i just wanted to say that i found this site after trying to find a solution to errors i encountered while trying to run "firewall-start" scripts from the Asus-Merlin Wiki.
i actually have almost 0 experience with the commandline interface so i pretty much got stuck on the first step after SSH'ing into the router. (how to create a script file. lol)
Model: RT-AC68R (ipset v6 / arm v7l)
Firmware: Asuswrt-Merlin v380.64
log into your routers web interface.
go to:
firewall -> general
enable firewall.
go to:
Administration -> System
Enable JFFS custom scripts and configs (YES)
Enable SSH (lan only)
--
download an SSH client. i used putty.
this is just for anyone else who doesn't know how to use the commandline interface.
to create the "firewall-start" script, you have to do the following:
log into the router using SSH. (username/password = it's the same as your login information to log into the routers web interface)
go to /jffs/scripts by typing this:
create the script called "firewall-start by typing:
this script only blocks Russia, China, Brazil, India, Mexico, Columbia, and Poland.
to modify the countries, search for the comments that shows you how (comments in scripts have # at the beginning of the line)
copy& paste this into the nano text editor :
(i did keep getting errors when pasting this into Putty because my Putty window was apparently too small. for some reason putty would WORD-WRAP some of the longer lines and because i don't know anything about commandline interfaces, i thought it was perfectly fine. it isn't. you will get errors so make sure that your scripts don't word-wrap. )
save it (in putty you press "ctrl+x", then save by pressing "y" for yes, then name it (you already named it when you typed nano firewall-start); then press "Enter"
make it executable by typing:
then run the script by typing:
just remember that there is a limit on how many IP addresses you can add. i think its 64k.
(i decided to add all third world countries but i kept going over the limit)
if you get errors running this, it's probably because i didn't use the compatibility checks that the other scripts use (arm or mips & ipset v4 or v6)
honestly, if you do encounter any errors, i will not be able to help you since i have no idea what any of those commands do. all i know is that it works.
i actually have almost 0 experience with the commandline interface so i pretty much got stuck on the first step after SSH'ing into the router. (how to create a script file. lol)
Model: RT-AC68R (ipset v6 / arm v7l)
Firmware: Asuswrt-Merlin v380.64
log into your routers web interface.
go to:
firewall -> general
enable firewall.
go to:
Administration -> System
Enable JFFS custom scripts and configs (YES)
Enable SSH (lan only)
--
download an SSH client. i used putty.
this is just for anyone else who doesn't know how to use the commandline interface.
to create the "firewall-start" script, you have to do the following:
log into the router using SSH. (username/password = it's the same as your login information to log into the routers web interface)
go to /jffs/scripts by typing this:
Code:
cd /jffs/scripts
Code:
nano firewall-startto modify the countries, search for the comments that shows you how (comments in scripts have # at the beginning of the line)
copy& paste this into the nano text editor :
(i did keep getting errors when pasting this into Putty because my Putty window was apparently too small. for some reason putty would WORD-WRAP some of the longer lines and because i don't know anything about commandline interfaces, i thought it was perfectly fine. it isn't. you will get errors so make sure that your scripts don't word-wrap. )
Code:
#!/bin/sh
# Loading ipset modules
lsmod | grep "xt_set" > /dev/null 2>&1 || \
for module in ip_set ip_set_hash_net ip_set_hash_ip xt_set
do
insmod $module
done
# Preparing folder to cache downloaded files
IPSET_LISTS_DIR=/jffs/ipset_lists
[ -d "$IPSET_LISTS_DIR" ] || mkdir -p $IPSET_LISTS_DIR
# Block incoming traffic from some countries using IPDENY.com blocklist
if [ "$(ipset --swap BlockedCountries BlockedCountries 2>&1 | grep -E 'Unknown set|The set with the given name does not exist')" != "" ]
then
ipset -N BlockedCountries nethash
#step 1: See country codes(Example: MEXICO(mx) use mx to block mexico IP)at http://www.ipdeny.com/ipblocks/
#step 2: Insert the country codes after "for country in" (located below this line)
for country in ru cn br in mx co pl
do
[ -e $IPSET_LISTS_DIR/$country.lst ] || wget -q -O $IPSET_LISTS_DIR/$country.lst http://www.ipdeny.com/ipblocks/data/countries/$country.zone
for IP in $(cat $IPSET_LISTS_DIR/$country.lst)
do
ipset -A BlockedCountries $IP
done
done
fi
[ -z "$(iptables-save | grep BlockedCountries)" ] && iptables -I FORWARD -m set --match-set BlockedCountries src,dst -j DROPsave it (in putty you press "ctrl+x", then save by pressing "y" for yes, then name it (you already named it when you typed nano firewall-start); then press "Enter"
make it executable by typing:
Code:
chmod +x /jffs/scripts/firewall-start
Code:
./firewall-start(i decided to add all third world countries but i kept going over the limit)
if you get errors running this, it's probably because i didn't use the compatibility checks that the other scripts use (arm or mips & ipset v4 or v6)
honestly, if you do encounter any errors, i will not be able to help you since i have no idea what any of those commands do. all i know is that it works.
When you say its not populating the lists, can you give me:
