I wanted to set up a specific routing rule and am confused on how to do it on the UI.
I basically wanted to set a specific internal IP(item on my network) (static) 192.168.2.26 (for example) to block all traffic outgoing ingoing to it.
Then allow only certain websites to access (siteexample.com) that device and not allow other sites and route the traffic on top of that through a VPN Server(NordVPN) ( which i setup on the VPN setting and have it working already).
I tried the firewall option and blocking the website name but the site and all subdomains are still pingable.
Any idea what I am doing wrong.
P.S. Also is there a log where i can see the traffic going from and to a device so i can better isolate the traffic(with a UI perhaps?)
Thanks in advance,
Dee
I basically wanted to set a specific internal IP(item on my network) (static) 192.168.2.26 (for example) to block all traffic outgoing ingoing to it.
Then allow only certain websites to access (siteexample.com) that device and not allow other sites and route the traffic on top of that through a VPN Server(NordVPN) ( which i setup on the VPN setting and have it working already).
Internet ==+==========>>Router Allow www.ibm.com
¦^¦ + + + +
¦^¦ ^ ^ ^ ^
¦|¦ | | | |
NordVPN Client | | | |
¦^¦ | | | |
¦|¦ | v v v
¦|¦ | 192.168.2.xxx
¦|¦ |
¦|¦ |
¦|¦ +----+
¦|¦ |
¦|¦ |
¦|¦ v
¦|¦ 192.168.2.26 (Selective Routing GUI rule: THISPC 192.168.2.26 'xxx.xxx.xxx.xxx' VPN)
¦|¦ // where xxx.xxx.xxx.xxx is the current IP for 'www.ibm.com'
¦|¦ //
¦|¦ //
¦|¦ //
¦|¦ ONLY www.ibm.com
¦|¦ ¦|¦
¦|¦ ¦|¦
¦|¦ ¦|¦
¦|¦ ¦|¦
¦|¦ ¦|¦
¦|¦==========¦|¦
¦+------------+¦
¦==============¦
either way you will need a script to add appropriate rules to the firewall.
i.e. you can't Selectively Route URL/Domains using the GUI as only IPs/CIDRs are allowed in the target 'Destination IP' field, and a single URL/Domain may resolve to a range of 10s if not 100s of IPs.
The GUI 'Firewall - URL Filter' does not physically block PING traffic.
Also it is Global in scope, so if you filter say 'www.ibm.com', then the URL 'text-based' block is from ALL LAN devices - not just the device(s) Selectively Routed via the NordVPN Client.
PING blocking can be explicitly enabled (but isn't intuitive) on 'Firewall - Network Services Filter' GUI, however it too is Global, meaning it will be completely DISABLED from ANY LAN device(s) regardless of target URL/IP.
Internet ==+==========>>Router Allow www.ibm.com
¦^¦ + + + +
¦^¦ ^ ^ ^ ^
¦|¦ | | | |
NordVPN Client | | | |
¦^¦ | | | |
¦|¦ | v v v
¦|¦ | 192.168.2.xxx
¦|¦ |
¦|¦ |
¦|¦ +----+
¦|¦ |
¦|¦ |
¦|¦ v
¦|¦ 192.168.2.26 (Selective Routing GUI rule: THISPC 192.168.2.26 'xxx.xxx.xxx.xxx' VPN)
¦|¦ // where xxx.xxx.xxx.xxx is the current IP for 'www.ibm.com'
¦|¦ //
¦|¦ //
¦|¦ //
¦|¦ ONLY www.ibm.com
¦|¦ ¦|¦
¦|¦ ¦|¦
¦|¦ ¦|¦
¦|¦ ¦|¦
¦|¦ ¦|¦
¦|¦==========¦|¦
¦+------------+¦
¦==============¦
either way you will need a script to add appropriate rules to the firewall.
i.e. you can't Selectively Route URL/Domains using the GUI as only IPs/CIDRs are allowed in the target 'Destination IP' field, and a single URL/Domain may resolve to a range of 10s if not 100s of IPs.
The GUI 'Firewall - URL Filter' does not physically block PING traffic.
Also it is Global in scope, so if you filter say 'www.ibm.com', then the URL 'text-based' block is from ALL LAN devices - not just the device(s) Selectively Routed via the NordVPN Client.
PING blocking can be explicitly enabled (but isn't intuitive) on 'Firewall - Network Services Filter' GUI, however it too is Global, meaning it will be completely DISABLED from ANY LAN device(s) regardless of target URL/IP.
dont think its hacked, on http://www.x3mtek.com/ I see:
This domain name registration has expired and renewal or deletion are pending. If you are the registrant and want to renew the domain name, please contact your registration service provider.
dont think its hacked, on http://www.x3mtek.com/ I see:
This domain name registration has expired and renewal or deletion are pending. If you are the registrant and want to renew the domain name, please contact your registration service provider.
Ahh OK, that is probably more reassuring, although the blank page only containing the message 'Helo Dude' is the type of thing kiddie scripters think is funny!
NOTE: The blog Table of Contents is available in Google cache but not the linked content.
So presumably you have entered something similar in the VPN Client GUI?
i.e. criteria
1.192.168.2.26 must NEVER use the WAN, and must honour the VPN KILL-switch if the VPN Client is DOWN
2.192.168.2.26 may only access a limited number of specified Websites/Domains.
So essentially you require to implement the 'Requirements Option 1' diagram (unlike Option 2. where 192.168.2.26 always uses the WAN except for nominated IPs/domains via the VPN)
The complete solution (criteria 2) requires you to manually add firewall rules to
1. BLOCK all internet websites from 192.168.2.26 thru the VPN Client tunnel by default.
2. Allow 192.168.2.26's nominated Domains/Websites as exceptions
In the example above, nslookup (for me) currently returns nine IPv4 addresses for 'www.youtube.com' - so with just two domains, we already have 10 rules.
Subsequently it is prudent to save all the domain IP addresses in an IPSET and rather have potentially hundreds of firewall rules have just one!
P.S. @Xentrk has scripts to collect all of the IPs for a selected domain see Xentrk GitHub
You can examine the firewall statistics to see if the restricted domain access is working as expected, and also interrogate the IPSET
Code:
ipset test Valid_VPN_IP snbforums.com
104.27.127.97 is in set Valid_VPN_IP.
Furthermore, rather than manually populate the IPSET, you can simply create an empty IPSET and have dnsmasq automatically (in real-time) add any new IPs associated with the selected domains,
Simply issue
Code:
echo "ipset=/snbforums.com/www.youtube.com/Valid_VPN_IP" >>/jffs/configs/dnsmasq.conf.add
service restart_dnsmasq
1.192.168.2.26 must NEVER use the WAN, and must honour the VPN KILL-switch if the VPN Client is DOWN
2.192.168.2.26 may only access a limited number of specified Websites/Domains.
So essentially you require to implement the 'Requirements Option 1' diagram (unlike Option 2. where 192.168.2.26 always uses the WAN except for nominated IPs/domains via the VPN)
The solution requires you to manually add firewall rules to
1. BLOCK all internet websites from 192.168.2.26 thru the VPN Client tunnel by default.
2. Allow 192.168.2.26's nominated Domains/Websites as exceptions
In the example above, nslookup (for me) currently returns nine IPv4 addresses for 'www.youtube.com' - so with just two domains, we already have 10 rules.
Subsequently it is prudent to save all the domain IP addresses in an IPSET and rather have potentially hundreds of firewall rules have just one!
P.S. @Xentrk has scripts to collect all of the IPs for a selected domain see Xentrk GitHub
You can examine the firewall statistics to see if the restricted domain access is working as expected, and also interrogate the IPSET
Code:
ipset test Valid_VPN_IP www.ibm.com
104.84.254.38 is in set Valid_VPN_IP.
Furthermore, rather than manually populate the IPSET, you can simply create an empty IPSET and have dnsmasq automatically (in real-time) add any new IPs associated with the selected domains,
Simply issue
Code:
echo "ipset=/www.ibm.com/www.youtube.com/Valid_VPN_IP" >>/jffs/configs/dnsmasq.conf.add
service restart_dnsmasq
Thank you very much for the explanation.
I will try it tonight when home from work and advise if its not what I wanted. I will test it with a pc before I change the ip to what I wanted
Martineau
So essentially I am just doing the 2 things below:
So presumably you have entered something similar in the VPN Client GUI?
(YES I DID)
Then i SSH into my router with PUTTY and do the following commands( I am not too keen/good with these commands nor linux , sorry for any errors I type):
"
modprobe -sv xt_comment.ko
Yes, PuTTY is fine, although you may wish to use a more feature-rich SSH client such as Xshell or MobaXterm but it should be a simple copy'n'paste into the command line.
#!/bin/sh
Say(){
echo -e $$ $@ | logger -st "($(basename $0))"
}
IPSET_NAME="Valid_VPN_IP"
Say "Paused for 2 secs....."
sleep 2
# These are optional, but if the domains are defined in 'dnsmasq.conf.add' then dnsmasq will automatically populate the ipset, but will not include the comment description to help identify the IPs. (May be useful if you later want to remove a domain's IPs.)
Say "Adding domains to IPSET '$IPSET_NAME'"
THIS="snbforums.com";for IP in $(nslookup $THIS | awk 'NR==1, $1 == "Name:" {next}; {if ( $0 ~ /\./ ) print $3}');do ipset add $IPSET_NAME $IP comment $THIS; Say "'"$THIS"' $IP rc="$?;done;
THIS="speedtest.net";for IP in $(nslookup $THIS | awk 'NR==1, $1 == "Name:" {next}; {if ( $0 ~ /\./ ) print $3}');do ipset add $IPSET_NAME $IP comment $THIS; Say "'"$THIS"' $IP rc="$?;done;
THIS="whatismyipaddress.com";for IP in $(nslookup $THIS | awk 'NR==1, $1 == "Name:" {next}; {if ( $0 ~ /\./ ) print $3}');do ipset add $IPSET_NAME $IP comment $THIS;Say "'"$THIS"' $IP rc="$?;done
then make the scripts executable
Code:
chmod a+rx /jffs/scripts/*
P.S. There is a wealth of information in the RMerlin Wiki describing how to write scripts, and for descriptions of the various files such as 'firewall-start' see User scripts
Yes, PuTTY is fine, although you may wish to use a more feature-rich SSH client such as Xshell or MobaXterm but it should be a simple copy'n'paste into the command line.
P.S. There is a wealth of information in the RMerlin Wiki describing how to write scripts, and for descriptions of the various files such as 'firewall-start' see User scripts
I'm sure @Xentrk is aware of his Blog site access issues, and will restore access ASAP.
In the interim, this video How to setup Policy rules and KILL Switch is old but still quickly demonstrates how easy it is (only three clicks) to select a LAN device and route all of its traffic thru' the VPN tunnel.
If you have correctly created the IPSET, when you access 'www.siteiwanttoallow.com' its IP address(s) will automatically be added to IPSET Valid_VPN_IP.
However, if required, you can manually add them using
Code:
ipset add Valid_VPN_IP xxx.xxx.xxx.xxx
ipset list Valid_VPN_IP
Martineau Thanks for the wealth of information, I modified the firewall-start to now always go through the VPN and wanted to do that myself as per the video you posted on youtube.
So I modified the files thusly.
Let me know if I messed up anything before i implement them.
I didn't mess anything up in his code by removing those VPN lines did I?
Also I don't think this one ran as the ipset doesn't show right when I run the "ipset list VALID_VPN_IP". I get the following picture, What did I do wrong?
I didn't mess anything up in his code by removing those VPN lines did I?
Also I don't think this one ran as the ipset doesn't show right when I run the "ipset list VALID_VPN_IP". I get the following picture, What did I do wrong?
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.
