Morac
Senior Member
I'm running Merlin 382.1_2 on my AC88U and I am unable to get blacklisting to work with the Network Services Filter. I was originally trying to blacklist a NTP server so I added the ip address and set the protocol to UDP, but that didn't work. I then tried other ip addresses and TCP and was able to access them.
I checked iptables and I can see that entries are being added to the CHAIN NSFW with a rule of RETURN. Is that what it should be? I ask because from my understanding RETURN just causes iptables to go back to the previous rule and continue checking.
Here's the ip tables sections in question:
As you can see the NSFW rule for 204.176.49.10 is hitting, but simply returning back to the FORWARD chain and being accepted by rule 8 of the FORWARD chain. I read somewhere that Network Services Filter doesn't work if Parental Controls is enabled, but it's not enabled on my router. It looks like the Network Services Filter is simply broken.
Is there something wrong with the FORWARD rules or is the NSFW rule being created wrong?
Any idea how to fix this without manually adding an iptable rule?
Here's the entire iptables list. Of note I have a number of port forward rules which don't show up anywhere in iptables even though they work.
I checked iptables and I can see that entries are being added to the CHAIN NSFW with a rule of RETURN. Is that what it should be? I ask because from my understanding RETURN just causes iptables to go back to the previous rule and continue checking.
Here's the ip tables sections in question:
Code:
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 4940 1179K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 0 0 ACCEPT all -- tun21 * 0.0.0.0/0 0.0.0.0/0
3 0 0 DROP all -- !br0 eth0 0.0.0.0/0 0.0.0.0/0
4 9 468 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
5 0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
6 610 47856 NSFW all -- * * 0.0.0.0/0 0.0.0.0/0
7 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT
8 2 152 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0
Chain NSFW (1 references)
num pkts bytes target prot opt in out source destination
1 2 152 RETURN udp -- br0 eth0 0.0.0.0/0
2 608 47704 ACCEPT all -- br0 eth0 0.0.0.0/0 0.0.0.0/0
As you can see the NSFW rule for 204.176.49.10 is hitting, but simply returning back to the FORWARD chain and being accepted by rule 8 of the FORWARD chain. I read somewhere that Network Services Filter doesn't work if Parental Controls is enabled, but it's not enabled on my router. It looks like the Network Services Filter is simply broken.
Is there something wrong with the FORWARD rules or is the NSFW rule being created wrong?
Any idea how to fix this without manually adding an iptable rule?
Here's the entire iptables list. Of note I have a number of port forward rules which don't show up anywhere in iptables even though they work.
Code:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- tun21 * 0.0.0.0/0 0.0.0.0/0
2 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1194
3 8328 1243K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
4 12 480 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
5 3434 647K PTCSRVWAN all -- !br0 * 0.0.0.0/0 0.0.0.0/0
6 1542 199K PTCSRVLAN all -- br0 * 0.0.0.0/0 0.0.0.0/0
7 1542 199K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
8 3024 630K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW
9 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
10 0 0 SSHBFP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:27158 state NEW
11 6 240 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
12 404 17672 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 4940 1179K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 0 0 ACCEPT all -- tun21 * 0.0.0.0/0 0.0.0.0/0
3 0 0 DROP all -- !br0 eth0 0.0.0.0/0 0.0.0.0/0
4 9 468 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
5 0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
6 610 47856 NSFW all -- * * 0.0.0.0/0 0.0.0.0/0
7 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT
8 2 152 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 12487 packets, 4853K bytes)
num pkts bytes target prot opt in out source destination
Chain ACCESS_RESTRICTION (0 references)
num pkts bytes target prot opt in out source destination
Chain FUPNP (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.36 udp dpt:9306
2 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.36 udp dpt:9308
Chain INPUT_ICMP (0 references)
num pkts bytes target prot opt in out source destination
Chain NSFW (1 references)
num pkts bytes target prot opt in out source destination
1 2 152 RETURN udp -- br0 eth0 0.0.0.0/0 204.176.49.10
2 608 47704 ACCEPT all -- br0 eth0 0.0.0.0/0 0.0.0.0/0
Chain PControls (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain PTCSRVLAN (1 references)
num pkts bytes target prot opt in out source destination
Chain PTCSRVWAN (1 references)
num pkts bytes target prot opt in out source destination
Chain SECURITY (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x17/0x02 limit: avg 1/sec burst 5
2 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x17/0x02
3 0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x17/0x04 limit: avg 1/sec burst 5
4 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x17/0x04
5 0 0 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 limit: avg 1/sec burst 5
6 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8
7 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain SSHBFP (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 recent: SET name: SSH side: source
2 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 recent: UPDATE seconds: 60 hit_count: 4 name: SSH side: source
3 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain default_block (0 references)
num pkts bytes target prot opt in out source destination
Chain logaccept (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix "ACCEPT "
2 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain logdrop (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix "DROP "
2 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Last edited: