Martineau
Part of the Furniture
This hacked version works on my RT-AC68U.
NOTE: Country Blocking is no longer included...you can use the latest country blocking script from the Wiki https://github.com/RMerl/asuswrt-merlin/wiki/Using-ipset#tor-and-countries-block
Full credit to member @Adamm for the original script/idea.
Thanks to @HardCat for spotting the incorrect line.
EDIT: 24/04/2017 The (too large to post in-line) current version (v3.04) is hosted here:
https://pastebin.com/zQ3KEe8P
Code:
#!/bin/sh
#================================================================================================= © 2016-2017 Martineau
# Dynamically block unsolicited access attempts using IPSETs. Useful if U have opened ports >1024 as hopefully hackers will
# start their attempts at the more common ports e.g. 22,23 etc. so will be blocked BEFORE they reach your port!
#
# IPSET_Block [help|-h] | [status [full]] [reset] [delete] [ban [ip_addr]] [unban [ip_addr]] [whitelist]
#
# IPSET_Block status
# Displays the number of currently blocked I/Ps and the nmber blcoked since the last status request:
# e.g. Summary Blacklist: 12345 IPs currently banned. 99 New IP's Banned.
# IPSET_Block status full
# Display the contents of IPSETs Whitelist & Blacklist - beware there could be a lot!!!
# IPSET_Block reset
# Temporarily flush the IPSET Blacklist (It will be restored @BOOT or manually using the restore cmd)
# IPSET_Block restore
# Restore the IPSETs Whitelist & Blacklist from the current saved IPSETs.
# (If 'delete' was used then U need to clone the 'backup' file before attempting the restore!)
# IPSET_Block ban 12.34.56.7
# Adds 12.34.56.7 to IPSET Blacklist
# IPSET_Block unban 12.34.56.7
# Removes 12.34.56.7 from IPSET Blacklist
# IPSET_Block delete
# Permanently flush the IPSET Blacklist (It cannot be restored @BOOT or using the restore cmd)
#
# /jffs/scripts/init-start
# /usr/sbin/cru a IPSET_SAVE "0 * * * * /jffs/scripts/IPSET_Block.sh save" #Every hour
# /usr/sbin/cru a IPSET_BACKUP "0 5 * * * /jffs/scripts/IPSET_Block.sh backup" #05:00 every day
#
# /jffs/scripts/firewall-start
# /jffs/scripts/IPSET_Block.sh init
#
# NOTE: Whitelist wil be automatically populated with local LAN subnet, but VLANs will need to be added manually e.g. 10.0.0.0/8 etc.
#
# Credit @adamm https://www.snbforums.com/threads/how-to-dynamically-ban-malicious-ips-using-ipset-firewall-addition.16798/#post-115872
# Print between line beginning with'#==' to first blank line inclusive
ShowHelp() {
awk '/^#==/{f=1} f{print; if (!NF) exit}' $0
}
MYROUTER=$(nvram get computer_name)
if [ -d /tmp/mnt/$MYROUTER ]; then
DIR="/tmp/mnt/"$MYROUTER
else
DIR="/tmp"
fi
bannedips=$DIR"/IPSET_IP_Count" # Allows display of new blocked IPs after every implied/ explicit status request
# 380.63+ for ARM routers, IPSET v6 is available...Load appropriate IPSET modules
case $(ipset -v | grep -io "v[4,6]") in
v6)
MATCH_SET='--match-set'; CREATE='create'; ADD='add'; DELETE='del'; SWAP='swap'; SAVE='save'; FLUSH='flush'; RESTORE='restore'
IPHASH='hash:ip'; NETHASH='hash:net family inet'; NETHASH6='hash:net family inet6'; SETNOTFOUND='name does not exist'
lsmod | grep "xt_set" > /dev/null 2>&1 || \
for module in ip_set ip_set_hash_net ip_set_hash_ip xt_set
do
insmod $module > /dev/null 2>&1
done
;;
v4)
MATCH_SET='--set'; CREATE='--create'; ADD='--add'; DELETE='--del'; SWAP='--swap'; SAVE='--save'; FLUSH='--flush'; RESTORE='--restore'
IPHASH='iphash'; NETHASH='nethash'; SETNOTFOUND='Unknown set'
lsmod | grep "ipt_set" > /dev/null 2>&1 || \
for module in ip_set ip_set_nethash ip_set_iphash ipt_set
do
insmod $module
done
;;
*)
logger -st "($(basename $0))" $$ "**ERROR** Unknown ipset version: $(ipset -v). Exiting."
echo -e "\a"
exit 99
;;
esac
# Need assistance!???
if [ "$1" == "help" ] || [ "$1" == "-h" ]; then
ShowHelp
exit 0
fi
ACTION=$1
# If the first arg is an I/P address or subnet then assume it is to be blocked.
# TBA
# status / ban / unban / reset / delete / save / ban / whitelist / backup
case $ACTION in
status)
echo -en "\n"
ipset -L Blacklist | grep -vE "^[0-9]" # Sadly 'ipset -t Blacklist' to list only the IPSET header doesn't work on Asus
if [ ! -z $2 ];then # Verbose if 2nd arg
ipset -L Blacklist | \
grep -E "^[0-9]" | \
sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | \
awk ' {printf "%15s\t", $1;}'
echo " ";echo " "
ipset -L Whitelist
fi
#logger -s -t "($(basename $0))" $$ `ipset -L`
;;
ban)
if [ -z $2 ];then
echo "Input IP Address"
read bannedip
else
bannedip=$2
fi
logger -st "($(basename $0))" $$ "Adding" $bannedip "to Blacklist] ... ... ..."
ipset -q -A Blacklist $bannedip
echo "$bannedip Is Now Banned"
;;
unban)
if [ -z $2 ]; then
echo "Input IP Address To Unban"
read unbannedip
else
unbannedip=$2
fi
logger -st "($(basename $0))" $$ "Unbanning and removing" $unbannedip "from Blacklist ... ... ..."
ipset $DELETE Blacklist $unbannedip
echo "`sed /$unbannedip/d $DIR/IPSET_Rules.txt`" > $DIR/IPSET_Rules.txt
echo $unbannedip "Is Now Unbanned"
;;
reset)
logger -st "($(basename $0))" $$ "Temporarily Allowing ALL ("`cat $bannedips`") I/P's in Blacklist IPSET"
NOW=$(date +"%Y%m%d-%H%M%S") # current date and time
mv $DIR/IPSET_Rules.txt $DIR/IPSET_Rules.txt-$NOW # Create restore backup
ipset $SAVE > $DIR/IPSET_Rules.txt # Save the current IPSETs
ipset $FLUSH Blacklist
rm $bannedips # Reset counter '0'
;;
delete)
logger -st "($(basename $0))" $$ "Permanently deleting ALL ("`cat $bannedips`") I/Ps from Blacklist."
ipset $FLUSH Blacklist
rm $bannedips # Reset counter '0'
ipset $SAVE > $DIR/IPSET_Rules.txt
;;
save)
#echo "Saving Blacklists ... ... ..."
logger -st "($(basename $0))" $$ "Saving IPSet rules to $DIR/IPSET_Rules.txt ... ... ..."
# Only save the IPSETs associated with this script
ipset $SAVE Blacklist > $DIR/IPSET_Block.txt
ipset $SAVE Whitelist >> $DIR/IPSET_Block.txt
;;
whitelist)
echo "Input file location" # see /jffs/configs/IPSET_Whitelist
read WHITELISTFILE
for IP in `cat $WHITELISTFILE`
do
ipset -q -A Whitelist $IP
echo $IP
done
ipset $SAVE > $DIR/IPSET_Rules.txt
;;
backup)
#echo "Backing Up Current IPSet Rules"
logger -st "($(basename $0))" $$ "Creating IPSET rule backup to "$DIR"/IPSET_Rules.bak ... ... ..."
cp -f $DIR/IPSET_Rules.txt $DIR/IPSET_Rules.bak
;;
init)
# ....called from firewall-start?
if [ X"`nvram get fw_log_x`" = X"drop" ]
then
logger -st "($(basename $0))" $$ "Correct 'logdrop' Setting Detected"
else
logger -st "($(basename $0))" $$ "Setting 'logdrop'....."
nvram set fw_log_x=drop
nvram commit
fi
if [ X"`nvram get fw_enable_x`" = X"1" ]
then
logger -st "($(basename $0))" $$ "Correct 'firewall' enabled Setting Detected."
else
logger -st "($(basename $0))" $$ "Setting 'enable' firewall....."
nvram set fw_enable_x=1
nvram commit
fi
logger -st "($(basename $0))" $$ " © 2016-2017 Martineau, IPSET Dynamic blocking initialisation Starting....."
iptables -D logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options 2> /dev/null > /dev/null
iptables -D INPUT -m set $MATCH_SET Whitelist src -j ACCEPT 2> /dev/null > /dev/null
iptables -D INPUT -m set $MATCH_SET Blacklist src -j DROP 2> /dev/null > /dev/null
iptables -D logdrop -m state --state NEW -j SET --add-set Blacklist src 2> /dev/null > /dev/null
# 'init' will restore IPSETs from file but 'init full' will re-create empty IPSETs
if [ -s "${DIR}/IPSET_Rules.txt" ] && [ -z "$2" ]; then
logger -st "($(basename $0))" $$ "IPSET "$DIR"/IPSET_Rules.txt found... restore starting...."
ipset $RESTORE < $DIR/IPSET_Rules.txt
else
logger -st "($(basename $0))" $$ "IPSETs: Whitelist & Blacklist being created....."
ipset -q -F Whitelist
ipset -q -F Blacklist
ipset -q -X Whitelist
ipset -q -X Blacklist
ipset -q -N Whitelist $NETHASH
ipset -q -N Blacklist $IPHASH
fi
RULENO=`iptables -nvL INPUT --line | grep "lo " | awk '{print $1}'`
RULENO=$(($RULENO+1))
#logger -st "($(basename $0))" $$ "**DEBUG RULENO="$RULENO
iptables -I INPUT $RULENO -m set $MATCH_SET Blacklist src -j DROP
iptables -I INPUT $RULENO -m set $MATCH_SET Whitelist src -j ACCEPT
if [ "$?" -gt 0 ];then
RC=$?
logger -st "($(basename $0))" $$ "**ERROR** Unable to add - INPUT $MATCH_SET Whitelist RC="$RC
echo -e "\a`iptables -nvL INPUT --line >> /tmp/syslog.log`"
fi
logger -st "($(basename $0))" $$ "IPSETs: 'Whitelist & Blacklist Blocking enabled"
iptables -I logdrop -m state --state NEW -j SET --add-set Blacklist src
ipset -q -A Whitelist `nvram get lan_ipaddr`/24
# Remember to manually include all VLANs e.g. 10.0.0.0/8 see /jffs/configs/IPSET_Whitelist
esac
# Summary
if [ ! -s "$bannedips" ]; then
OLDAMOUNT=0
else
OLDAMOUNT=`cat "$bannedips"`
fi
if [ `ipset -L Blacklist | grep -vE "^[NTRHSM]" | wc -l` -gt 0 ]; then
expr `ipset -L Blacklist | grep -vE "^[NTRHSM]" | wc -l` > $bannedips
NEWAMOUNT=`cat $bannedips`
else
NEWAMOUNT=0
fi
logger -st "($(basename $0))" $$ "Summary Blacklist: $OLDAMOUNT IPs currently banned. `expr $NEWAMOUNT - $OLDAMOUNT` New IP's Banned. "
Last edited:
