'snbforums.com' 104.27.127.97 rc=0
May 5 06:05:27 (wan-start): 1393 'snbforums.com' 104.27.126.97 rc=0
May 5 06:05:27 (wan-start): 1393 'speedtest.net' 151.101.2.219 rc=0
May 5 06:05:27 (wan-start): 1393 'speedtest.net' 151.101.194.219 rc=0
May 5 06:05:27 (wan-start): 1393 'speedtest.net' 151.101.130.219 rc=0
May 5 06:05:27 (wan-start): 1393 'speedtest.net' 151.101.66.219 rc=0
May 5 06:05:27 (wan-start): 1393 'whatismyipaddress.com' 104.16.154.36 rc=0
May 5 06:05:27 (wan-start): 1393 'whatismyipaddress.com' 104.16.155.36 rc=0
Dec 1 15:09:31 (firewall-start): 1495 Creating IPSET 'Valid_VPN_IP' rules
So, to accommodate your change in requirements, the firewall rules in
post #27 have been updated albeit without changing the
IPSET name (i.e. '
Valid_VPN_IP' should really be changed to say '
Valid_IP' in all scripts to reflect that
VPNs are no longer relevant despite the thread title.)
Lastly, does it matter if I am rebooting via website reboot button versus command reboot in mobaxterm?
In theory No, but I personally always use a '
Reboot.sh' script containing
as the last line.
- you should know why.
